Privacy Policy
Effective October 24, 2026. Operator: The Conjuring House LLC. Privacy contact: jason@conjuringhouseofficial.com. Billing contact: billing@conjuringhouseofficial.com.
1. What we collect
This describes what House Live collects when you have an account, buy access or watch, and who handles it.
| What | Why | Notes |
|---|---|---|
| Name and email | Your account, sign-in, security emails | Required. |
| Membership requests: the name, email address and optional reason you enter on the request form | Review your request and, if approved, invite you | Requesting does not create an account. We do not store the request form's network address (only short-lived abuse counters do). |
| Password | Sign-in | Stored only as a one-way hash. We cannot read it. |
| Sign-in codes (administrators) | Two-factor security | Secrets are stored encrypted. Two-factor is required for administrators. |
| Sign-in sessions: IP address and browser details | Keep your session secure and show your active sessions | Kept while the session exists; sessions last up to 30 days. |
| Viewing sessions: which camera, start, heartbeat and end times, a device identifier, a salted hash of your IP address, browser details | Check you still have access while watching, prevent shared sessions, run the service | We do not store your raw IP address in viewing records. |
| Purchases and access: Stripe customer reference, what you bought, amount, any tax, status, the night it covers, access start and end | Give and end access, handle refunds | Card numbers are never stored by us. |
| Favorites and Mark Activity reports (camera and time) | Features you use | Other viewers see only counts. Administrators can see which account made a report. |
| Administrator action log | Security and accountability | Records which administrator did what, with no passwords or card data. |
| Request counters | Block abuse | Short-lived counters tied to a network address or account. |
We do not use advertising or analytics trackers.
2. Cookies
We use first-party cookies that are strictly necessary: your sign-in session and, for administrators, the two-factor step. We do not use advertising or analytics cookies. When you pay, you are taken to Stripe's own page, which sets its own cookies under Stripe's policies.
3. Video and recordings
When you watch, your browser loads the video directly from our video provider (Cloudflare Stream), which therefore sees your network address and device details, as any host would. To deliver live video the provider keeps a temporary recording of each broadcast. Our cleanup system deletes those recordings after seven days. We do not offer recordings to members. Seven days is our current policy; if it changes, we will update this page. House Live broadcasts only while the monitored areas are empty of people (section 7 of the Terms).
4. Who handles your data
- Vercel hosts the site and keeps server logs.
- Neon hosts our database (account, access, purchase and activity records).
- Cloudflare delivers the live video and holds the temporary recordings.
- Stripe takes payments and sends receipts and refund notices. Stripe's own privacy notice covers card data; we receive only a customer reference, the amounts and the status.
- Resend sends our account emails (verification, password reset, membership invitations and, when we send them, notices about your membership).
They process information on our behalf only to operate House Live, under their own privacy and security terms, and may do so in the United States. We do not sell your personal information and we do not share it for advertising. We may disclose information if the law requires it or to protect our rights and safety.
5. Email
We send the emails needed to run your account and purchases: today that is verification and password reset, and we may send notices about your membership. When you submit a membership request, we email our own team (not you) that a request arrived, with your name and email address. If we approve your request, we email you a personal invitation link that works for 72 hours, from our sending address, with your name in the greeting. Accepting an invitation creates your account only; it does not charge you or start a membership. Payment receipts and refund notices come from Stripe. We send promotional email only to people who have separately opted in to it, and you can opt out at any time. There is no promotional email today.
6. How long we keep it
- Live-stream recordings: 7 days, then deleted by our cleanup system.
- Membership requests (name, email, optional reason): until we delete them. A request has no automatic deletion date today; we delete spam and any request you ask us to delete, and we keep a declined request for at least 30 days so that the same address cannot ask again straight away. If a request is approved, the invitation we create keeps the email address until it is used or expires.
- Your account information (name, email, password hash, sign-in methods, two-factor setup, favorites): while your account is active. When you close it, we delete these or replace the account with an anonymous "Deleted member" record, and end access.
- Billing and transaction records (purchases, amounts, refunds, Stripe references): kept for as long as needed for accounting, tax, fraud and dispute purposes, generally 7 years. They are not deleted automatically today, so they may be kept longer until we delete them. They stay, tied to the anonymous record, after an account is closed.
- Security and operating records: the administrator log is kept permanently by design (it cannot be edited or deleted) and holds no passwords or card data. Viewing-session and activity records (camera, times, device identifier, a salted hash of your IP address, browser details) have no automatic deletion date today; after an account is closed they stay without your name or email. Short-lived abuse counters are deleted automatically soon after they expire.
- Sign-in sessions: they stop working when they expire (up to 30 days) or when you sign out. Expired session records are not purged on a fixed schedule today.
- Our providers' own logs (hosting, video and database providers) are kept under their own settings and retention periods.
7. Your choices and rights
You can ask us to give you access to, correct, or delete your personal information, or to close your account. Write to the privacy contact above from the email address on your account. We verify your identity before we act on a request, we respond within the time the law requires, and we may keep or decline to delete records that the law requires us to keep or that are otherwise exempt from deletion, and we will tell you when that applies. There is no self-service export or deletion button yet; a person handles each request, and we cancel any active subscription first.
8. Children
House Live is for adults. You must be at least 18 to have an account, as the Terms say, and we do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it, except for records we must keep.
9. Security
We use encrypted connections, hashed passwords, two-factor sign-in for administrators, limited database permissions, and monitoring of our systems. No system is perfectly secure.
10. Changes
We will post updates here with a new date, and email members about material changes.