Privacy / Updated October 9, 2026
Your curiosity.
Your information.
We use the information you choose to share to keep in touch—and a small set of website statistics to understand what is useful. We do not sell your email address or personal information.
Who is responsible
Tech in the Box operates this website. For privacy questions, access, correction, deletion or withdrawal requests, contact [email protected]. This contact inbox currently uses our Shirts Frenzy domain; that does not subscribe you to Shirts Frenzy marketing.
Mailing address: Tech in the Box 17810 Yonge Street, Bldg A, Suite 1016 Newmarket, ON L3Y 8S1 Canada.
If you ask for email updates
We collect your email address only when you submit the signup form and actively check the consent box. The permission is for occasional Tech in the Box emails about new blog articles, not unrelated advertising, another brand’s mailing list or third-party promotions. Signing up is optional and never required to read, browse or play.
We record the consent time, the exact wording and contact details shown, the form used and this policy version. We do not currently send a confirmation email or verify that the person submitting an address owns that mailbox. Opt-ins are marked unverified. Delivery is deferred until our email system is configured; the list is not currently sent to a marketing platform.
When delivery is introduced, authorised people and service providers acting for Tech in the Box may process the list only for these updates. We will assess the provider, safeguards and unsubscribe handling before transferring it and update this policy with material changes, including relevant processing locations. A different marketing purpose would need a new permission.
Change your mind, any time
Withdraw using our form or email us. No account or fee is required. Form withdrawals take effect immediately in this website’s list; future emails must include an easy unsubscribe route. We remove the stored email on withdrawal and keep a protected matching value and minimal consent/withdrawal history for up to one year to avoid accidentally adding it back. A withdrawn address cannot automatically rejoin through the signup form; contact us if you want to rejoin.
While you remain opted in, we retain the email and consent record for the stated blog-update purpose. If we abandon that purpose, we will delete the list. You can request access, correction or deletion; we may need proportionate verification before disclosing or changing a record.
Website statistics—not a dossier
Our first-party analytics counts public page views, broad referral sources (such as a search engine or one of our product sites), page-to-page transitions when the browser supplies a referrer, and clicks to recognised external destinations. It stores daily totals, public page paths and fixed source/destination labels for up to 365 days, with automatic expiry.
We do not store IP addresses, full referrer URLs, URL query strings, search terms, email addresses, browser fingerprints or visitor/session identifiers in analytics. We do not use advertising pixels, third-party analytics scripts, analytics cookies or cross-site tracking. Email signup and withdrawal pages, owner pages, private content and design studies are excluded. We cannot use these counts to reconstruct an individual’s complete visit, report unique people or determine their location.
We honour Do Not Track and Global Privacy Control signals for analytics. Referral restrictions, blocked JavaScript, recognised bots and these choices mean some activity is not counted. Counts describe requests and clicks, not verified humans. Appearance preferences may be saved on your device, separately from analytics.
Playing Orbital Chess
When you enter the chess station, your chosen guest name is visible to other people in the waiting room and to your opponent. We temporarily hold names, invitations, moves and game state in server memory to run the game. Your browser tab keeps a random guest token in session storage so a refresh can reconnect. These are used only for gameplay and are not joined to website statistics, email records or advertising.
Guest sessions expire after two minutes without contact. Game records disappear when their players leave or expire; the server also ends games after six hours, and a server restart clears all sessions. There is no saved-game history, chat, account or ranking. Sign out of the waiting room to remove your guest session immediately. Keep sensitive information out of your public short name.
Storage and safeguards
Subscriber records and statistics are stored in private server-side databases outside the public website files. Email values are encrypted with application-managed keys, and owner access requires authentication through our private administration connection. Form protection and short-lived, in-memory request limits help prevent misuse. These controls reduce risk; no system is perfectly secure.
Network addresses are necessarily processed to deliver requests and enforce short-lived abuse limits, but are not written to the analytics database. Hosting and network infrastructure may process operational security information separately. We do not record signup form bodies in application logs. Do not send passwords or sensitive information through our contact email.
Necessary anti-forgery cookies protect forms, and an authenticated owner receives a private administration cookie. These are not analytics identifiers. Personal-data forms require HTTPS or our private loopback/SSH access; the ordinary HTTP LAN preview does not accept email collection.
Host administrators and authorised operators can access server storage and keys. Protected email storage is not a promise that another process running under the same server account is isolated. Backups and future exports must be access-restricted, subject to deletion/retention rules and checked against withdrawals before any restored list is used.
Links and changes
External product and social links lead to separate websites with their own privacy practices. The Shirts Frenzy social accounts linked here belong to that product, not a new Tech in the Box social account.
We will update this page when our practices change. We will not treat an updated policy as consent to a materially different use of your email.