Overview
Habbend ("we," "us," or "our") operates habbend.com. This Privacy Policy explains what limited information we collect when you use the Site, and how we handle it. By using the Site, you also agree to our Terms of Use.
Information We Collect
Depending on how you use the Site, we may collect:
- Account information — email address, password (stored as a one-way hash), display name, and the Habbo Origins identity you choose to link (name, hotel, and unique id).
- Verification and security data — Habbo motto verification tokens, email verification tokens, session cookies, and basic request metadata such as IP address used for rate limiting and abuse prevention.
- Optional profile data — avatar pose preferences, profile banner selection, and similar settings you choose to save.
- Usage and contributions — actions you take while signed in (for example price suggestions, collections, or comments), and aggregate analytics that do not identify you personally when possible.
Much of the Site is browsable without an account. Public Habbo Origins catalogue and activity data shown on the Site comes from publicly accessible sources and is not personal information about you.
How We Use Information
We use this information to:
- Operate accounts, sign-in, and Habbo linking;
- Provide Site features you request;
- Protect the Site against abuse, spam, and unauthorized access;
- Communicate about your account (for example email verification or password reset);
- Improve and maintain the Site.
We do not sell your personal information. We do not use it for third-party advertising.
Account Security
We take practical steps to protect accounts on the Site. No website can guarantee perfect security, but we design sign-in, sessions, and account recovery so that a stolen password file, a copied cookie, or a guessed reset link is not enough on its own.
- Passwords are never stored in a form we can read back. They are saved only as a one-way hash. We cannot email you your current password, and a copy of the database does not contain usable passwords. Member passwords must be at least 8 characters; staff accounts require a longer password that includes letters and numbers.
- Email must be verified before you can sign in. A new account stays locked until you confirm the address through a one-time link. Those links expire (typically within 24 hours) and are stored as hashes, not as the raw token.
- Password reset is short-lived and one-use. Reset links expire after 30 minutes. Requesting a new reset invalidates unused older ones. Completing a reset signs out other open sessions for that account. We answer reset requests the same way whether or not the email is registered, so the form is not a way to check who has an account.
- Signed-in sessions use browser cookies that scripts on other sites cannot read (HttpOnly), marked Secure on HTTPS, and limited with SameSite. Session identifiers are regenerated when you sign in. Idle sessions expire (about 12 hours for members, 2 hours for staff). An optional "keep me signed in" lasts up to 14 days for members; staff accounts cannot use it. No session is kept longer than 30 days without signing in again.
- Actions that change data require a CSRF token tied to your session, so a form or script on another site cannot piggyback on your login.
- Sign-in, sign-up, and reset are rate-limited by address and, where relevant, by email, to slow password guessing and abuse. Identifiers used for those limits are hashed rather than stored in the clear.
- The Site is served over HTTPS with browser security headers, including a content security policy, clickjacking protection, and HTTP Strict Transport Security, so traffic is encrypted in transit and the pages are harder to misuse in an iframe or injected script.
You still play a part: use a unique password, keep the email inbox you registered with under your control, and sign out on shared computers. If you think an account was used without your permission, contact us at [email protected] and we will help lock it down.
Cookies and Local Storage
We use cookies (and similar storage) as needed for signed-in sessions, CSRF protection, and remembering preferences such as theme. You can clear cookies in your browser; doing so may sign you out or reset preferences.
Sharing
We may share information only when needed to operate the Site (for example email delivery providers, if configured), to comply with law, or to protect the Site and its users. Linked Habbo names and public profile material you choose to display may be visible to other visitors as part of normal Site features.
Retention
We keep account and related records for as long as your account remains active, and for a reasonable period afterward if needed for security, backups, or legal obligations. You may contact us to request account deletion.
Children
We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, contact us and we will take appropriate steps.
Changes
We may update this Privacy Policy from time to time. The "Last updated" date above will change when we do. Continued use of the Site after changes are posted means you accept the revised policy.
Contact
Privacy questions may be directed to: