Privacy Policy

Effective and last updated: 16 October 2026

Who operates HackBox

HackBox is operated by HJV Ventures, a business registered in Malaysia, under the Hider Studios brand. Contact admin@hiderstudios.com for support, privacy questions, account requests or to reach the operator.

Social sign in

We use Supabase Authentication and the sign-in providers enabled in HackBox. Google and GitHub are the selected sign-in methods; availability is shown on the sign-in screen. X is an unavailable placeholder and does not start a sign-in flow. Your provider may supply an account identifier, email address, name or username, profile picture and email-verification information. We use this information to authenticate you, associate your account with its saved game data, manage account access and provide support. We do not receive your provider password.

HackBox requests basic identity information, not access to your Gmail inbox, Google Drive, GitHub repositories or social posts. Your provider separately handles the sign-in page under its own policies. Revoking a provider's access does not, by itself, delete the HackBox account or its saved data.

Game and device data

HackBox stores account identifiers, PC profile information, game progression, demo-access state, virtual balances and items, purchases made with game currency, contracts, game events and settings needed to operate the simulation.

PC saves, simulated files, Terminal history, Mail, notes, bookmarks and selected preferences in the PWA and iOS app are stored on your device and synchronized to a private cloud checkpoint for your signed-in account. Signing in to the same account on another device lets you continue from its last successfully synchronized save. The service uses a per-open writer identifier and save revisions to prevent an older device from silently replacing a newer checkpoint. These are essential save controls, not optional product analytics.

The Android app keeps full PC progress on that device after import. Paid accounts can upload a private transfer copy from the original PWA or use Android Options → Transfer progress to export/import when moving devices. Signing in restores paid access; it does not continuously synchronize Android PC progress. Transfer copies contain the same game-save data described above and remain private to the account. Keep the original device until the import is verified. Export before uninstalling or clearing Android app data; changes since your last export can otherwise be lost.

Previously device-only saves upload when you next open that PC with an updated, connected client. Unsynchronized changes can remain only on the original device. Keep that device's storage until Cloud saved appears or you return to the menu successfully. If different unsynchronized saves exist, you choose which version to continue; a recovery copy is retained locally. Clearing app/browser data or uninstalling can remove local unsynchronized changes and recovery copies.

Fictional Terminal commands, simulated files, Mail, notes and other game content can form part of gameplay requests, game state or saves. This does not mean that we collect them as product analytics. Do not enter real passwords, sensitive personal information or real-world attack data into the simulation.

Hosting, authentication and security services may process request metadata such as IP addresses and browser information to deliver the game, authenticate sessions and investigate abuse. This is separate from optional product analytics.

Optional analytics and replay

Updated 15 October 2026.

PostHog product analytics are optional and disabled for you unless you opt in. Replay additionally requires its own opt-in, with sampling configured at 10 percent of eligible sessions. You can change these preferences in Options or Settings. Declining optional analytics or replay does not prevent gameplay.

The analytics design records limited game events, such as installation, sign-in method, onboarding milestones, chapter completion, demo completion and error categories and foreground gameplay presence. Consented game activity includes simulated Wi-Fi names/security, visible simulated host addresses and inspected service ports/products, tool actions and outcomes, installed tools, file-download counts and the actual scope/privilege of access. These are simulation records, not scans of your real network or device. Raw commands, passwords, file contents and other players' account identities are excluded. If you accept the updated analytics notice, we link these events to your registered game name, sign-in email, PC profile names and machine names in PostHog. A stable internal ID keeps repeat visits together. Earlier permission for opaque analytics does not permit this expanded collection: existing participants must choose again. Analytics identity is reset on logout.

Registration and PC totals are measured from service records as aggregate counts, with a measurement time. These totals contain no player identifiers and include accounts that decline optional analytics. The active-player and named-player reports cover consenting participants only; they do not represent all registered accounts.

Replay is configured to mask text, inputs and element attributes and exclude account details, Terminal, Mail, files, notes, editors and other private game areas. Product telemetry excludes tokens, URL queries, raw commands, console logs, and network request or response bodies. Private game saves are not treated as replay data. Collection remains off when consent is declined or withdrawn.

Withdrawing consent stops future optional collection; it does not automatically erase information collected previously. Contact us if you also want to request deletion of previously collected information.

Full-game payments

When web checkout is available, RevenueCat and its connected payment provider handle checkout and payment information under their own policies. HackBox sends an opaque billing customer ID linked to your account to verify and restore the full-game entitlement. HackBox stores purchase-verification and entitlement records needed to provide access, reconcile refunds and prevent duplicate grants. These required purchase records do not depend on optional analytics consent. HackBox does not receive or store your full payment-card details.

Service providers and sharing

Netlify hosts the website, Supabase provides authentication and server-backed game services, and the chosen identity provider handles social sign-in. PostHog provides optional product analytics and replay only when you consent.

We use these service providers to operate and protect HackBox and handle support requests. We do not sell personal data or use sign-in information for advertising. We may disclose information where legally required or necessary to address security incidents. Our providers may process data outside your home country. Their own policies also apply to the services and accounts they provide.

Retention and deletion

Account and server-backed game information are retained while needed to provide your account and preserve progress. We review verified closure or deletion requests and fulfil them within seven days of ownership verification, removing or de-identifying information no longer needed, subject to security, technical and legal requirements. Some game records are immutable journals and need separate review rather than a blanket database deletion.

Infrastructure logs and backups follow the providers' configured retention and backup cycles, rather than disappearing immediately when a request is received. If optional analytics or replay is enabled, its retention settings and this notice will be reviewed before collection starts. No automatic inactivity deletion is promised. The seven-day request fulfilment period is subject to the retained-record and backup exceptions above.

Contact admin@hiderstudios.com to request account or data deletion. We may need to verify ownership before acting. Deleting an account can permanently remove server-backed progress. Provider accounts and copies retained by those providers are managed separately. Local browser data can be removed through your browser or device settings.

Your choices and rights

You can use the available account settings, change optional telemetry consent, sign out and manage the provider connection through your provider's account settings. Contact us to request access, correction or deletion of your information, withdraw applicable consent or ask a question about its use. Essential account and game data are needed to authenticate you and provide saved gameplay; if you do not supply them, an online game account cannot be provided. Optional analytics and replay are not required. Applicable statutory rights are not limited by this notice. You can also contact the relevant data protection authority, including Malaysia's Personal Data Protection Department.

HackBox is for players aged 13 and above, or a higher age where required by law or the chosen provider. It is not intended for children under 13. If you are under 18, your parent or legal guardian must review these policies and consent to your use and the processing of your information before you continue. Contact support if you need help with this requirement. We do not claim to verify ages or guardian relationships through social sign-in. Do not use a false birth date or share someone else's provider account. Contact us if an account does not meet the applicable requirements.

Changes and contact

The effective date will be the date this policy is first published, shown on the public page. Material changes to data use will be communicated before the changed use begins, with renewed consent where required. Privacy enquiries: admin@hiderstudios.com.