This policy explains how Qube, LLC (“Qube,” “we”) handles information in Qube accounts: optional accounts at account.qubesoftware.com that let a parent back up their family's progress in Qube games and play it on more than one device. Dragon Hatchery is the first game to offer them.
The short version: accounts are optional, and every game plays without one. Only a parent signs in, with a code sent by email. Children have no email address or password; a parent makes a profile for each of them with a nickname and a built-in picture. We keep only what backup needs, for only as long as it needs it. There are no ads, no analytics, and no tracking, and nobody else gets your family's information except Cloudflare, which runs the service for us.
Where things stand
Qube accounts are in a small pilot, by invitation. Child profiles aren't available yet. They open only after our parental notice and consent process has been reviewed, and this policy will describe that process before they do. Until then, no child profile can be created.
You don't need an account to play
Without an account, a game keeps your progress on your device, as it always has. An account adds a backup: once a profile's progress is backed up, it's safe if a device is lost or its browser data is cleared, and the same profile can play on several devices. If Qube accounts are unavailable, the game keeps playing, and the backup catches up later.
This policy covers Qube accounts and the backup they provide. A game's other features, such as playing online, aren't part of Qube accounts and aren't covered here.
Who signs in
Only a parent signs in. (On these pages, “parent” means the adult who holds the account.) There are no passwords: you enter your email address at account.qubesoftware.com and type the six-digit code we email you.
Children never sign in, and they have no email address or password. You make a profile for each player: a nickname of up to 16 characters and a built-in picture. Please use a nickname rather than a child's real name. You can also make a profile for yourself, and a shared Family profile for a collection the whole family adds to. One account can manage up to 10 profiles.
Linking a device
To back up a profile on a phone, tablet, or computer, choose to link the game there. It shows an eight-character code that works for 10 minutes. Enter that code at account.qubesoftware.com, confirm with a fresh code from your email, choose the profile, and approve. The code itself holds no account details; it only finds the device's request.
Approving gives the game on that device a device link: a limited credential for one profile in one game. With it, the game can back up and download that profile's progress, offer the device's own earlier finds for you to review, and unlink itself. It can't see your email address, your sign-in, other profiles, or your family's settings, and it can't approve, change, or delete anything. The device keeps the credential; we keep only a one-way hash of it.
A device link stops working after 90 days without use, and 180 days after linking at the latest; then you approve the device again. You can revoke it sooner, at any time.
What we keep
- Your email address, to send you sign-in codes, codes that confirm important actions, and notices about your account.
- Your sign-ins: a session for each browser you sign in on, so you stay signed in, with when it began, so you can sign others out. We don't store your IP address or anything about your browser with them.
- Recovery codes: ten single-use codes, shown to you once, for getting back in if you lose access to your email. We keep only one-way hashes of them.
- Profiles: each profile's nickname, picture, and type (adult, child, or Family).
- Parental consent records, for child profiles: how consent was given, what it covers, which version of the notice you saw, and when it was given or withdrawn.
- Device links: a one-way hash of each device's credential, a name for the device sent by the game (like “Kitchen tablet”), which you can change, and when it was linked, last used, and last backed up.
- Game progress: in Dragon Hatchery, a profile's DiscoveryDex, meaning the dragons and riders found, how many of each, their looks, and the showcase picks. With it we keep receipts that stop a find from counting twice, and a few recent snapshots you can go back to.
- Limit counters: counts of recent attempts, like codes sent or wrong codes typed, kept against a keyed hash of an email address, IP address, device, or account, never the address itself.
- A safety record of each deletion, consent withdrawal, reset, restore, revocation, recovery, and email change (ids and times, never an email address), so it holds even if we ever have to restore our database from a backup.
Data Retention lists how long we keep each of these.
How we use it
Only to run Qube accounts: to sign you in, link devices, back up and restore progress, keep the service and your family's information secure, and send the emails the service needs. Those are codes and notices about your account, from codes@mail.qubesoftware.com. We don't send marketing email, and we don't use your family's information for anything else.
What we don't do
- No advertising, analytics, tracking, or third-party SDKs.
- No selling, renting, or sharing of your family's information.
- No cookies other than the one that keeps you signed in at account.qubesoftware.com.
- No email address, password, location, or photo for a child.
- A device linked to a child's profile never sees your email address, your sign-in, other profiles, or family controls.
- A linked child's collection, or a Family profile's, is never shown to other players at an online table.
Who else handles it
Qube accounts run on Cloudflare, our hosting provider. Cloudflare stores the account database and sends our email on our behalf, under its own privacy policy and data processing terms. Cloudflare may keep limited operational logs, such as IP addresses, for security, as described at cloudflare.com/privacypolicy. No other company receives account information.
Our own error logs record what went wrong, never an email address, nickname, code, credential, or game save.
Keeping it safe
- Email codes work for 10 minutes and allow three tries.
- Email codes, recovery codes, and device credentials are stored only as one-way hashes.
- Important actions need a fresh code from your email, even when you're signed in: approving a device, adding a device's earlier finds, going back to a snapshot, resetting or deleting data, changing your email address, and replacing your recovery codes.
- Withdrawing consent and revoking a device never need one, so stopping is always easy.
- The sign-in cookie can't be read by scripts on the page, and our emails never contain a sign-in link.
Your choices and rights
You manage everything yourself at account.qubesoftware.com: see what we hold for each profile, download a copy, rename a profile or a device, revoke devices, withdraw consent for a child's profile, go back to a snapshot, reset a profile's progress in a game, delete a profile, or delete your whole account. Parent Rights explains each one.
Depending on where you live (for example, in the European Union, the United Kingdom, or California), you may have the right to access, correct, or delete information about you, or to object to how it is used. If there's something you can't do yourself on account.qubesoftware.com, email us.
Qube, LLC is based in Utah, in the United States. Cloudflare runs Qube accounts on servers around the world, so account information may be processed outside your country.
What revoking and deleting can't reach
A game keeps its own copy of a profile's progress on each linked device, so it can play offline. Revoking a device ends its access at once, and it finds out the next time it connects, but its copy stays on the device, with anything it hadn't backed up yet, in case you approve that device again. When you delete a profile or your account, or withdraw consent, each linked device removes its copy the next time it connects.
We can't reach a device that stays offline: it keeps what it already has. To remove the game's data from a device yourself, clear the game's site data in that browser.
Children
Qube accounts are designed so that a parent manages everything, and a child never signs in or gives any contact details. A child's profile holds only a nickname and a built-in picture, and neither the profile nor its backed-up progress is shown to other players. Only a parent may hold a Qube account; if you think a child has made one, email us.
Child profiles open only after our parental notice and consent process has been reviewed. Before making one, a parent will read a notice describing what's collected and give consent, and can withdraw that consent at any time. Withdrawing it stops collection for that profile at once and deletes its backed-up progress.
Changes to this policy
If what Qube accounts collect, or how we use it, changes, we'll update this page and its date before the change reaches you.
Contact Qube, LLC
Questions about this policy or about your family's information are welcome. Email Qube, LLC at admin@qubesoftware.com.