Privacy Policy (full legal version)

1. Scope and Acceptance

This Privacy Policy (the "Policy") describes the manner in which the operator of hourofjoy.wiki (the "Operator", "we", "us" or "our") collects, uses, stores, discloses and otherwise processes Personal Information in connection with the website located at hourofjoy.wiki, including the wiki and the forum (collectively, the "Site"). The Site is operated from, and hosted within, the United States of America.

This Policy is incorporated into and forms part of the Terms of Service. BY ACCESSING OR USING THE SITE, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS POLICY AND CONSENT TO THE PRACTICES DESCRIBED HEREIN. IF YOU DO NOT AGREE WITH THIS POLICY, YOU MUST NOT ACCESS OR USE THE SITE.

2. Definitions

"Personal Information" means any information that identifies, relates to, describes, or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual.
"Account" means the registered user account created in order to access the interactive features of the Site.
"Process" or "Processing" means any operation performed on Personal Information, including collection, recording, storage, use, disclosure, and deletion.
"Service Provider" means a third party that Processes Personal Information on behalf of the Operator for the purpose of operating the Site.

3. Personal Information We Collect

Access to the publicly available portions of the Site does not require registration. In the event that you elect to register an Account, the Operator collects and stores the following categories of information:

Identifiers furnished by you, consisting of a username and an electronic mail address, together with a record of whether such electronic mail address has been verified;
Authentication credentials, consisting of your password, which is stored exclusively in salted and cryptographically hashed form and is not recoverable by the Operator in plaintext;
The three (3) security questions selected by you, together with your answers thereto, which answers are stored exclusively in salted and cryptographically hashed form and are not recoverable by the Operator in plaintext;
Where you elect to enable two-factor authentication, a shared secret used to compute time-based one-time passcodes, and cryptographic hashes of the backup codes issued to you;
Profile information, consisting of the profile image selected by you from the catalogue made available by the Operator and any biography you elect to provide;
User-generated content, consisting of the threads, replies and other material you submit to the forum;
Activity metadata, consisting of the date and time of registration and of each submission or edit made by you;
Session records, consisting of a cryptographic hash of the session token stored in your browser, together with its expiration; and
Single-use tokens, stored in cryptographically hashed form and subject to expiration, issued in connection with electronic mail verification, password reset and the two-factor authentication step.

At registration the Operator requests your date of birth for the sole purpose of determining eligibility. The date of birth is evaluated at the time of submission and is not retained.

For the purpose of preventing unauthorized access and abuse, the Operator records attempts to log in, to register and to reset a password. Each such record is associated with a one-way cryptographic hash derived from the Internet Protocol address from which the request originated; the Internet Protocol address itself is not stored, and each record is deleted within twenty-four (24) hours.

Whenever you select a new password, the Operator determines whether that password appears in a publicly known data breach by consulting the Pwned Passwords service operated by Have I Been Pwned. For that purpose the Operator computes a cryptographic hash of the password on its own servers and transmits only the first five (5) characters of that hash; neither the password, nor the complete hash, nor any Personal Information is transmitted, and the service is unable to determine which password was the subject of the inquiry.

Where you elect to post a listing in the marketplace section of the Site (the "Market"), the Operator requests your date of birth for the sole purpose of determining that you are at least eighteen (18) years of age and retains only an indication that such determination was affirmative; the date of birth is not retained. The Operator further records the listings submitted by you, comprising the address of the corresponding listing on a third-party marketplace, its title, price, condition and images and, in the case of listings on eBay, the publicly displayed seller identifier and feedback rating. Listing information for eBay is obtained from eBay Inc. by transmitting the item number of the listing; no Personal Information is transmitted in that request. Listing images are retrieved by the Site from the servers of the relevant third-party marketplace and relayed to your browser.

The automated challenge presented on the registration and password reset request forms is generated and evaluated by the Site itself and involves no third party. The Operator records, for each such challenge, the images presented and the correct selection; such record is not associated with any person and is deleted within ten (10) minutes.

Where another user replies to a thread created by you or quotes your content, the Operator records a notification of that event for display to you within the Site; such notifications are deleted after sixty (60) days. The Operator further maintains a log of moderation actions taken by its staff, identifying the Account and the thread concerned.

Where you report content to the moderators, the Operator records the content reported, the reason selected by you and the fact that the report was made by your Account.

