Privacy

Last updated 2 September 2026

Tubes N Seeds is a small, invitation-only site run by the admins of a private Facebook group so the group can run seat games. It is not a company and it does not sell anything to anyone. This page describes exactly what the site stores about you, why, and how to get rid of it.

What we collect from Facebook

Signing in uses Facebook Login. When you approve it, Facebook gives us a small profile and nothing else. We keep:

• Your app-scoped Facebook ID. This is a number Facebook generates specifically for this site. It is different from your real Facebook ID and different from the ID any other app sees. It is what identifies your account here.
• Your name, as it appears on your Facebook profile. It is refreshed each time you sign in and is what other members see next to your seats.
• Your email address, only if you allow it. You may decline, and the site works normally without it.
• Your profile picture. We download a copy and store it here, because the links Facebook provides expire after a short time.

We do not receive your friends, your posts, your messages, or your group memberships. Facebook removed the ability for sites to check group membership in April 2024, which is why admins approve members by hand instead.

The access token Facebook issues during sign-in is used to read the profile above and is then discarded. We never store it, never request a long-lived one, and never post anything to Facebook on your behalf.

What the site records as you use it

• Your account status (awaiting rules, pending, approved, denied or revoked) and whether you are an admin.
• Your acceptance of the house rules: which version, when, and the IP address and browser user agent you accepted from. This is the record that you agreed, so it is kept rather than overwritten. Accepting a newer version adds a row; it does not replace the old one.
• A security log of sign-ins, failed sign-ins, rules acceptances, and approvals, denials or revocations, each with the IP address, browser user agent and time.
• Your activity in games: seats you claim or win, games you have won, and any seat picks you are owed.
• What you type when reporting a payment: which app you used, the reference or handle you entered, and any note. See the payments section below.
• Notifications addressed to you, and when you last marked announcements as seen.
• Your session. We store a one-way hash of your session cookie, not the cookie itself, so somebody reading the database still cannot sign in as you.

Cookies

The site sets two cookies. Neither is used for advertising or tracking.

• sid keeps you signed in. It is restricted to this site, unreadable by JavaScript, and sent only over HTTPS. It expires on its own, and signing out deletes it here and on the server.
• theme remembers whether you chose light or dark mode. It contains that one word and nothing else.

There is no analytics package, no tracking pixel and no advertising network on this site.

Payments

Seats are paid person to person through PayPal, Venmo or Cash App, directly between you and an admin. Payments do not go through this site. We never see or store card numbers, bank details or payment credentials. The only payment information here is what you type into the report form so an admin can match your payment: the app you used, a reference, and an optional note. Please put no more in that box than the admin needs.

Whatever happens inside PayPal, Venmo or Cash App is governed by their privacy policies, not this one.

Who can see your information

• Other approved members see your name and profile picture next to seats you hold, and on the winners page if you win. They never see your email address or your payment reports.
• Admins can see everything listed above, because they run the approval queue and confirm payments.
• Nobody else. We do not sell, rent or share your information with third parties. There are no data brokers and no marketing lists.

The site and its database run on hardware the admins own and operate themselves. There is no cloud host and no managed database service, so your information is not handed to an outside provider to store on our behalf.

The site has places where an admin can display a sponsor's banner. If a banner ever comes from an advertising network rather than being a plain image and link, that network could set its own cookies. If that happens, this page will be updated to name it before it goes live.

How long it is kept

• Your account and game history are kept while your account exists.
• Sessions expire on their own, and are deleted immediately if your access is revoked.
• Rules acceptances and the security log are kept for as long as the account exists, because they are the record of who agreed to what and who was let in.

Deleting your data

You can have everything removed at any time, and you do not have to give a reason.

1. Ask an admin. Message an admin in the Facebook group and say you want your account deleted.
2. We delete it. Your account, sessions, seats, seat picks, notifications, rules acceptances, security log entries and stored profile picture are removed. Expect this within 30 days, and normally much sooner.
3. Optionally, cut us off at Facebook too. In Facebook, go to Settings & Privacy → Settings → Apps and Websites, find Tubes N Seeds and remove it. That stops Facebook sharing anything further with the site.

Two things may survive: a game's recorded result, so past draws stay verifiable for the other players, and anything an admin needs to settle an outstanding payment with you. Both are reduced to the minimum, and your name is removed from public views.

You can also ask us what we hold about you, or ask us to correct it. Your name and picture correct themselves the next time you sign in, because they are re-read from Facebook.

Security

The site is served over HTTPS. Sessions are stored server-side and identified by a hashed cookie, forms are protected against cross-site request forgery, sign-in attempts are rate limited, and every database query is parameterised. Admin pages are invisible to non-admins. No system is perfect, and this is a hobby site run by volunteers, so please do not store anything here you would be upset to lose.

Children

This site is for adults in a private group. It is not intended for anyone under 18, and we do not knowingly collect information about children. Games involving payment may also be restricted by local law where you live.

Changes

If this policy changes, the date at the top changes with it. Substantial changes will be announced on the site.

Contact

Questions about any of this: message an admin in the Facebook group.

House rules · Sign in