How We Protect You
No legalese. No fine print. Just a straight answer about what we do with your data and why.
Your Data, Your Trust
Plain-Language Privacy Practices
The haunt community is small and interconnected. One trusted community member's endorsement carries more weight than any marketing. One incident handled poorly destroys it. We know that. So instead of hiding behind a wall of legal text, here is a plain-language explanation of what we collect, why, how it is protected, and what you control.
We still have a full Privacy Policy — the legal one. This page is the human version.
What We Collect and Why
Haunted 365 (Social Community)
- Email address — so you can log in and we can reach you if something affects your account
- Display name and profile info — what you choose to show other community members
- Posts, messages, photos — content you create inside the community
- Device and browser info — to keep your account secure and detect suspicious logins
We do not collect your real name, phone number, or location unless you choose to add them to your profile. We do not read your private messages as a matter of course — moderators open a conversation only when a safety report brings it to us. Being straight with you about the limits of that: it is a rule our moderation team follows, not a lock that makes it technically impossible. If that distinction matters to you, treat direct messages the way you would treat any message on any platform.
HR for Haunters (Workforce Management)
- Employment data — name, position, pay rate, schedule, provided by your haunt when they set up your workspace
- Sensitive identifiers — SSN, tax ID, banking info for payroll processing
- Performance and attendance records — managed by your haunt through the platform
HR data is kept completely separate from your social profile. A Haunted Attraction you accept an HR for Haunters invite from sees only what any other member sees of your Haunted 365 profile — whatever your own privacy settings allow. They cannot read your private messages, and they cannot see that you work with any other haunt. Your social connections cannot see your HR data. These are kept strictly separate for your protection.
What Is Encrypted and Why
Encryption means your data is scrambled so that even if someone gained unauthorized access to our systems, they could not read it. Here is what we encrypt:
Encrypted at Rest (AES-256)
- Social Security Numbers
- Bank routing and account numbers
- Salary, hourly rate, and compensation data
- Your email address and phone number
- Date of birth
- The IP address of your last sign-in
These fields are unreadable in our database. They are only decrypted when an authorized person with the correct role requests them, and that access is logged.
Other HR records — schedules, attendance, safety logs, pay stubs, background-check status — are not individually encrypted at this level. They are protected by database isolation, access controls, and encryption in transit. We would rather list this precisely than round it up.
Encrypted in Transit (TLS/SSL)
- Every page you visit on our platform
- Every message you send
- Every file you upload
- Every login and password entry
- Every API call from the mobile app
No data travels between your device and our servers in readable form. All connections are encrypted.
Your password is never stored in readable form. It is scrambled and hashed, which means even we cannot see it. If you forget it, we cannot retrieve it — only reset it.
What Staff Can and Cannot See
We use role-based access control. That means every person on our team only has access to the data they need to do their job — nothing more.
Platform Staff Can
- View your public profile information
- Review content that has been reported for safety violations
- See login metadata (when, from where) to investigate security issues
- Access aggregated, anonymized analytics
- Process account deletion requests
Platform Staff Cannot
- Read your private messages (unless a safety report is filed)
- See your password (it is hashed — we literally cannot)
- Access your SSN, banking info, or salary (encrypted, role-locked)
- View your HR records without your haunt's authorization
- Share your data with third parties for marketing
- Sell your information — to anyone, ever
Every access to sensitive data is logged. We maintain audit trails so we can verify who accessed what and when. If a staff member accesses data they should not, we will know.
How Minor Safety Works
The haunt industry includes performers and fans of all ages. We take the safety of minors seriously — not as a legal checkbox, but because this community includes parents, families, and young people who love the craft.
Age Brackets
Cannot create an account. No data collected. Period. They can browse public attraction listings without logging in.
Requires verified parental consent. Parent must approve via email within 48 hours or the account and all data are permanently deleted. No messaging. Limited community features. No location sharing.
Requires verified parental consent. Same approval process. Parents can enable expanded features (limited messaging with mutual connections, employment features) through the Family Account dashboard.
Full access. Standard registration. All platform features available.
What This Means in Practice
- Adults cannot initiate direct messages with minor accounts
- All interactions involving minors are subject to enhanced content moderation
- Location sharing is disabled for all minor accounts by default
- We collect only birth year (not full date), email, parent email, and display name from minors — nothing else
- Parents can review activity, modify permissions, or delete the account at any time through the Family Account dashboard
- When a minor turns 18, their account transitions to adult status automatically — they are notified and can review settings
How to Request Data Deletion
You own your data. If you want it gone, we will make it gone. Here is exactly how:
Go to Settings → Account → Delete Account. Your account and your Haunted 365 content are permanently deleted right away — there is no waiting period and no recovery window. Uploaded files are removed from storage shortly afterward.
One exception, and we would rather say it here than surprise you: if you have worked for a haunt through HR for Haunters, that haunt's employment records about you — payroll, compliance documents, employment history — belong to the haunt and are kept under their own retention rules, not ours. Deleting your account does not erase their records. You will see this reminder again before you confirm.
Email [email protected] with the subject "Data Deletion Request." We will process it within 30 days and confirm when complete.
Parents can request deletion of a minor's data through the Family Account dashboard or by emailing [email protected]. Minor data is purged within 24 hours.
What Gets Deleted
- Your profile, posts, messages, and uploaded content
- Your account credentials and login history
- Your social connections and community activity
What May Be Retained (and Why)
- HR employment records — retained for 7 years after employment ends (required by federal tax and labor law)
- Financial/payroll records — retained for 7 years (IRS requirement)
- Safety reports you filed — retained to protect other community members, with your identity anonymized
We will always tell you exactly what is being retained and why. Nothing is kept because it is convenient for us — only because the law requires it.
What Happens to Your Data If We Shut Down
We built this platform to last. But we also believe you deserve to know what happens if it does not. Here is our commitment:
If we ever decide to shut down or significantly change the platform, we will give you at least 90 days' written notice via email.
During that period, you will be able to export all of your data — posts, messages, photos, connections, and any HR records — in a portable format.
After the notice period, all remaining data will be permanently and securely destroyed. We will not sell it, transfer it, or repurpose it.
Any data we are legally required to retain (HR records, tax documents) will be held by a designated custodian for the required retention period, then destroyed.
Questions?
If anything on this page is unclear, or if you want to know something we have not covered, ask. We will answer honestly — and if we do not know, we will say so.
For the full legal version, see our Privacy Policy and Terms of Service .
The Darkness Is Ours — Protected
Trust is earned, not declared. We earn it by being transparent about what we do and accountable when something goes wrong.
Join the Community