In addition, the servers hosting the Site may automatically record technical information transmitted by your browser with each request, including Internet Protocol address, user agent and timestamp ("Log Data"). Log Data is maintained for purposes of security, diagnostics and abuse prevention, and is not associated by the Operator with your Account.

4. Information We Do Not Collect

The Operator does not request or knowingly collect your legal name, postal address, telephone number, date of birth, government identifiers, payment or financial information, precise geolocation, biometric information, or the contents of your contacts, camera or microphone.

The Operator does not employ third-party analytics, advertising networks, tracking pixels, social media trackers, or cross-site behavioral tracking technologies of any kind.

You are cautioned against including Personal Information in any forum submission or biography, as such material is publicly accessible.

5. Cookies and Similar Technologies

The Site sets only the following first-party cookies. The first two and the last are strictly necessary and HTTP-only. The third and fourth record a choice made by you and contain no personal information:

hoj_session: an authentication cookie set upon successful login, which persists for a period not to exceed thirty (30) days and is deleted upon logout;
hoj_2fa: a transient cookie set upon successful entry of a password for an Account on which two-factor authentication is enabled, which persists for a period not to exceed five (5) minutes pending entry of a one-time passcode;
hoj_unofficial: a preference cookie set when you acknowledge the notice that the Site is an unofficial fan site and elect to proceed, which persists for a period not to exceed one (1) year;
hoj_cookies: a preference cookie set when you accept the use of cookies, which persists for a period not to exceed one (1) year; and
hoj_wait: a strictly necessary, HTTP-only cookie set when a registration is refused by reason of the date of birth submitted, which contains no personal information, persists for a period not to exceed twenty-four (24) hours, and is set irrespective of your cookie preference because it is required for compliance with applicable law.

The Site does not set advertising, analytics or third-party cookies. A notice describing the use of cookies is displayed on your first visit, and no preference cookie is set unless and until you accept. If you decline, the preference cookies are not set, your answers are retained only for the duration of the browser tab by means of session storage, and the notices are displayed again on subsequent visits. The strictly necessary cookies are set only if you log in to an Account, as authentication cannot function without them.

6. Purposes of Processing

The Operator Processes Personal Information solely for the following purposes:

to create, authenticate and maintain your Account;
to display your public profile and your user-generated content;
to transmit transactional electronic mail, namely address verification messages, password reset messages, and notices concerning the security of your Account;
to respond to inquiries and requests submitted by you;
to enforce the Terms of Service and the forum rules, and to detect, investigate and prevent abuse, fraud and security incidents; and
to comply with applicable legal obligations.

The Operator does not Process Personal Information for purposes of marketing, advertising, profiling, or automated decision-making producing legal or similarly significant effects.

7. Disclosure of Personal Information

The following information is publicly displayed on the Site and is accessible to any person, including operators of search engines: your username, profile image, biography, user-generated content, date of registration, and aggregate post count.

Your electronic mail address, authentication credentials, security questions and answers, and two-factor authentication data are not publicly displayed. Neither your password nor your security answers are accessible to any person, including the Operator's staff.

The Operator does not sell, rent, lease or trade Personal Information, and does not share Personal Information for purposes of cross-context behavioral advertising. The Operator discloses Personal Information only in the following circumstances:

to Service Providers, namely the provider of hosting infrastructure for the Site and the provider of electronic mail delivery services, the latter of which receives your electronic mail address and the content of the message transmitted, in each case solely to the extent necessary to perform services on behalf of the Operator;
where required by law, regulation, subpoena, court order or other valid legal process;
where the Operator believes in good faith that disclosure is necessary to protect the rights, property or safety of the Operator, the users of the Site, or the public; and
in connection with any transfer of the operation of the Site, in which event the successor shall be bound by this Policy with respect to Personal Information previously collected.

8. Children's Privacy

The Site is intended for a general audience that includes both adults and children. The publicly available portions of the Site may be accessed by any person, including a child, without registration and without the collection of Personal Information from that person. Registration of an Account is restricted to persons who are at least thirteen (13) years of age. In accordance with the Children's Online Privacy Protection Act, 15 U.S.C. Sections 6501 through 6506, and the regulations promulgated thereunder at 16 C.F.R. Part 312, the Operator presents an age screen at registration that requests a date of birth in a neutral manner, refuses registration to any person whose stated date of birth indicates an age under thirteen (13), retains none of the information submitted in such a refused registration, and prevents the same browser from resubmitting a registration for a period of twenty-four (24) hours. The Operator does not knowingly collect Personal Information from any child under the age of thirteen (13).

