Privacy Policy

Hijinks runs team games inside chat platforms. This policy explains what we store, why, who processes it and your rights. Short version: we store the minimum needed to run games, our database lives in the EU, we name every processor below, and we never sell data.

Who is responsible

The controller is Hijinks ("we"). Contact for anything in this policy: support@hijinks.team.

What we collect, and why

• Workspace data: workspace/server ID, name, and the channels where games run. Needed to run the service (contract, GDPR Art. 6(1)(b)).
• Player data: platform user ID and display name, game answers and scores. On Slack, Discord and Telegram the bot only receives its own commands, button presses and messages sent to it; it does not read channel conversations, and in DMs it records only game answers. On a chat connected through our webhook API, your own bridge decides what it forwards: a forwarded message that answers nothing in play is accepted and discarded, never stored. (Contract.)
• Team region: on Slack we read each member's time zone setting to estimate where a workspace's team is (for example "mostly US"), so its trivia fits. We store only that workspace-level mix, never anyone's own time zone. An admin can change or override it in workspace settings. (Legitimate interest: making the product fit the team.)
• Celebration dates: if a member chooses to enter them, their birthday (month and day only, no year) and their work anniversary (a full date, so we can count the years). Members enter and delete these themselves from the bot's home tab. (Consent, Art. 6(1)(a).)
• Know Your Team answers: the answers members give to Know Your Team profile questions, which the bot uses to build guess-who rounds. (Consent.)
• Dashboard accounts: when you sign in to the dashboard, the email address and name your chat platform shares with us at sign-in. (Contract.)
• Billing records: your plan, subscription status and billing period. Payments are handled by Stripe as merchant of record; we never see or store card details. (Contract and legal obligation.)
• Waitlist emails: if you join the early-bird list, we store your email, which waitlist you joined and, if you pick one, which chat your team uses. We use it to send a confirmation email when you sign up, then the launch notification and your discount code — no newsletters, no sharing. Every email we send carries an unsubscribe link: one click stops all email to that address. To have the address deleted as well, email support@hijinks.team. We track no opens and no clicks. (Consent.)
• Customer records: waitlist emails, workspace details, and workspace members' names, roles and dashboard sign-in emails are mirrored into a customer-relationship tool (CRM) that we host ourselves on our EU servers, so we know who to contact about launch and billing. No third party has access to it. (Legitimate interest, Art. 6(1)(f): running the customer relationship. You can object at any time by email.)
• Site analytics: self-hosted, cookieless Umami on our own servers. No cookies, no cross-site tracking, and site analytics never leave our infrastructure. That's why there's no cookie banner. (Legitimate interest.)
• Error reports: when something breaks, the backend, the dashboard, this website and the developer portal send an error report to Sentry. Before a report leaves our server or your browser we remove request bodies, cookies, query strings and authorization headers, and the SDK attaches no IP addresses or user profiles. A report from a browser also carries the page address, the browser and operating system version, the language and the time zone. A report can still carry a workspace or user ID inside the error message. (Legitimate interest: keeping the service working.)
• Feedback: when you use "Send feedback" in the dashboard, what you submit goes to Sentry: your message, the name and email in the form (filled in from your account, and yours to change), the page address, the same browser details as an error report and, only if you add one, a screenshot of the page. We use it to answer you and to fix what you report. Your name and email go only with the feedback you send, never with error reports. (Consent: nothing is sent unless you submit the form.)

Chats connected through a bridge

A team on Mattermost or another chat we have no built-in app for plays through a bridge: a small program the team runs on its own servers, which passes messages between its chat and Hijinks. The bridge decides what reaches us. Our reference bridge sends the chat's IDs for the channel and the member who acted, the member's display name, the text of their /hijinks commands, which button they pressed and, only if the team turns typed answers on, every message posted in the game channel and the messages members type to the bot in a direct message. A forwarded message that answers nothing in play is discarded, never stored. We never receive email addresses, avatars, member lists or channel history. What we send back is what to post: the game messages with their buttons and images, addressed by channel ID or member ID. If the bridge collects its events from us instead of receiving them, we hold them for 24 hours and then delete them. Celebration dates are entered by each member with a command, since a bridged chat has no home tab. Everything else in this policy applies the same way. The developer docs list every field.

Game-results pages

When a game ends, the bot can post a link to a results page showing the players' display names and scores. The link is an unguessable token (no sign-in), it is posted only into the channel that played, the page carries no platform user IDs, and it tells search engines not to index it. This is on by default; the workspace owner can turn it off in the dashboard settings, which also makes every existing link stop resolving.

Where it lives, and who processes it

Our database, backups, CRM, analytics and outgoing mail run on servers we rent from Hetzner in the EU. Three services outside our own infrastructure take part in running Hijinks:

We will update this table before adding a processor. If a transfer outside the EU is involved (today: Sentry, a US company, which stores our reports in Germany), it rests on the European Commission's standard contractual clauses in that provider's data processing terms.

Who can see what

• Members see game messages in the channels where they are played, and each member sees and can delete their own stored dates from the bot's home tab.
• Owners and admins: whoever installs the app becomes the workspace owner in Hijinks; on Slack, workspace owners and admins are granted the same role when they sign in to the dashboard. Admins can change settings and export all workspace data (members, scores, custom questions, celebration dates and Know Your Team answers) as a JSON file from Settings → Data. Only an owner can delete the workspace.
• Hijinks staff can reach the database and the dashboard's operator views to run the service and to review reported questions. We do not look at game data except to resolve a support request or an incident.

Security

Platform tokens and webhook secrets are encrypted at rest (AES-256-GCM), all traffic is over HTTPS, and the security page lists the Slack permissions we request, our backup and deletion mechanics and how to report a vulnerability.

Your rights (GDPR)

You can request access, correction, export, or deletion of your data at any time, and object to processing based on legitimate interest. Email support@hijinks.team — we answer within 30 days, usually much faster. Workspace admins can export all workspace data themselves from Settings → Data in the dashboard, and the workspace owner can delete it there; members delete their own celebration dates from the bot's home tab. You also have the right to complain to a supervisory authority: ours is the Spanish Agencia Española de Protección de Datos (aepd.es), and you may use the authority of your own country.

Retention

Game history is kept while your workspace has Hijinks installed. Uninstalling starts a 30-day deletion clock: if the bot is not added back within 30 days, the workspace and everything stored about it are deleted automatically, in one transaction, after any subscription has been cancelled. Deleting the workspace from Settings → Data does the same immediately. Nightly database backups are kept for 14 days, so a copy of deleted data can exist in a backup for up to 14 more days; backups are restored only to recover from a failure, never to bring data back. Waitlist emails are deleted after launch once the discount codes go out, or on request.

Data processing agreement

When your organisation uses Hijinks with its members' data, we act as your processor. A data processing agreement under GDPR Art. 28, with the processor list above as its annex, is available on request and is signed on behalf of Hijinks. Email support@hijinks.team with the subject "DPA".

Changes

Material changes to this policy will be announced in-product before they take effect.