Privacy Policy

This policy explains what Hive House Games, a sole proprietorship (“Hive House Games,” “we,” “us”) collects when you use this site, why we have it, who else touches it, and how to get it removed.

It covers two kinds of people: account holders, who sign up to host events or keep their scores, and players, who join a game with a code and never make an account at all. We ask players for the least we can: a display name, and the answers they type during the game.

If you make an account:

• Your email address, and a password stored only as a hash we cannot reverse. If you sign in with Google, we receive your email address and name from Google instead of a password.
• Your display name and, if you upload one, your avatar image.
• Your plan, and the subscription records that go with it.
• The events you create, including the title, description, date, venue or call link, capacity, and visibility you set.
• The questions, clues, puzzles, and media you upload.

If you play a game:

• The display name you choose for that game.
• Your answers, your scores, and where you finished.
• Which event and round you took part in.

Once ticketing launches, we will also hold order and ticket records: what was bought, for which event, at what price, and whether it was refunded. We will not hold the card number.

Automatically: our hosting provider keeps standard server logs, which include IP addresses and request details, for operations and security. We also store a keyed hash of your IP address for a short time, up to about an hour, so we can limit repeated attempts to sign in, sign up, or join a game and protect the service from abuse. It is a hashed value we cannot turn back into your actual address, and it is deleted automatically once that window passes. We do not build advertising profiles and we do not track you across other sites.

We use what we collect to:

• Run the games and events themselves, including scoring, leaderboards, and showing a player their own result.
• Keep your account working, sign you in, and let you recover access.
• Avoid repeating questions a signed-in player has already answered, across every event they play.
• Email you about your account, your events, and things that go wrong. You can unsubscribe from the new-games list at any time; we cannot unsubscribe you from an email about your own account.
• Enforce the rules in the terms, including the banned-word filter on display names and typed answers.
• Take payment and pay hosts out, once ticketing launches.

We do not sell personal information. We do not share it for cross-context behavioral advertising. There are no advertising pixels or data brokers involved in this platform.

A small number of companies process data on our behalf so the platform can work. They are bound to use it only to provide their service to us.

• Stripe will handle payments and payouts once ticketing launches. Card details go to Stripe, never to us. Hosts who take payouts complete Stripe’s own identity verification with Stripe, including any bank and tax details, and we never see or store them. We receive the fact of a payment and its status.
• Cloudinary stores and serves uploaded media: avatars, event cover images, and puzzle images.
• Resend delivers our email, so it processes the address a message is sent to and the contents of that message.
• Neon hosts the database, and Vercel hosts the application and the socket server runs on Render.
• LocationIQ powers venue address suggestions when a host is creating an event. It receives what the host types into that one field.
• Google, only if you choose to sign in with a Google account.

Images you upload are served from Cloudinary and can be viewed by anyone who has the link. The address is long and not guessable, and we do not list or index it, but it is not protected by your login. Anyone you send the link to can open it, and so can anyone they forward it to.

This applies to avatars, event cover images, and puzzle media. Treat it the way you would treat anything posted publicly, and do not upload an image that would cause harm if the link were passed on.

We set a small number of strictly necessary cookies and nothing else. No analytics, no advertising, no third-party trackers. Each one is listed, with what it does and how long it lasts, in the cookie policy.

• Account data stays while your account is open.
• Events, questions, and game results stay while the account that owns them is open, because a host's past events and question bank are the thing they built.
• Deleted events are hidden from everyone but retained, so that attendees' own records and played rounds are not destroyed along with them.
• Server logs are kept on our hosting providers' standard schedules.
• Once ticketing launches, order and payment records will be kept as long as tax and accounting rules require, which is longer than an account may last.

Email hello@hivehousegames.com from the address on the account and ask us to delete it. We will confirm, then delete.

What gets deleted: your account, your email address, your display name, your avatar, your events, and the questions and media you uploaded.

What survives, and why: game results belonging to other players are theirs, not yours, so a round other people played does not disappear because the host closed an account. Once ticketing launches, records of money that moved will be retained where tax and accounting rules require it. Anything retained is kept for that purpose only.

We are building a self-serve delete button. Until it ships, email is the way, and it is a real person who answers.

United States state privacy laws, including California’s, give residents of covered states rights over their personal information. We extend these to everyone who uses the platform, rather than checking which state you are in before deciding whether to help you.

• Know what personal information we hold about you and why.
• Get a copy of it.
• Correct it if it is wrong.
• Delete it, subject to the retention rules above.
• Opt out of the sale or sharing of personal information. We do neither, so there is nothing to opt out of, and this is covered under Global Privacy Control below.
• Not be treated differently for exercising any of these rights.

To exercise any of them, email hello@hivehousegames.com from the address on your account. We may need to confirm it is you before we hand over or delete anything, which protects you rather than us. If we turn a request down, we will say why.

We honor the Global Privacy Control signal. If your browser or extension sends the Sec-GPC: 1 header, we treat it as a valid opt-out of the sale or sharing of your personal information. No setting to change, no banner to dismiss.

Your browser did not send a Global Privacy Control signal with this request. This line is read live from the request, so it changes if you enable the signal and reload.

What honoring it actually changes today: nothing, because we do not do the things it opts out of. The signal opts you out of the sale of personal information and of sharing it for cross-context behavioral advertising. This platform does neither. There are no ad pixels, no third-party analytics, and no data brokers. We would rather write that plainly than imply a switch that has nothing to switch off.

The check is in the code, not just on this page, so that it is already in place if anything is ever added that the signal would need to govern.

If we discover that personal information has been exposed to someone unauthorized, we will notify affected people as required by California Civil Code sections 1798.29 and 1798.82, and by the equivalent law of your state.

We will notify in the most expedient time possible and without unreasonable delay, once we have worked out the scope and restored the integrity of the system. A notice will say what happened, when, what kinds of information were involved, what we have done about it, and what you can do. We will send it to the email address on your account.

Where a breach affects more than 500 California residents, we will also submit a sample notice to the California Attorney General, as that law requires.

Accounts are for people 13 and over. Hosting an event or receiving a payout requires you to be 18 or over. We do not knowingly collect personal information from a child under 13, and we do not allow under-13 accounts.

Children can play without an account, and that is the normal case at a youth event. A player joins with a code, picks a display name, and answers questions. No email address, no sign-up, no account. What we hold is a display name, answers, and a score, tied to that event.

Hosts running events for children are responsible for the consent and supervision their own setting requires, whether that is a school, a church, a club, or a party. Display names are filtered automatically, but a host can remove any player at any time.

If you believe a child under 13 has created an account, email hello@hivehousegames.com and we will remove it.

If this policy changes, the date at the top of the page changes with it, and we will email account holders about anything material. Questions, requests, and complaints all go to hello@hivehousegames.com.