1. The short version
hourofjoy.wiki is run from and hosted in the United States. We collect as little as we can.
- We ask for an email address. Nobody else ever sees it.
- No real name. No address. No phone number.
- No ads. No trackers. No analytics.
- We do not sell or rent your information to anyone.
- Cookies are only used to log you in and to remember two choices you make on your first visit.
2. What we collect
You can read the whole wiki and forum without an account. If you make an account, we store:
- Your username.
- Your email address, and whether you have confirmed it.
- Your password, stored in scrambled (hashed) form. We cannot read it.
- The three security questions you picked, and your answers in scrambled form. We cannot read the answers either.
- The profile picture you picked from our list.
- Your bio, if you write one.
- The threads and posts you make.
- Dates and times: when you joined and when you posted or edited.
- A login record that matches the cookie in your browser.
- If you turn on two-factor login: the secret key your authenticator app uses, and scrambled copies of your backup codes.
- Short lived codes behind the links we email you. They are stored scrambled and they expire.
- If you report a post: which post it was and the reason you picked.
- Alerts: a note that someone replied in your thread or quoted you, so the site can show it to you. Alerts are deleted after 60 days.
- A log of what moderators do, such as removing a post or banning an account.
- If you use the Market: a yes that you are 18 or over (never your date of birth), and the listings you post. A listing holds the link, the title, the price, the photos and, for eBay, the public eBay seller name and rating.
- For the picture check on the sign-up and forgot-password forms: a record of which pictures were shown and which one was right. It is not tied to you and it is deleted within ten minutes.
When you sign up we ask for your date of birth. It is used once, to check your age, and it is not saved.
When you pick a new password, we check whether it has appeared in a known data leak, using the Pwned Passwords list run by Have I Been Pwned. Your password is not sent. It is scrambled on our server, and only the first five characters of the scrambled form go out. Nothing about you or your account goes with it, and the list cannot tell which password was checked.
When someone posts an eBay listing, the site asks eBay for that listing by its item number. Nothing about you goes with the question. Listing photos are stored on eBay and Mercari. This site fetches them and passes them on, so your browser only talks to this site when you look at the Market. Following a listing's link takes you to eBay or Mercari, which have their own privacy policies.
The picture check is made and checked by this site. No outside captcha company is involved, and nothing about you is sent to one.
To stop password guessing and floods of fake accounts, we keep a count of login, sign-up and password-reset attempts. Each one is stored against a scrambled value made from the address the request came from. The address itself is not stored, and the count is deleted after a day.
Posts, thread titles and bios are checked by the site for email addresses, phone numbers and street addresses, and are refused if they hold one. This is done to stop anyone, children above all, from posting personal details in public.
3. What we do not collect
- Your real name, home address or phone number.
- Payment details. The site is free.
- Your location.
- Anything from your contacts, camera or microphone.
Please do not put personal details like these in your posts or your bio. Those are public.
4. What your email is for
- Confirming the account is yours.
- Sending a link when you ask to reset your password.
- Telling you about security matters on your account.
- Answering you when you write to us.
We do not send newsletters or ads, and we do not give your email to advertisers.
5. Server logs
Like any website, the servers that host this site can record technical details of each visit, such as IP address, browser type and time. Those logs keep the site running and help stop abuse. We do not tie them to your forum account.
6. Cookies
- hoj_session keeps you logged in for up to 30 days. It is deleted when you log out.
- hoj_2fa lasts five minutes. It only exists between typing your password and typing your two-factor code.
- hoj_unofficial lasts one year. It remembers that you were told this is a fan site and pressed Proceed.
- hoj_cookies lasts one year. It remembers that you accepted cookies.
- hoj_wait lasts one day. It is set when a sign-up is turned away because of the date of birth given, so the same browser cannot simply try again. It holds no information about you.
There are no advertising cookies, no analytics cookies and no cookies from other companies. hoj_unofficial and hoj_cookies hold no information about you. They only stop the two notices from showing again.
If you press Reject on the cookie notice, those two cookies are not kept and the notices will show again on your next visit. The login cookies are only set if you log in, because logging in cannot work without them.
7. Who can see it
Public: your username, profile picture, bio, posts, join date and post count. Anyone on the internet can see those, including search engines.
Private: your email address, your password, your security questions and answers, and your two-factor details. They are never shown on the site. Staff cannot see your password or your answers.
- The company that hosts the site processes data for us so the site can run.
- An email delivery service sends our account emails. It receives your email address and the message.
- We hand over information if the law requires it, for example a valid court order.
- We may share information when needed to protect someone's safety or the site itself.
We do not sell, rent or trade your information.
8. Children
The wiki and the forum are for adults and children alike. Anyone can read all of it without an account, and reading does not ask for or store anything about you.
Accounts are only for people 13 and older. Sign-up asks for a date of birth. Anyone under 13 is turned away, and nothing they typed is kept. We do not knowingly collect personal information from anyone under 13.
There are no private messages and no uploads, and posts cannot carry emails, phone numbers or addresses. Any member can report a post to the moderators.
If we learn that an account belongs to someone under 13, we remove the account, its details and everything it posted.
If you are a parent or guardian and you think your child under 13 has an account, email [email protected]. We will remove the account and what is tied to it.
9. Your choices
You can change your profile picture, bio, email, password and security questions, and turn two-factor login on or off, in Settings.
You can delete your account yourself in Settings. That removes your email, your profile and your login for good, and your posts too if you tick the box.
To get a copy of what we hold on your account, or to fix it, email [email protected] from the address on your account.
When an account is deleted, its posts may stay up, as the Terms of Service explain. If a post contains personal information about you, tell us and we will remove it.
Some US states give their residents extra privacy rights. We do not sell or share personal information for advertising, and anyone can make the requests above no matter where they live.
10. How long we keep it
- Account details, including your email: until the account is deleted.
- Posts: for as long as the forum runs, unless removed.
- Login records: up to 30 days, or until you log out.
- Email link codes: 24 hours for confirming an email, one hour for a password reset.
- Server logs: a short period set by the hosting company.
11. Security
Passwords and backup codes are hashed before they are stored, and the live site is served over an encrypted connection. Two-factor login is there if you want a second lock. No website can promise perfect security.
Use a password you do not use anywhere else.
12. Where your information is
The site is operated from and hosted in the United States. If you use it from another country, your information is stored and processed in the United States, where privacy laws may differ from yours.
13. Do Not Track
We do not track you across other websites, so a Do Not Track signal from your browser does not change anything here.
14. Changes to this policy
We can update this policy. The date at the top shows the latest version. If we ever start collecting something new, this page will say so before it happens.
15. Contact
Privacy and legal requests go to [email protected]. Everything else goes to [email protected].