Privacy Policy

This Privacy Policy explains how Mother AI, LLC ("Mother AI," "we," "our," or "us") collects, uses, and protects information when you use Cody's Box (the "Service"). We keep this policy short and honest.

1. Who We Are

Mother AI, LLC is a Montana limited liability company. Cody's Box, including codysbox.com and app.codysbox.com, is a product of Mother AI, LLC. Contact us at hello@codysbox.com.

2. Information We Collect

Information you provide directly

• Account information: email address, chosen username, password (stored as a one-way hash, never in plaintext).
• Profile information: county/state (for clan-based leaderboards).
• Purchase information: when you buy Lucky Roll tokens or the Custom Pack, we record the purchase along with a Stripe transaction identifier. We do NOT store your credit card number — that information is handled directly by Stripe and never touches our servers.
• Communications: if you email us for support, we retain the email and any information you include.

Information collected automatically

• Game activity: dice rolls, final scores, tiles closed, timestamps, achievements earned, streaks, and other gameplay events that appear on leaderboards or in your personal statistics.
• Technical information: browser type, operating system, and IP address for security and abuse prevention.
• Anonymous guest activity: if you play as a guest (without an account), we track anonymized session data using a browser-local identifier. This data is not linked to any personal information.

What we do NOT collect

• We do NOT use third-party marketing analytics (no Google Analytics, no Facebook Pixel, no ad networks).
• We do NOT sell or rent your personal information to third parties.
• We do NOT track you across other websites.
• We do NOT store your credit card number or CVC.

3. How We Use Your Information

• To provide the Service and let you sign in, play games, and see your scores.
• To operate leaderboards (including sharing your username, scores, and county with other players).
• To process purchases through our payment provider, Stripe.
• To send you occasional service emails (e.g., password resets, purchase receipts, important account changes).
• To detect and prevent cheating, fraud, and abuse.
• To comply with legal obligations.

4. Third-Party Service Providers

We use a small number of third-party providers to run the Service. Each is used only for its specific purpose and is bound by their own privacy policy:

5. Children's Privacy (COPPA)

Cody's Box is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, contact us at hello@codysbox.com and we will delete it promptly.

For users between 13 and 18, we require that a parent or legal guardian review our Terms of Service and this Privacy Policy.

6. Data Retention

• Account data: retained while your account is active. Deleted within 30 days of you requesting account deletion.
• Game scores: retained indefinitely to preserve historical leaderboards and personal stats, unless you delete your account.
• Purchase records: retained for at least 7 years to comply with U.S. tax and accounting rules, even if you delete your account.
• Support emails: retained for 2 years.

7. Your Rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate information.
• Delete your account and associated data (except purchase records we must retain for tax/legal reasons).
• Export your data in a portable format.
• Object to certain uses of your information.

To exercise these rights, email hello@codysbox.com. We aim to respond within 30 days.

California residents (CCPA/CPRA)

California residents have the additional rights described in California Consumer Privacy Act, including the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information.

European residents (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation, including the right to lodge a complaint with your local data protection authority. Our legal basis for processing your data is (a) performance of our contract with you (to provide the Service), (b) our legitimate interests (fraud prevention, service improvement), and (c) your consent where required.

8. Security

We use industry-standard security practices, including:

• Passwords are hashed using bcrypt or a comparable one-way algorithm. We cannot see your password.
• All data is transmitted over HTTPS/TLS.
• Payment card data is handled entirely by Stripe (a PCI-DSS Level 1 certified provider); it never reaches our servers.
• Row-level security policies restrict database access to authorized queries only.

No security system is perfect. If you become aware of a security issue, please report it to hello@codysbox.com.

9. International Data Transfers

Our servers and service providers are located in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be announced in-app or by email. The "Last updated" date at the top of this page shows when it was last revised.

11. Contact Us

Questions or requests about your data can be sent to hello@codysbox.com or by mail to the address below.