Privacy notice

Who we are

Hunchbox is a trading name of Chief Technology Limited, registered in England and Wales, company no. 16532368, registered office 36a Hiltingbury Road, Eastleigh, SO53 5SS. We are the controller of the information in this notice.

We are registered with the Information Commission (until September 2026, the Information Commissioner’s Office), the UK’s data protection regulator, under reference ZB998966.

For anything about your information, email [email protected].

What we keep, and why

As a guest: the first name you play under, and a cookie that remembers this device, so you can come back to your game. We need these to run the game you asked to play.

With an account: your email address, so you can sign in with a code we send you; your first name; and your date of birth, to check you’re old enough for an account and for the parts of the game that need it, such as recording. We need these to give you the account you asked for.

Your games: what each game was played for, the rounds, who peeked and who decided, who won, and the scores. Your stats are worked out from these. They are the game itself.

How you lift the lid: the timing of each peek, to keep the game fair and both screens in step. We keep this because we have a legitimate interest in a fair game.

Errors and security: when something goes wrong we record what happened, and we record each sign-in, and the making of each account, with the internet address (IP address) and port it came from, so we can fix problems and keep accounts safe. This is our legitimate interest in a working, secure service.

Where you play from: each time you start or join a game or a party, as a guest or with an account, we keep the internet address and port it came from, your browser and device type, and the first name you played under, for 30 days. We use them only if someone reports a child being harmed, when the law requires us to pass what we have to the National Crime Agency, who may need them to find the person. Mobile networks share one internet address between many people, so without the port the address often can’t be traced. We do this because we have a legal obligation to report, and a legitimate interest in keeping players safe.

Your country: Cloudflare, which passes the website’s traffic to us, tells us which country each visit seems to come from, worked out from its internet address. We use it to apply the law there: the ages in “Outside the UK”, and the countries Hunchbox isn’t offered in. For an account, we keep the country it was made in, because its ages follow that country. For a guest, we keep nothing of it, except the country an answer to “How old are you?” was for (below). We do this because we have a legitimate interest in following each country’s law and in protecting children.

Before a guest plays on video, we ask “How old are you?”. If you’re old enough for video where you are, we keep only that you passed for video in that country, and when, never your age. If you’re not, we keep nothing of your answer, and you can still play in person; for a day, we keep only that this phone’s player answered too young, so the question isn’t asked again until then (a phone that had no player gets one, with only the name it plays as). An account uses its date of birth instead, against the higher of its own country’s video age and the one where it is now. We ask because we have a legitimate interest in protecting children.

Counts across all players, such as how many games were played each day, which never name anyone. We use them to make the game better.

Visits to our website: we count them, so we know how people find Hunchbox and which pages they read. For each page we count its address and title, the page that sent you there, your browser, operating system, type of device, screen size and language, and your country, worked out from your internet address, never anything more precise. We don’t keep your internet address, use cookies, or link a visit to you or your account. Visits on the same day are told apart by a code that changes every day, so nobody can be followed from one day to the next. In the game, we count only that it was opened, never what you do in it. We do this because we have a legitimate interest in knowing how our website is used, and you can switch it off (see “Cookies and storage”).

Emails you send us: what you write and your address, so we can answer you.

Playing on video

A game on video is a live call between you and the other player, through our own video server. Nobody else can join it. We don’t record it unless you both agree (below).

We carry the call because we have a legitimate interest in running the game you both chose to play on video, with the protections in this notice: it reaches only the other player, and nothing of it is kept unless you both agree to a recording. That’s the basis we rely on for every player, including players under 18.

Video replays

We only record a game if you both say yes before the first round, and both of you must be 16 or over and signed in. You’ll see “Recording” at the top while it’s on, and either of you can stop it at any time. We record because you both gave your consent, and you can take it back by stopping the recording.

Only the rounds go in a video. Recording starts a moment before each round so its start isn’t missed, and anything before the round starts, or after its reactions, is never used: “Recording paused” at the top says so between rounds.

Nothing is made during the game. After each round you’re both asked again, and a video of that round is only made if you both say yes. If either of you says no, or stops recording, that round’s recordings are deleted.

To add captions, we turn what you said into text on our own server, then delete the text. Nobody else hears your voice. We never use your voice or your face to work out who you are, and never use them to train any computer model.

