Privacy notice

TheHumbleHustler.io BV (company number 0727.441.897, RPR Gent, afdeling Gent, registered office Fraterstraat 190, 9820 Merelbeke, Belgium) is the controller of your personal data. Write to hello@huzzah.show about anything in this notice.

• Your account. Your email address, your name if you give one and the identifier our sign-in provider gives you. Your password is handled by that provider and never reaches us. The provider also records sign-in details such as IP address, browser and time, to keep accounts secure.
• What you agreed to. Which version of the terms of use you accepted, which version of this notice was shown to you when you accepted them, and when.
• Your quizzes. Everything you put in them: titles, questions, answers, team names, links to YouTube videos and the pictures and audio you upload, in Huzzah or from a conversation with an AI assistant you connected to Huzzah. A file you share with an assistant reaches us only when you ask it to add the file to a quiz: our server then fetches it once from the assistant's file storage. For each upload we also keep its size, type and how its rights were stated: the statement you confirmed in Huzzah, or that it came from an assistant.
• Error logs. When something goes wrong on our servers we log the error so we can fix it.
• Access logs. For each request to Huzzah our servers record when it came, what it asked for, how we answered, the browser it came from and its IP address, so a failure or an attack can be traced.
• On your device. Cookies set by our sign-in provider that keep you signed in, and your light or dark choice in your browser's storage. Both are needed for the service to work. When you open your quizzes, one more cookie, host_hint, is set on Huzzah's own domain so Huzzah's website can offer you Open Huzzah instead of Create account. It holds only the number 1: no name, address or account number. It goes when you sign out or delete your account, and otherwise 30 days after you last opened your quizzes. For error reports and usage sharing (section 3), nothing is stored before you choose. If you choose not to share, only a record of that choice is kept in your browser. If you choose to share, a few items are stored by this site only, as cookies and in browser storage. There are never advertising cookies. A quiz with a YouTube clip loads YouTube's player, which can store its own cookies in the browser presenting it (see section 5).

Nothing is collected about the people in the room. They have no device, and the only thing about them that reaches Huzzah is whatever team names you choose to type.

We use PostHog to find out when Huzzah breaks, how our website is used and, if you agree, how Huzzah is used. What is sent depends on the screen and on your choice.

• On the screen the room sees, and on your own pages until you choose or if you choose not to share: error reports only. They describe what went wrong in the app and carry no name and no account. Nothing is stored on the screen the room sees; on your own pages, choosing not to share keeps only a record of that choice in your browser. PostHog tells visits apart with a code it computes from the connection and changes every day.
• If you choose to share, from the card that asks: the pages you open and when a show starts or finishes, plus a recording of your visits with every word, every picture and everything typed hidden. These are linked to your Huzzah account number (never your email address) through a few items stored by this site only, as cookies and in browser storage.
• On huzzah.show, the website that tells people about Huzzah: the pages opened, how far down each was scrolled, where on the page the pointer clicked or rested, which buttons and links were pressed and how fast each page loaded. Nothing is stored in your browser, and these visits are not linked to an account. PostHog tells these visits apart with a code it computes from the connection and changes every day.
• From our servers: counts of quizzes created and accounts joined or deleted, which name no one (a new account is counted with the place on our website its sign-up started from, such as the top of the home page), and reports of unexpected errors, without their message.
• Never: your email address, quiz titles, the questions and answers or anything about the people in the room.

As with any website, PostHog receives the IP address of the browser sending the report. You can change your choice at any time from Usage sharing in the account menu. Signing out forgets it, so the next person on that device is asked again.

• To give you an account, store your quizzes and present them: necessary to perform our agreement with you (GDPR Article 6(1)(b)).
• To keep the service secure and working, which is what the sign-in records, access logs and error logs are for: our legitimate interest in running a safe and reliable service (Article 6(1)(f)).
• To receive error reports, from every screen and whatever you chose, because a quiz night that breaks in front of a room is the failure we most need to hear about: our legitimate interest in keeping a live show working (Article 6(1)(f)).
• To see how Huzzah is used and replay masked visits, only if you chose to share: your consent (Article 6(1)(a)), which you can withdraw as easily as you gave it.
• To keep a record of what you agreed to, so either of us can show it later: our legitimate interest (Article 6(1)(f)).
• To handle reports about unlawful content under the EU Digital Services Act: our legal obligations (Article 6(1)(c)).

• Amazon Web Services EMEA SARL runs our servers, database, file storage and logs, in its Ireland region (eu-west-1).
• Clerk, Inc. (United States) provides accounts and sign-in, and sends the verification emails.
• PostHog, Inc. (United States) receives the error reports and usage described in section 3, and stores them in its EU Cloud in Frankfurt.
• Google Cloud EMEA Limited (Ireland) holds the mailboxes for our addresses, through Google Workspace: what you write to us and what we write back.

If a quiz includes a YouTube clip, the browser presenting it loads the video from YouTube, and our server asks YouTube for the video's title while you build. The player can set YouTube's own cookies. YouTube is run by Google, which handles that data under its own privacy policy rather than on our behalf.

Clerk and PostHog are based in the United States. Transfers to them rely on their certification under the EU-US Data Privacy Framework, with the European Commission's Standard Contractual Clauses as the fallback, as set out in each one's data processing addendum. PostHog stores our data in the EU. Mail held by Google Cloud EMEA Limited can reach Google's own subprocessors outside the EU, under the Standard Contractual Clauses in Google's Cloud Data Processing Addendum.

• Your account, quizzes and uploads: for as long as you have an account. Delete your account from the account menu and they are deleted straight away, together with your sign-in account. If you chose to share, we also delete your usage events and recordings in PostHog. Database backups roll over within seven days after that.
• Deleting your sign-in account at our sign-in provider does the same. You can also ask us, and we delete everything within 30 days.
• Access logs and error logs on our servers: three months.
• Recordings of visits: 30 days.
• Error reports and usage events in PostHog: one year.
• Records of what you agreed to: for as long as you have an account, and afterwards only as long as we need them to show what was agreed.
• A file withheld after a report: until the report and any challenge to our decision are closed.

You can ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it and to receive the data you gave us in a portable form. You can delete your account and everything in it yourself, from the account menu. For anything else, write to hello@huzzah.show. We answer within one month. Where we rely on your consent, you can withdraw it at any time from Usage sharing in the account menu, without affecting what was sent before.

You can also complain to the Belgian Data Protection Authority, or to the authority where you live or work.

When what we collect or who handles it changes, this notice changes first. We tell you with a notice on your quizzes page, well before a new recipient or a transfer outside the EU starts, and list the change below. You are never asked to accept this notice. Changes to what you agree to are in the terms of use, which ask you to accept them again.