Legal

Privacy — BumpHex Challenge.

This game has no accounts, asks for no names, and collects nothing about you. There is no advertising, no analytics and no tracking of any kind, in any mode. It is a complete game on one device; played with people in the same place it goes straight from your device to theirs across your own Wi-Fi; and played with somebody who is somewhere else, it passes through a relay we run that forwards the game and keeps none of it.

Last updated 6 October 2026

Which app this policy covers

This page covers one app, and only one. Our other mobile games — which collect nothing and never open a network connection at all — are covered separately at privacy for our mobile games.

• BumpHex Challenge com.hauntedspacehotel.bumphexchallenge A hexagonal strategy board game for two to six players, on Google Play and on the Apple App Store (iPhone, iPad and Mac), with the same identifier on both. For players 13 and over. Not a children's title.

The short version — three switches

Out of the box this game opens no connection at all, and it is the whole game that way: you against the computer, or friends passing one device round the table. The three things below are off until you turn them on.

What we collect

Nothing. There is no account, no sign-in, no profile, no leaderboard, no advertising and no analytics. Specifically, this app does not ask for, access, collect, store or transmit to us:

• Email addresses, phone numbers or postal addresses
• Names — the game has no name field anywhere; a player is a seat and an army. When you host or join, each device shows the others a four-letter tag it made up at random (so a lobby can tell devices apart) and hands the host a random rejoin code, so a device that drops can take its own seat back. Both are invented by the app, name nobody, go only to the devices in that game (through the relay if the host chose the internet), and we keep neither.
• Location of any kind, precise or approximate
• Contacts, calendar, photos, files, microphone or camera
• Advertising IDs, device identifiers or any other tracking identifier
• Usage analytics, gameplay telemetry, crash reporting of our own, heat maps or session recordings
• Cookies, web beacons or cross-app profiles

We run exactly one piece of server infrastructure for this game and it is a relay, at manager.hauntedspacehotel.com. It exists so that people who are not in the same place can play together, it forwards the game between your devices without reading it, and it keeps nothing. Every other connection the app can make is to another copy of itself on your own network, and none of them happens until somebody presses HOST or JOIN.

1 · On the same Wi-Fi — what leaves the device, and where it goes

One device hosts the game. Everybody else joins from their own copy on their own device. What travels between them is the game and nothing else: whose turn it is, where the pieces are, and the move a player made.

• It is your network, not ours. The devices talk directly to each other. There is no account, no room registered anywhere, and no third party in the path.
• Seats, never names. The game never asks who you are. There is no chat and no way to type a message to another player.
• Nothing is kept about who played. No history is written anywhere, on any device, about who played with whom.
• It is off until you turn it on. A copy that never hosts and never joins opens no connection, on your Wi-Fi or anywhere else.

To find a game on your Wi-Fi, a joining device asks the network whether anybody is hosting, and a hosting device answers. That question and that answer contain no personal information. On iPhone, iPad and Mac this is why the game asks for permission to talk to your local network, and it asks only when you host or join. Say no and the game still plays on one device exactly as before.

2 · Over the internet — a relay we run, that keeps nothing

If the people you are playing with are somewhere else, the host can open the game over the internet instead. The hosting device and the devices that join each make an encrypted connection to manager.hauntedspacehotel.com, a server we operate, and it passes the game between them. The four letters on the host's screen are the address of that room and the only thing anybody types.

What the relay is, precisely:

• It does not understand the game. It forwards whatever it is given to the other devices in the same room, untouched.
• It stores nothing. There is no database, no account, no history and no record of what was passed through.
• A room lasts as long as the host's connection. When the host leaves, the room is gone and its four letters mean nothing again.
• Traffic is encrypted between each device and the relay (TLS, over the same port a browser uses).
• There is no list of games to browse. A room is reachable only by somebody you gave its four letters to.
• It is the same relay our other networked games use, and shared only in the sense that one machine serves them all — a room never sees another game's traffic.

An ordinary internet fact we would rather state than leave implied: like every internet service, the relay and the content-delivery provider in front of it (Cloudflare) necessarily handle the connection itself, so your device's IP address is visible to them while you are connected, as it is to any website you open. We do not use it, keep it or join it to anything. Play on the same Wi-Fi, or on one device, and no part of this section happens at all.

3 · The purchase

Joining a game somebody else is hosting is free, always. The one purchase, bought once, lets you host games — on your Wi-Fi or over the internet — and opens the larger boards and pass and play for three or more people on one device.

It is a single non-consumable in-app product, handled entirely by the store the app came from — Google Play Billing on Android, Apple's In-App Purchase on iPhone, iPad and Mac. We never see a card number, a name, an email address or a billing address. The store answers the app with this device has bought it or it has not, and the app keeps only that answer. Your receipt is the store's, under Google's privacy policy or Apple's privacy policy.

There is no advertising in this app and there is no build of it that could show one. The commerce module it uses refuses every advertising placement at compile time.

What is kept on the device

A game in progress, so it can be picked up again, and the menu's settings, in the app's own private storage. They never leave the device, are not readable by other apps, and contain nothing about you. Uninstalling the app, or clearing its data, removes them.

Third parties

• Google Play — for distribution on Android, and for the one optional purchase. Google gives us aggregate, anonymised console statistics: install counts, ratings, anonymous crash reports.
• Apple — for distribution on iPhone, iPad and Mac, and for the one optional purchase, with the same kind of aggregate, anonymised statistics.
• Cloudflare — only if you host or join a game over the internet. They sit in front of our relay and handle the connection, under Cloudflare's privacy policy.

That is the complete list. There are no ad networks, no analytics providers, no social logins, no crash-reporting SDKs of ours and no match-making service.

Permissions

Every network permission the app holds exists so the devices playing together can reach each other: Android's INTERNET (opening a connection at all), the Wi-Fi permissions that let a device hear "is anybody hosting?" on your own network, and, on newer Android, the local network permission, asked only when you host or join. Google's billing library adds com.android.vending.BILLING and ACCESS_NETWORK_STATE so the app can ask the Play Store about the one purchase. The app asks for no location, no contacts, no photos, no camera, no microphone and no advertising ID.

Children

This is not a children's title. It is not in Google Play Families and not in Apple's Kids Category, and it is intended for players aged 13 and over: it is a full strategy game, and it can put you in a game with people you do not know. If you are a parent looking for our games for young children, they are the ones on privacy for our mobile games, and they open no network connection at all.

Third-party licences

This game is built on other people's work as well as ours. The notices that work is owed are listed on our third-party licences page.

Your rights

Data-protection law gives you the right to access, correct, export or delete the personal data a company holds about you. We hold none — there is no account and no database, and the one server we run is a relay that keeps nothing. To remove what is on the device, uninstall the app or clear its data. If you want to ask about any of this, write to us.

Changes to this policy

If this game ever changes what it does with data, we will update this page and the date at the top before that version ships, and we will say plainly what changed.

Contact

Write to [email protected] — the same address on our Google Play and App Store listings. A person answers it.