Once it’s made, you can both watch, save and share the video. Either of you can share it, and a video that’s been shared can’t be pulled back. We delete it 10 minutes after it’s made, or once you’ve both saved it, whichever comes first, and keep no copy.

Recordings of rounds nobody makes a video of are deleted within an hour at most.

If a replay of you has been posted somewhere you don’t want it: ask the person who posted it to take it down, report it to the site or app it’s on, and tell us at [email protected], and we’ll help. If you ask us to remove an intimate picture or video of you from Hunchbox, we remove it within 48 hours, though we keep replays only minutes anyway.

Anyone else your camera or microphone catches is in the call too, and in a recording if you make one. We keep them no longer than the rest of the round, never try to tell who they are, and rely on our legitimate interest in running the game. Please check anyone nearby is happy to be filmed.

If you’re under 18

Hunchbox is for players aged 13 and over. You need to be 13 or over to make an account, and 16 or over to be recorded. A few countries need older players: see “Outside the UK”.

If you’re under 18, nothing about you is public. We don’t profile you, we don’t show you personalised ads, and we don’t use your location, beyond the country you’re in, to apply the law there.

If something worries you, tell an adult you trust, and tell us at [email protected]. A parent or carer can also write to [email protected] about a teenager’s information.

Outside the UK

Some countries’ laws need players to be older than the UK does. In those countries, these ages apply instead of the ones above. A guest goes by the country they’re playing in, and an account by the country it was made in, so its ages don’t change when you travel. The one exception is video: an account plays on video from the higher of the video ages where it was made and where it is now.

Hunchbox isn’t offered in Brazil or Vietnam yet, because we can’t meet the law there. Anyone opening the game there sees that it isn’t available in their country, and can still read this website.

We go by the country Cloudflare says a visit comes from. It’s an estimate from your internet address, so it can be wrong, for example on a VPN. If we’ve got your country wrong, email [email protected] and we’ll correct it.

Wherever you live, you have the rights in “Your rights” below, and you use them the same way. The law where you live may give you rights of its own too, for example in the EU, some US states, Canada, Australia, New Zealand, India, Indonesia, Kenya and Nigeria. Email [email protected], say where you live, and we’ll answer within a month.

You can also complain to the data protection regulator where you live.

Reports, and keeping players safe

When you report a player or a problem, we use what you send us, and what we keep about the game and the players in it, to look into it and act. We never tell the player you reported who reported them.

A report sent with the form, in the game or on our Safety page, keeps what kind of problem it is, who it’s about, what happened in your words, and your email if you gave one, those last two encrypted. From a game, it also keeps the game, the round, your player and the other player in it; from the Safety page, none of those. A copy goes to our safety inbox. We do this because we have a legitimate interest in keeping players safe, and a legal obligation to deal with reports.

If you gave your email, we send you an email to say we’ve got your report. “Stop these emails” in it forgets your address for that report. We send one address no more than 3 of these a day, so nobody can use the form to fill someone else’s inbox, and none for the same report sent twice.

Some reports are looked at the next morning instead of at once: one that names a game you weren’t in, comes from a device that has never played, repeats one sent in the last day, or comes from someone whose reports we’ve repeatedly found to be baseless. We still read every one, and a report that a child may be at risk, of something sexual, or of self-harm always comes to us at once. If we find someone’s reports baseless, we note it for up to 12 months.

If we suspend a player, we keep which rule was broken, our reason, and when the suspension started and ended, so we can see a player’s past suspensions before deciding again: our legitimate interest in keeping players safe. We tell the player why, by email if they have an account, otherwise in the game.

If a report or anything else we find suggests child sexual exploitation or abuse, the law requires us to report it to the National Crime Agency, with what we have: what happened, and what we keep about the account involved, such as its email address, name and recent sign-ins. We do this because we have a legal obligation to.

For a case we report, the law also requires us to keep its records for 1 year, and its reference for 5 years, even if the account is deleted in the meantime: the account’s name, email and date of birth, its sign-ins from the 2 weeks before, and the games and parties it joined in those 2 weeks, with their internet addresses, ports, browsers and the names played under, and the reports by or about it. That’s why we keep these for 30 days. Nothing else is kept longer because of a report.

In an emergency, we may share what’s needed with the police in the country concerned, to protect someone’s life or safety.

