Privacy Policy

Last updated November 11, 2026

This Privacy Policy explains what Spicy Holdings LLC ("we," "us," or "our") collects when you use Cube Cooperative at cubecooperative.com (the "Services"), how we use it, and the choices you have.

In short: we collect very little. We don't sell your information, we don't run ads, and there are no third-party trackers or analytics on the site.

1. Information We Collect

Information you give us

Account information. Your email address. If you add a password, we store only a salted hash of it, never the password itself.
Username. If you choose one. It's public.
Paintings. What you paint on your sections. Paintings are public.
Orders. The sections you bought, when, the amount, any tax charged, the country you selected, and the version of the Terms in effect. For buyers in the European Union, we also record when you asked for immediate delivery.
Agreement to our Terms. The date you accepted the Terms of Service and Community Guidelines, and which version.
Reports. If you report a painting, we keep the section, the reason you picked, and anything you add. If you're signed in, the report is linked to your account. If you're not, we keep a hash of your IP address so the same section can't be reported over and over.
Messages. Anything you send through the contact form, along with your email address. A copyright (DMCA) notice also includes your name, mailing address, and phone number, because the law requires them.

Information collected automatically

Painting totals. A running count of the faces you've painted, which is what the leaderboards show.
Sign-in records. A hashed token and its dates for each browser you're signed in on and each device you've verified with an emailed code.
IP address. We use it to work out which country you're connecting from, which we need to charge the right tax and must keep as tax evidence for EU sales. We also use it to limit abuse, such as repeated requests for sign-in codes. Rate-limit counters that include IP addresses are deleted within two days.

Information from others

Square. Our payment processor tells us whether a payment went through, and whether it was later refunded or disputed, and gives us its reference numbers and a link to your receipt. We never receive your card number.

What we don't collect

Card numbers or bank details, your precise location, or advertising and analytics data. We don't ask for your name, mailing address, or phone number unless you send a copyright notice.

2. How We Use Your Information

To create and secure your account and sign you in
To process purchases and deliver your sections
To display your paintings on the cube
To calculate, collect, and report taxes
To answer your messages
To enforce our Terms of Service and Community Guidelines, and to prevent fraud and abuse
To comply with the law

If you're in the European Economic Area or the United Kingdom, our legal bases are: performance of our contract with you (your account and purchases), compliance with legal obligations (tax records), and our legitimate interests in keeping the Services secure and free of abuse.

3. What's Public

Your username (or "Painter" and a number if you haven't picked one), your paintings, the location of your sections, and your place on the leaderboards. Your email address, orders, and everything else in this policy are never shown to other users.

4. When We Share Information

We don't sell or rent your personal information. We share it only as follows:

Cloudflare hosts the Services and our database, and delivers the emails we send you, such as sign-in codes. Every request to the site, including your IP address, passes through Cloudflare.
Cloudflare Turnstile checks that a person, not a bot, is asking for a sign-in code or sending us a message. It runs only at those two moments. To do its job it looks at technical details of your browser and connection, including your IP address. Most people never see it; a few are asked to tick a box. Cloudflare's handling of that information is covered by its own privacy policy.
Square processes payments. We send Square the contents of your order, the amounts, and our order reference. You give Square your payment details and email address directly. Square emails your receipt, keeps its own record of the payment, and adds you to our customer list at Square. Square's handling of your information is covered by its own privacy policy.
Have I Been Pwned. When you choose a password, we send the first five characters of a hash of it to this service to check it against known data breaches. Your password and email address never leave our server.
Copyright notices. We may forward a copyright notice, including the sender's name and contact details, to the user who created the painting.
Legal requirements. We may disclose information to authorities when the law requires it, including tax authorities, and we report child sexual abuse material as required by law.
Business transfers. If the Services are sold or merged into another business, your information may be transferred as part of that deal.

5. Cookies and Local Storage

We use three cookies, all of them necessary for signing in: one keeps you signed in (30 days), one remembers a device you've verified (one year), and one lasts ten minutes while you enter a sign-in code. We don't use advertising or analytics cookies, which is why you don't see a cookie banner.

Your browser also stores a few things on your own device, such as your cart, your saved colors, paintings you haven't saved yet, and whether you've completed the welcome tutorial. These aren't sent to us, and signing out clears your cart and unsaved paintings from that device.

6. How Long We Keep Information

Account, sections, and paintings: until you delete your account
Sign-in sessions: 30 days. Verified devices: one year. Sign-in codes: ten minutes
Rate-limit counters with IP addresses: up to two days
Contact form messages: two years, or until you delete your account
Reports: six months after they've been dealt with, and two years at most
Moderation records (what was done to which section, and why): for as long as the Services operate. If we close an account for breaking the rules, we also keep a hash of its email address so it can't sign up again
Order records: up to eleven years. Tax law requires us to keep them for ten full years after the year of the sale. They are kept even if you delete your account, but without your email address

7. Your Rights and Choices

Download your data. Sign in, click your name at the top of any page, and choose Download my data.
Stay off the leaderboards. In the same place, choose Hide me from the leaderboards. You can change it back at any time.
Delete your account. In the same place, choose Delete my account. Your email, password, sign-ins, messages, sections, and paintings are erased. Order records are kept as described above.
Correct your email address. Contact us and we'll update it.

European Economic Area and United Kingdom. You also have the right to ask us to restrict or stop processing your information, to object to processing, and to lodge a complaint with your local data protection authority.

California and other U.S. states. You have the right to know what personal information we hold, to correct it, and to delete it, using the tools above or by contacting us. We don't sell or share personal information as those terms are defined in U.S. state privacy laws, and we won't discriminate against you for exercising your rights.

8. International Transfers

We're based in the United States. Your information is processed there and on Cloudflare's global network, so it may leave your country. If you're in the European Economic Area, the United Kingdom, or Switzerland, that means your information is transferred to the United States, where data protection laws differ from yours.

Most of it you give us directly when you use the Services. Where we pass it to the service providers named in Section 4, we rely on the safeguards the law recognizes for these transfers: the EU-U.S. Data Privacy Framework where a provider is certified under it, and otherwise standard contractual clauses approved by the European Commission.

9. Security

All connections to the Services are encrypted. Passwords, sign-in codes, and session tokens are stored only as hashes. A password works only on a device you've already verified with an emailed code. Our database is encrypted at rest. No system is perfectly secure, and if a breach affects your information we'll notify you as the law requires.

10. Children

The Services are not intended for anyone under 18, and we don't knowingly collect information from children. If you believe a child has created an account, contact us and we'll remove it.

11. Changes to This Policy

If we change how we handle your information, we'll update this page and its date, and we'll notify you of material changes through the site or by email.

12. Contact Us

Questions or requests about your information? Contact us through the Help page or at:

Spicy Holdings LLC
PO Box 981
Centreville, VA 20120
support@cubecooperative.com