Who is responsible

Fox Knox, the project behind this site. You can reach us on X at @FoxKnox_RH.

If you only read the site

We set no cookies and store nothing in your browser. Like any website, the servers that deliver the pages see your IP address and browser type for as long as it takes to answer, and keep short-lived technical logs. There is no analytics script and no advertising.

If you sign in with X

Sign-in is read only. It asks X for permission to see your profile and public posts, and nothing else: it cannot post, follow, like or message for you. The access X gives us is used once, to read your profile, and is then revoked. We never see your X password.

From that one read we store:

• your X id, username, display name and profile picture address
• your bio, follower and following counts, and whether X marks you as verified
• when your X account was created
• when you first signed in here, and when you were last active
• who referred you, if you arrived through someone's link

As you play we also store the tasks you completed, the code words you used and the points that came from them.

Public posts about Fox Knox

The Foxlist scores posts, so we look for them. Through a service called TweetAPI we search X for public posts that mention Fox Knox, and we keep each one: its text, when it was written, its likes, replies, reposts and views, and its author's public X id, username, name, picture and follower count.

This includes posts by people who have never signed in here. Those posts are public on X already; we keep them so that someone who signs in later gets credit for what they wrote before. If you would rather we did not hold your posts, tell us and we will remove them.

What other people can see

The leaderboard is public. If you are on it, your X username, your picture and your points are visible to everyone.

Cookies

• fk_session keeps you signed in. It lasts 30 days, cannot be read by scripts, and is deleted when you sign out.
• fk_oauth exists for up to ten minutes while you are being sent to X and back, so that the answer can be matched to your browser.

Both are needed for sign-in to work and neither is used for anything else, which is why there is no cookie banner.

Who else handles this data

• X, when you sign in and when we read public posts.
• TweetAPI, which reads public X data for us. It receives X usernames, ids and post ids, never anything private.
• Amazon Web Services, where the database and the images are stored, in the United States.
• The company that hosts this website and its server.

We do not sell personal data, and we do not share it for advertising.

How long we keep it

For as long as the Foxlist runs, or until you ask us to delete it, whichever comes first. Sign-in sessions expire after 30 days.

Your choices

You can ask what we hold about you, have it corrected, or have it deleted, including your place on the board and any posts of yours we kept. Message @FoxKnox_RH from the X account in question, so we know it is you. If you live in the EU or the UK you also have the right to complain to your data protection authority.

You can also withdraw the permission you gave at sign-in at any time, in your X settings under connected apps. Since we revoke it ourselves straight away, there is usually nothing left to withdraw.

Age

This site is not meant for anyone under 18.

Changes

If what we store changes, this page changes first, and the date at the top moves. See also the terms and the risks.