Who helps us run Hunchbox

Hetzner Online runs our server, in a data centre in the EU. Your games, account, recordings and replays are kept there.

Amazon Web Services sends our emails, from London.

Google runs our email inboxes. What you email us, and each report sent from the game or the Safety page, is kept there.

Cloudflare runs our domain’s address book and passes the website’s traffic to our server. It also tells us which country each visit seems to come from.

Our error tracking, logs and visit counts run on our own server, not another company’s.

Each acts only on our instructions, under a contract that protects your information. We never sell it. If we ever share it because the law requires us to, for example with the police, we only share what’s needed.

The EU has data protection laws the UK recognises as protecting your information to the same standard, so information kept there is protected as it is in the UK.

Cloudflare’s network reaches around the world, so it may pass the website’s traffic through places outside the UK and EU. Where it does, Cloudflare is certified under the UK’s data bridge with the US, which the UK recognises as protecting your information, and its contract with us also includes data protection clauses approved under UK law. Email [email protected] for a copy.

Google may keep our emails in its data centres outside the UK and EU, such as in the US. Google is certified under the UK’s data bridge with the US, which the UK recognises as protecting your information, and its contract with us includes data protection clauses approved under UK law.

How long we keep it

Your account, games and stats: while you have an account.

What you type for what’s in the box: 30 days after the game’s last move. After that we keep only that it was your own words.

A guest: 12 months after the guest’s last game. Then the name becomes “A former player” and the device is forgotten.

A guest’s pass for video: with the guest, for as long as above.

A deleted account: your email, date of birth, name and country go straight away, including the names you played each game under, and your internet addresses within 30 days, as for everyone. Your games stay, shown as “A former player”, so other players’ scores don’t change.

Your country, for an account: while you have an account.

Sign-in codes: until they expire, 10 minutes after we send them.

The internet address and port each sign-in came from, and the one the account was made from: 30 days. When you signed in: while you have an account.

The internet address, port and browser each game or party was joined from, and the first name played under in it: 30 days. The game itself stays, as above.

Recordings and video replays: as above, minutes, never more than an hour.

Errors and logs: logs and error reports for 90 days. Backups for up to 6 months.

Visit counts: we keep them, as they can’t identify anyone.

Emails you send us: 12 months.

Reports sent with the form: 12 months. Then we remove what happened, your email, the players and the game, and keep only what kind of problem it was, who it was about, where it was sent from and when, for our records of how we handle reports. Those go at the end of the second calendar year after.

A note that someone’s reports were found baseless: 12 months, or until the account is deleted.

Suspensions: with the player. Once an account is deleted, or a guest forgotten, they no longer name anyone.

A case we report to the National Crime Agency: its records for 1 year and its reference for 5 years, as the law requires. Reports by or about the player in it are kept whole for that year.

Your rights

From your account you can email yourself everything we keep about you and delete your account. The copy leaves out the timing of each peek, which you can ask us for.

You can also ask us to correct what we keep, to stop using it or limit how we use it, to object to how we use it, or for a copy you can take elsewhere. Email [email protected] and we’ll answer within a month.

Where we use your information because you agreed, such as recording, you can change your mind at any time.

If you’re unhappy with how we’ve used your information, you can complain to us at [email protected]. We’ll acknowledge your complaint within 30 days, look into it, keep you told how it’s going, and tell you the outcome without undue delay.

You can also complain to the Information Commission at ico.org.uk or on 0303 123 1113.

Cookies and storage

hb_player remembers this device’s player, so you can come back to your game. It lasts up to 400 days.

The session cookie, and XSRF-TOKEN, keep you signed in and protect your requests. They last while you’re signed in.

The game also keeps a few settings in your browser, such as whether sound is on and the first name you last played under.

These are all needed for the game to work, so the law doesn’t ask us to get your agreement first. We don’t use advertising or tracking cookies.

We count visits to our website without cookies and without storing anything on your device. If you switch counting off below, this browser keeps umami.disabled to remember that, until you switch it back on or clear your browser’s data. If your browser asks websites not to track you (Do Not Track), we don’t count your visits.

Changes to this notice

We’ll change the date at the top when we update this notice. If a change matters to how we use your information, we’ll tell you in the game or by email before it applies.