Privacy
Please Unbox runs on the ckrets.ai API. Your secret is locked in your browser for riddle and dated boxes, so we cannot read it; a game box's secret is held under our key until the judge passes an answer.
What we keep, and for how long
We keep IP addresses for 90 days for abuse and legal requests, never for ads. One access record for every box, kept by the ckrets.ai API on Please Unbox's own schedule (90 days; the API keeps 30 for its other uses):
- Box made: the IP address, the time, the browser, your ckrets.ai account ID if you signed in, and the bot check's result. 90 days.
- Box opened: the IP address, the time, the browser, the account ID if any. 90 days.
- Box reported: the reporter's IP address and time, the reason, the link if given. 90 days, or a year if the report goes on to the authorities.
The record is encrypted, deleted automatically after 90 days (a year for anything reported to the authorities or under a request to preserve records), never joined to analytics and never used for ads. Our own counts of boxes made and opened per day hold numbers only, with a salted address hash that changes every day, never a raw address.
The box itself:
- The secret: until the box opens for good or expires. Riddle and dated boxes hold only ciphertext we cannot read.
- The box's record (what its status page reads): until 30 days after it expires.
- When it was made and opened, its size, its rules, and who made it (an account ID or a hash of the address): 13 months.
- Receipt identifiers, so a receipt can be checked against our record: 13 months.
Who can ask for it
Only valid legal process (a subpoena, court order or warrant), an emergency where someone's life or safety is at risk, or a request to preserve records, scoped to the boxes it names. Reading the record takes two people.
What not to put in a box
Passwords, health information or payment data. A box is a gift and a game, not a vault.