Privacy Policy

This policy explains what Hostrivia collects when you host or play a game night, why we hold it, who else touches it, and how to get it back or have it removed. It is written to be read, not to be survived. If anything here is unclear, email [email protected] and ask.

Hostrivia is operated by [Company legal name], [Registered address]. For anything about your data, we are the data controller and the contact is [email protected].

Two kinds of people use Hostrivia

The difference matters, because we hold almost nothing about the second group.

• Hosts have an account. They sign up, log in, set games up and run them. Most of this policy is about hosts.
• Players join a host's room from their phone with a room code. Players do not create an account, and we do not ask them for an email address. See Players who join a room.

What we collect from hosts

What you give us when you sign up

• Your email address and a password. We never store the password itself — only a one-way hash of it, which cannot be turned back into your password.
• Which plan you chose at signup (Free or Paid), and the language the signup page was in.
• The date and time you accepted the Terms of Service and this policy.

What you can add to your profile

All of this is optional, and all of it is editable or removable from your profile:

• Display name (the host name that appears on the big screen).
• Venue name and the name of your quiz night.
• Country and city.
• Date of birth.
• Preferred language and the game you host most often.
• Your email preferences — which kinds of email you are happy to receive.

What we record as you use the site

• Game history. One row per game you host: which game, the label on it, how many players took part, how they joined, and when it started. We do not keep a transcript of the game.
• Product events. A short, coarse record of milestones in your account — signing up, finishing onboarding, hosting a first game — so we can see where the product loses people.
• Signed-in devices. For each active login session: the IP address and browser user-agent it was created from, when it was last seen, and when it expires. This is what lets you review and sign out other devices from your profile, and it is how we spot a session that is not yours.
• Page counts. A daily total of how many times a page was loaded. No cookie, no identifier, nothing per-visitor — just a number that goes up.
• Usage counters. How many games you have started this month, so the Free plan's monthly game credits can be counted.

What you create

• Question packs, boards, prompts and saved setups — including anything you write yourself and anything you have generated with AI. These are private to your account unless you deliberately share them.
• Support requests and the messages in them, plus whatever context you attach to them.
• Feedback: game ratings, content reports, feature requests, satisfaction scores and any comment you add.

Email records

For every email we send you we keep the address, the subject, which template it was, the send status, and what the delivery provider told us afterwards (delivered, bounced, complained). This is how we can tell you honestly whether a confirmation email actually arrived. Bounces and complaints add your address to a suppression list so we stop mailing an address that does not want us.

Players who join a room

A player types a room code and a display name. That name, and their answers and scores, live in the running game in server memory for as long as the room is open, and are gone when it closes. We do not store player names, answers or scores in our database, we do not ask a player for an email address or a date of birth, and we do not build a profile of a player.

The player's phone keeps a small token in its own browser storage so that refreshing or losing signal puts them back in the same seat instead of kicking them out. That token stays on their device.

Why we hold it

To give you the service you asked for

Running your account, authenticating you, hosting games, counting plan credits, and delivering the emails the service depends on (confirming your address, resetting a password).

Because we have a legitimate interest in the product working

Keeping the service secure and abuse-free, answering support requests, understanding at a coarse level which parts of the product work, and telling you about changes that affect your account.

Because you agreed to it

Optional emails such as product news. You can turn these off at any time from your profile or the unsubscribe link in any of them, without losing the service emails you need.

We do not sell your data. We do not share it with advertisers. We do not run ad networks, analytics scripts or tracking pixels on this site.

Cookies and browser storage

There is no cookie banner here because there is nothing to consent to. We use:

• An authentication cookie once you log in. It holds a session token, nothing else, and it is what keeps you logged in. Strictly necessary — the site cannot work without it.
• A language cookie remembering whether you picked English or Spanish. A preference, not an identifier.
• Your browser's own local storage, on your device only, for things like a game setup in progress, a dismissed hint, and a player's seat in a room. We cannot read it from the server.

Who else processes it

We keep the list of companies with access to your data as short as we can. Each one acts on our instructions:

• Render — hosts the application.
• Supabase — hosts the database.
• Resend — sends our email and reports what happened to it.
• Cloudflare — DNS, and routing mail sent to our own address.
• OpenAI — generates a question pack when you ask for one. Your prompt is sent so a pack can come back. Do not put anything confidential in an AI prompt.

We may also disclose data if the law requires it, or to protect the service, our users or ourselves from harm or abuse.

Where it is held

Our hosting and database run in [Hosting region], and some of the providers above operate internationally, so your data may be processed outside [Jurisdiction] under the transfer safeguards those providers offer.

How long we keep it

• Your account — for as long as it exists, and then removed as described below.
• An account whose email was never confirmed — deleted automatically about 24 hours after signup, along with the packs, boards and history attached to it. If you never got the confirmation email, sign up again.
• Login sessions — until they expire or you sign the device out.
• Support requests and feedback — kept while they are useful as a record of what we were asked and what we changed.
• Email delivery records — kept as a delivery log, and suppression entries kept for as long as needed to stop mailing an address that asked us not to.
• Daily page counts — kept indefinitely, because they contain nothing about anyone.

Your choices and your rights

Depending on where you live you may have the right to a copy of your data, to have it corrected, to have it deleted, to restrict or object to how we use it, and to complain to your data protection authority.

• Correct it yourself. Most of what we hold about you is editable from your profile.
• Change what we email you. From your profile, or the unsubscribe link at the bottom of any optional email.
• Get a copy, or have your account deleted. Download your data or delete your account from your profile at any time, or ask us at /support or [email protected] if you would rather we did it.

We aim to reply to any privacy request within 2 business days, and to complete it within [statutory response period].

Age

Hostrivia host accounts are for adults, and you must be at least [minimum account age] to create one. NoFilter is an 18+ game: its prompts are written for adults, and both the host and the players are asked to confirm that everyone playing is 18 or older. We do not knowingly collect data from children. If you believe a child has given us data, email [email protected] and we will delete it.

Security

Passwords are stored only as hashes. Traffic runs over HTTPS, and the connection to our database is encrypted. Sessions can be reviewed and revoked from your profile. No system is perfect: if something goes wrong that affects you, we will tell you.

Changes to this policy

When we change something that matters, we update the date at the top of this page, and for a significant change we will also tell account holders by email. Continuing to use Hostrivia after a change means you accept the updated policy.

Contact

Email [email protected], or open a request at /support if you have an account. More ways to reach us are on the contact page.