Cookie Policy

We set a handful of cookies and every one of them is strictly necessary for something you asked for: staying signed in, staying in the game you joined, or finishing a verification step you started.

There are no advertising cookies, no third-party trackers, no Google Analytics, and no pixels. Nothing on this site follows you to another one.

Session cookie. Set when you sign in, so the site knows who you are on the next page. Without it you would be signed out on every click. It is removed when you sign out, and it expires on its own.

Play token, hhg_play_<session>. Set when you join a game. It is what lets you answer as yourself for the rest of that round and claim your own result at the end, without making an account. It is scoped to that one game session.

Event player token, hhg_event_<event>. Set when you join a multi-round event, so you carry across rounds as the same player and your running score follows you. Scoped to that one event.

Pending signup, hhg_pending_signup. Set while you are part-way through creating an account and we have emailed you a verification code. It holds the signup in progress so the code you type matches the one we sent. It is short-lived and is cleared when the signup completes or expires.

Pending email change, hhg_pending_email. The same idea for changing the email on an existing account. It holds the requested address and a hash of the code, never the code itself, so that nothing changes until you prove you can receive mail at the new address.

All of these are signed or encrypted, sent over HTTPS, and marked so that browser scripts cannot read them.

Strictly necessary cookies do not require consent, and strictly necessary cookies are all we set. A banner asking permission for cookies that are required for the site to function would be asking a question with only one answer.

Consent banners come from the EU cookie rules and the GDPR. This platform operates in the United States, US state privacy laws use an opt-out model rather than a consent model, and we do not do the things that model is concerned with. There is nothing here to consent to.

If you send a Global Privacy Control signal, we honor it. What that changes in practice is set out in the privacy policy.

We do not run analytics on this site today. No Google Analytics, no session recording, no heatmaps.

If we add analytics later, it will be a cookieless product such as Vercel Analytics or Plausible, which measure page views without storing anything on your device and without following you between sites. That constraint is written down next to this policy in the code, so that adding a tracker would mean changing the rule on purpose rather than quietly making this page untrue.

Our hosting providers keep ordinary server logs, which include IP addresses and request details. Those are not cookies and are not used to profile you.

Every browser lets you see, block, and delete cookies. Because ours are the necessary kind, blocking them has consequences worth knowing:

• Block the session cookie and you cannot stay signed in.
• Block the play or event token and you cannot join a game, because the game has no way to tell which answers are yours.
• Block the pending-signup or pending-email cookie and you cannot finish signing up or change your email address.

Nothing we set is used for advertising, so blocking it costs you function without buying you privacy from tracking that was never happening.

Questions about this policy go to hello@hivehousegames.com.