Privacy Policy

Effective October 27, 2026 · Questions: support@oddbox.me

ODDBOX lets creators build a grid page and publish it at oddbox.me/their-name. This policy explains, in plain language, what we collect, why, who it's shared with, and the choices you have. ODDBOX is operated by NightHouse Studios LLC, doing business as ODDBOX ("ODDBOX", "we"), based in the United States.

The short version

We collect what we need to run your account and your page, and nothing to sell. We don't run ads or third-party analytics.
Your published page is public. Your drafts, inbox, and account details are not.
You can download everything we have about you, or delete your account, from Settings at any time.

What we collect

Your account

Email address and name.
Password: stored only as a salted, one-way hash, so we never see it.
If you sign in with Google: your name, email address, and Google's account ID for you. We don't get your contacts, files, or Google password.
When you signed up and last signed in, and your plan (Free or Pro).

Your page

Everything you put on your page: name, bio, photo, tiles, links, images, music and video links, map locations, and settings. Unpublished drafts are saved to your account so you can edit from any device.
If you import from Instagram or Linktree, we read the public profile you name (photo, name, and links) to build your first page.

Things visitors send

Contact form: the visitor's name, email, and message, delivered to the page owner's ODDBOX inbox.
Reports and feedback: the reason, details, and any contact info the sender chooses to include.

Technical information

One sign-in cookie keeps you signed in. It's required for the service, can't be read by other websites, and isn't used for tracking.
Your browser's storage keeps a copy of your draft while you edit.
To stop spam and abuse, we turn your IP address into a scrambled, one-way code and count requests (for example sign-ups and contact messages). We don't store your IP address itself. Most of these counts are deleted within a day.
Short links count visits. We don't record who visited.
Our host, Cloudflare, processes requests and keeps short-term technical logs to deliver and protect the site.

How we use it

To run your account, save and publish your page, deliver contact messages to you, and keep you signed in.
To prevent abuse, investigate reports, and keep ODDBOX safe.
To answer you when you contact us.
To send account emails you ask for, like password resets. We don't send marketing email without your permission.

What's public

Your published page, its short link, and its QR code can be seen by anyone, and search engines may find them. If you turn on "Show on Explore", your page's name, photo, bio, and tags appear there too. Unpublish your page anytime to take it offline.

Who we share it with

We don't sell or rent your information. We share it only as follows.

Service providers that run ODDBOX for us: Cloudflare (hosting, database, file storage, and email forwarding) and Google (only if you choose Google sign-in). When paid plans launch, our payment processor will handle card details; ODDBOX never sees full card numbers.
Services you add to your page. When a page shows a YouTube, Vimeo, Spotify, Apple Music, or SoundCloud player, or a map from Mapbox or OpenStreetMap, that service delivers the content directly to the visitor and may set its own cookies, under its own privacy policy.
Services that help pages load: Google Fonts (lettering), jsDelivr (drawing code for globe maps), Google's site-icon service (small logos next to links), OpenStreetMap's place search (when you add a map), and Mapbox (map tiles, which receive the visitor's IP address and the map area shown).
When the law requires it, or to protect people from harm, fraud, or abuse.
If ODDBOX is sold or merged, under this same policy; we'll tell you first.

Google user data

If you sign in with Google, ODDBOX uses your Google name, email address, and account ID only to create your account and sign you in. ODDBOX's use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. We don't use Google data for ads, don't sell it, and don't let people read it except where needed for security or the law.

Your choices

Edit or unpublish your page anytime.
Download your data: Settings → Your data → Download my data gives you your page, settings, and messages in one file.
Delete your account: Settings → Delete account removes your account, published page, short link, drafts, and inbox.
Questions, corrections, or requests: email support@oddbox.me. Depending on where you live (for example California, the EU, or the UK), you may have further rights, such as to access, correct, delete, or move your data, or to object to some uses. We honor these requests and won't treat you differently for making them.

How long we keep it

We keep your information while your account exists. When you delete it, your account, page, drafts, and inbox are removed right away. Backups roll off within 30 days. Records of admin actions on accounts (for example "account disabled") may keep an email address for security and legal reasons. Contact messages you received stay until you delete your account.

Security

Connections are encrypted (HTTPS). Passwords are hashed. Accounts and creator pages run on separate addresses, so a creator's page can't access anyone's account. No system is perfectly secure, so please use a strong, unique password.

Children

ODDBOX isn't for children under 13, or under the minimum age for consent where you live. If you think a child has given us information, email us and we'll delete it.

Where data is processed

ODDBOX runs on Cloudflare's global network, so your information may be processed outside your country. We rely on our providers' legal safeguards for these transfers.

Changes

If we make important changes, we'll update the date above and tell signed-in users in the app before the changes apply.

Contact

NightHouse Studios LLC, doing business as ODDBOX, United States · support@oddbox.me