What we collect
Playing as a guest (joining a room by QR code): just the display name you type and transient gameplay state. Rooms live in memory and are deleted about an hour after everyone leaves — we keep no record of who played or what happened.
With an account: your email address, display name, and — if you sign in with Google — your Google account's basic profile (name and email). Passwords are stored only as salted scrypt hashes; we cannot read them. We also keep a minimal security log (sign-in attempts, timestamps, IP addresses) to protect accounts from abuse.
With a subscription: billing runs entirely on Stripe. Your card number never touches our servers; we store only Stripe's customer and subscription identifiers and your subscription status.
Cookies & analytics
HostBox uses two kinds of cookies:
Google sign-in
When you use "Continue with Google," we receive your name, email address, and Google account identifier, and use them solely to create and sign you into your HostBox account. HostBox's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We never sell this data or use it for advertising.
Why we process your data (legal bases)
- To provide the service (contract): creating your account, running games, and billing a subscription you've chosen.
- Consent: analytics cookies, where the gate described above applies to you.
- Legitimate interest: the security log (sign-in attempts, IP addresses), kept to detect and prevent abuse of accounts.
Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and its data ("right to be forgotten")
- Receive a copy of your data in a portable format
- Object to or restrict certain processing
- Withdraw analytics consent at any time, without affecting anything processed before
To exercise any of these, email crichards999@gmail.com from your account's address — we respond within 30 days. Withdrawing analytics consent can also be done directly above, any time, with no email needed.
Retention & deletion
Account data is kept while your account exists. The security log is kept for 12 months on a rolling basis and then automatically deleted. Signed-in sessions expire after 90 days of inactivity. To delete your account and its data entirely, email crichards999@gmail.com from the account's address — we'll remove it within 30 days (Stripe retains billing records as required by law).
International transfers
Stripe and Google process data in the United States. Both maintain standard contractual clauses and equivalent safeguards for data originating in the EU/UK.
Who else sees data
Stripe (payments), Google (sign-in, only if you use it, and Analytics, subject to the cookie gate above). Nobody else: no data brokers, no advertising networks. If ads are introduced for free rooms in the future, this policy will be updated first.
Children's privacy
HostBox isn't directed at children under 16 and we don't knowingly collect account data from them. Guest play (no account) requires only a display name and keeps no lasting record.
Questions or complaints
Contact crichards999@gmail.com with any privacy question. If you're in the EU/UK and unsatisfied with our response, you also have the right to lodge a complaint with your local data protection supervisory authority.