PrivacyPlain answers to what this hotel holds about you, who sees it, who else is involved, and what you can do about it. It is written to match what the site actually does; when the site changes, so does this page.
What we hold
Your account: your username, your email address, a hashed password (never the password itself), the invite code you joined with and who it came from (if you joined with one), and, if you turn two-factor on, its secret and your recovery codes (hashed).
Where you came from: the address you joined from and the one you last used in the hotel, every sign-in attempt at the site with its address and whether it worked, the devices you are signed in on (their address and browser), and, from the hotel, an identifier for the browser you play in. These exist so a ban means something, so a stolen password shows up, and so the owner can tell one person's several accounts apart.
In the hotel: everything the game needs: your avatar, motto, rooms, furniture, friends, badges, currency, trades and purchases. Room chat and private messages are logged by the game server so staff can act on reports. A private message to a friend who is not in the hotel is also kept for them until they next come in, then removed; one nobody comes for is removed after 30 days.
On the site: the comments and reactions you leave, the photos you publish, the reports you file, staff applications you send, and rewards you earn.
An address check: when you join, or sign in from an address your account has not used before, the site asks a service called proxycheck.io whether that address belongs to a VPN, a proxy or a hosting company. The address is the only thing sent. The answer is kept for up to 30 days so the same address is not asked about twice. Depending on the owner's setting, a new account from such an address may have to confirm its email before it can enter the hotel, or may be turned away. A failed check never keeps anyone out.
What we do not do
We do not sell, rent or share your information. There is no advertising and no analytics service. Nothing about you is used for anything but running the hotel.
Who else is involved
Seven services outside the owner's control touch your data, each for one thing:
Cloudflare stands in front of the site and the game connection in production and provides the "are you a person" check on the sign-in and sign-up forms. It sees your address and the pages you request, as any front door does.
The email relay sends the messages the site sends you: confirmations, password resets, and notices about your account. It sees your email address and the message.
proxycheck.io is asked about an address, as described above. It sees the address and nothing else.
Pwned Passwords is asked, when you choose a password, whether it has appeared in a known data breach. Your password never leaves the site: it is hashed and only the first five characters of the hash are sent, which match thousands of possible passwords; the comparison happens here. A password that has leaked is refused. If the service does not answer, your choice stands.
FindRetros, the listing site members vote for Huzo on, is asked whether an address voted for the hotel in the last day: when you sign in, when you press the vote button, and for a quarter of an hour after you leave to vote, so the vote's diamonds can find you. It is sent the addresses you used lately, on the site and in the hotel (at most five, the one you are on first), and nothing else, and answers yes or no. When you vote, your browser visits it like any other site.
YouTube plays the videos and songs members put on in rooms, in its privacy-enhanced mode. While one plays, your browser fetches it from YouTube, which sees your address, as any site you visit does. Nothing is sent to it by the hotel.
KLIPY provides the GIFs members send in room chat. When you search in the GIF window, your browser sends KLIPY your search words; when a GIF shows in chat, your browser fetches it from KLIPY, which sees your address, as any site you visit does. With each request goes a random identifier that this browser made up and keeps, which says nothing about who you are; the hotel sends KLIPY nothing about you. Untick "Show GIFs in chat" in the GIF window and GIFs wait for a click before they load.
Everything else runs on a server the owner controls.
Cookies
huzo.session (in production __Host-huzo) keeps you signed in. It expires after twelve hours of not using the site, or after 30 days if you ticked "remember this device". huzo.trusted is set only when you tell two-factor to trust a browser, for 30 days. huzo.2fa lives for the few minutes between your password and your code. huzo_invite holds an invite code while you sign up from a friend's link. The site's forms carry a .AspNetCore.Antiforgery cookie that proves a form was sent from this site, and a one-line message such as "Saved" rides from one page to the next in .AspNetCore.Mvc.CookieTempDataProvider, gone once shown. Cloudflare's own check sets its own cookie on the forms it guards. Staff get one more for their housekeeping theme. Your radio volume and whether you show GIFs are kept in your browser, not sent anywhere; so is the GIF window's random identifier, which goes only to KLIPY, as described above. That is the whole list.
Who can see it
The owner, and staff to the extent their tools show it. Staff see addresses masked; seeing one whole, or an email address, is a deliberate step that lasts a minute and is written to a log the owner reads. Private messages are read one member at a time and every such reading is logged. Staff of your own rank or higher cannot look you up by private data at all.
How long we keep it
Account data stays while your account exists. Chat logs, sign-in attempts, ended devices and the like are kept until the owner purges them with a dated tool that can only remove records older than 30 days; there is no fixed schedule, and the owner may run it rarely or never. The site's log is kept for good: what staff did, and the steps on your own account (signing in, entering the hotel, changing your password, email or two-factor), each with the address it came from and any email in it masked. Nothing can change or remove an entry, which is what keeps staff honest and lets a stolen account be traced. Backups are rotated on a schedule and may hold copies for a short while after deletion.
Your choices
A copy of your data. From Settings, Privacy you can download one readable file with everything above that is yours: your account, your hotel life, what you said and wrote, and where you signed in from. Once a day, after your password.
Deleting your account. From the same page you can ask for your account to be deleted. Seven days pass first, during which you can change your mind; you are told by email at each step. Then your name, email, addresses, browser identifier, motto, look, friendships, signed-in devices and sign-in history are gone for good and your account number becomes "former" and a number. Your rooms are not deleted: they pass to the hotel's own account, locked, because friends may have built in them. Comments you wrote stay under the anonymous name. If you are banned when you ask, the ban keeps the address and browser identifier it was placed on until it ends; deleting an account is not a way around a ban. The site's log keeps its entries under your account number, with the addresses they came from, since nothing can remove an entry from it.
Corrections. Your email, password, look and motto are yours to change in Settings. For anything else, ask the owner.
In short