Privacy Policy
Last updated: 11 October 2026
This page is also available in Spanish. If the two versions ever differ, the one in the language you bought in applies.
We collect only what we need to show your ghost and process your purchase, and we never sell your data. This policy follows the Swiss Federal Act on Data Protection (FADP) and, for visitors in the EU and UK, the GDPR.
Who is responsible
Gerard Delgado Casanovas, Rue de Morat 37, 1700 Fribourg, Switzerland. Contact for privacy questions: [email protected].
What we collect and why
| Data | Why we use it | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|
| Your ghost: name, message, colour, pattern, face, accessory and position. For human-sized ghosts also the link, and the logo and sheet image if you upload them | To show your ghost in the house and in share images, publicly | Contract | Public until at least 31 October 2031 (the archive), or until it’s refunded or removed |
| Your email address, which we receive from Dodo Payments after you pay | To link your payment to your ghost, to contact you about moderation or your logo if your ghost is human-sized, and to help you get your ghost’s link back if you lose it | Contract and legitimate interest | Deleted 90 days after the house closes (30 January 2027) |
| Order records without your email: order number, amount, currency, date and whether it was refunded | To keep our accounts | Legal obligation | 10 years, as Swiss accounting law requires |
| Your consent at checkout: the version of the text you ticked and the time you started the payment | To show that you agreed to your ghost being placed straight away | Legitimate interest | Kept with the order record (10 years) |
| While a spot is held for you: a salted one-way hash of your IP address (for IPv6, of its /64 network) | To limit how many spots one visitor can hold at the same time | Legitimate interest | Deleted within a few minutes after the hold ends (the hold lasts 15 minutes at most) |
| When you upload a logo or image: the same kind of hash of your IP address | To limit how many images one visitor can send in an hour | Legitimate interest | Deleted after one hour |
| Payment notifications from Dodo Payments: only the event number, type and time | To process each payment once | Contract | Deleted 90 days after the house closes |
| Emails you send us | To answer you | Legitimate interest | Up to 12 months after the conversation ends |
| Technical data: IP address, browser and time of visit | Handled by Cloudflare to deliver the site, keep it secure and stop abuse | Legitimate interest | Not stored in our database. Cloudflare keeps short-lived security logs |
We never store your IP address itself, only the hashes described above, and only for that short time.
We never see your card number. Dodo Payments asks for your payment details, name and billing address at checkout. When it tells us about a payment, we keep only the parts listed above, never the full message, which contains your name and address. Dodo Payments keeps its own records as merchant of record, under its own privacy policy.
Everything you put on your ghost is public. Anyone can see it, take screenshots or share it, so don’t add anything you want to keep private.
Images you upload
If you add a logo or an image to a human-sized ghost, your browser resizes it and sends it to our server, which makes a new file from its pixels alone. Nothing else from your original file is kept: no file name, no camera or location data. The file is stored privately with Supabase in the EU (Frankfurt, Germany) and is only shown once we have checked your ghost by hand. Images that no ghost uses are deleted within a day, and those of a ghost that is refunded or removed within minutes.
Share images
When a link to a ghost is shared, our server draws a preview image of that ghost from its public content, so the link shows a picture in apps and social networks. If a name or message uses characters our own fonts don’t have (for example emoji or a non-Latin alphabet), our server asks Google Fonts and jsDelivr for just those characters. They receive the characters, never who wrote them or who is looking.
Who receives your data
- Dodo Payments: our online reseller and merchant of record. It charges you, collects VAT or sales tax and sends your receipt. It decides on its own how it handles your payment data (it is an independent controller), under its own privacy policy.
- Cloudflare: hosts the site and its server functions, delivers it over its network, protects it from attacks, and handles the login to our admin area.
- Supabase: stores the ghosts, the orders and the images you upload in the EU (Frankfurt, Germany).
- Resend: sends the confirmation email after your purchase (your email address, your ghost’s number and link, and the text you agreed to).
- Google Fonts and jsDelivr: only when drawing a share image needs characters our fonts lack, they receive those characters from our server (see Share images). Your browser never contacts them.
- Authorities: only when the law requires it.
Where your data may be processed: our database is in the EU (Frankfurt, Germany). Cloudflare, Supabase, Resend, Google and jsDelivr are companies based in the United States, so data they handle may be processed there; those transfers are protected by the Swiss-U.S. and EU-U.S. Data Privacy Framework or by standard contractual clauses. Dodo Payments works with its own group companies and payment partners in several countries, including outside Switzerland and the EU; its privacy policy explains how it protects those transfers.
Cookies
We don’t use analytics, ads or tracking cookies. Fonts and images come from our own domain, so your browser doesn’t contact Google Fonts or anyone else while you look around the house. The site remembers the language you choose in your browser’s local storage, and keeps the images of a human-sized ghost waiting for its check in that tab’s session storage, so you see them when you come back from paying. Neither ever reaches us.
The checkout pages are run by Dodo Payments and may use their own cookies. Our admin area, which only we use, sits behind Cloudflare Access, which sets its own login cookie for us.
Your rights
You can ask us to see, correct or delete your data, to limit or object to how we use it, or to receive a copy of it. Write to [email protected] and we’ll answer within one month.
If you ask us to delete your ghost’s content, your ghost stops being shown. Once your ghost has been placed, this is not refunded, unless the law requires it.
You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to the data protection authority where you live.
Children
One Night Haunt is not meant for children under 16. Anyone under 18 needs a parent’s or guardian’s permission to buy.
Security
The site only works over encrypted connections, and only we can access the database.
Changes
If we change this policy, we’ll update the date at the top.