As further safeguards, the Site provides no private messaging and no facility for uploading files, automatically rejects user-generated content containing an electronic mail address, a telephone number or a street address, and permits any registered user to report content to the Operator's moderators.

In the event that the Operator obtains actual knowledge that Personal Information has been collected from a child under the age of thirteen (13), the Operator shall delete the relevant Account, the associated Personal Information and the user-generated content submitted through such Account without undue delay. A parent or legal guardian who believes that a child under the age of thirteen (13) has registered an Account may notify the Operator at [email protected].

9. Your Rights and Choices

You may at any time review and amend your profile image, biography, electronic mail address, password and security questions, and enable or disable two-factor authentication, by means of the Settings page of your Account.

You may delete your Account at any time by means of the account settings. Deletion permanently removes the electronic mail address, profile information and authentication credentials associated with the Account and, at your election, the user-generated content submitted through it.

You may request access to, correction of, or deletion of the Personal Information associated with your Account by submitting a request to [email protected] from the electronic mail address associated with such Account. The Operator may take reasonable steps to verify your identity prior to fulfilling any such request, and shall respond within a reasonable period.

Notwithstanding the deletion of an Account, user-generated content previously submitted may be retained and continue to be displayed pursuant to the license granted under the Terms of Service. Upon request, the Operator shall remove Personal Information concerning you that appears within any such content.

The Operator shall not discriminate against you for exercising any right described in this Section.

10. State Privacy Notices

Residents of certain states of the United States may be afforded additional rights under applicable state law with respect to their Personal Information, which may include rights of access, correction, deletion and portability, and the right to opt out of the sale or sharing of Personal Information. The Operator does not sell Personal Information and does not share Personal Information for cross-context behavioral advertising, and accordingly no opt-out mechanism is required. The Operator extends the rights described in the preceding Section to all users irrespective of their state of residence.

11. Data Retention

The Operator retains Personal Information only for so long as reasonably necessary to fulfil the purposes for which it was collected, as follows:

Account information, including your electronic mail address, is retained until the Account is deleted;
user-generated content is retained for the duration of the operation of the forum unless earlier removed;
session records are retained for a period not to exceed thirty (30) days, or until logout;
single-use tokens are retained for twenty-four (24) hours in the case of electronic mail verification, one (1) hour in the case of password reset, and five (5) minutes in the case of the two-factor authentication step; and
Log Data is retained for such limited period as is determined by the provider of hosting infrastructure.

12. Security

The Operator maintains reasonable administrative and technical safeguards designed to protect Personal Information against unauthorized access, use, alteration and destruction, including the salted hashing of passwords and security answers, the screening of new passwords against known data breaches, the hashing of backup codes, session tokens and single-use tokens, the availability of two-factor authentication, and the transmission of data over encrypted connections on the production Site.

NOTWITHSTANDING THE FOREGOING, NO METHOD OF TRANSMISSION OVER THE INTERNET OR OF ELECTRONIC STORAGE IS COMPLETELY SECURE, AND THE OPERATOR DOES NOT WARRANT OR GUARANTEE THE ABSOLUTE SECURITY OF ANY INFORMATION. You are responsible for selecting a unique password and for maintaining the confidentiality of your credentials.

13. Data Location and International Users

The Site is operated from and hosted within the United States of America. If you access the Site from outside the United States, you acknowledge and agree that your Personal Information will be transferred to, stored in and Processed within the United States, the data protection laws of which may differ from, and may be less protective than, those of your jurisdiction of residence.

14. Do Not Track

The Operator does not track users over time or across third-party websites. Accordingly, the Site does not alter its practices in response to "Do Not Track" signals or similar mechanisms transmitted by web browsers.

15. Third-Party Websites

The Site may contain links to websites operated by third parties. This Policy does not apply to, and the Operator assumes no responsibility for, the privacy practices of any third-party website. You are encouraged to review the privacy policy of each website you visit.

16. Changes to this Policy

The Operator reserves the right to amend this Policy at any time. The effective date set forth above shall indicate the date of the most recent revision. In the event that the Operator proposes to collect any additional category of Personal Information, or to Process Personal Information for a materially different purpose, this Policy shall be amended prior to the commencement of such collection or Processing. A simplified summary of this Policy is published for convenience only; in the event of any conflict or inconsistency between such summary and this full text, this full text shall govern and control.

17. Contact

All requests and inquiries concerning privacy, and all legal notices, shall be directed to [email protected]. All other inquiries shall be directed to [email protected].