Privacy Policy

1.Who is responsible

The controller of your personal data is ONEXPLOIT SECURITY LABS SRL, Str. Broscariei 70, Maldaeni, Teleorman, 147195, Romania (Trade Register number J2020000526348). For anything about your data, write to [email protected]; for everything else, [email protected].

2.What we collect

When you create an account

• Your email address and a password, which we store only as a one-way hash. If you sign in with Google, GitHub, Facebook or Apple instead, we receive your account id with that provider, your email address, your name and, from Google and GitHub, your profile picture. Sign in with Apple is offered in the iOS app; if you choose to hide your email there, Apple gives us a private relay address instead, and your name only the first time.
• A handle and display name, generated for you at sign-up; you can change the display name later.

What you choose to add

• First and last name, a short bio and an avatar image. We re-encode uploaded images, which removes hidden details such as location metadata.
• Your answers to the four skill questions during onboarding.

When you play

• Your answers, scores, how long each answer took, whether you used a hint, your progress, streaks, XP, tokens, rewards, achievements and duel results.
• The type of device you answer on (phone, tablet or desktop), worked out from your screen width.

If you turn on notifications in the app

• The push token your phone is given for Hexret, and whether it is iOS or Android, so we can deliver the season pings. We remove it when you sign out of that device or delete your account, and when the device reports the token as no longer valid.

When you pay

• Your Stripe customer and subscription identifiers, plan, and renewal or end dates. Stripe collects and holds your card details; we never see them.

When you send feedback or review a card

• Your message, the reasons you picked, and any screenshot you attach, together with your IP address.
• Technical details of the moment: the page you were on and the few before it, your browser and operating system, screen size, language, time zone and the last error the app saw. For general feedback this is optional and off unless you turn it on; for card and run reviews it is always included, because it is how we reproduce the problem you are reporting.

To keep your account and the service secure

• Each time you sign in, your IP address, browser details and the session's start, last activity and expiry.
• Signals that play may be automated, such as an unusual number of distinct cards seen in a day.
• In the apps, when you take a screenshot of a card we record that it happened: the screen, the card, your device type and the app version, never the image itself. It tells us if the library is being copied.

3.Why we use it, and on what legal basis

• To provide Hexret (your account, gameplay, progress, leaderboards, duels, rewards, the notifications you turn on and your Pro subscription): because it is necessary to perform our contract with you.
• To keep Hexret secure and fair (sign-in records, rate limits, anti-cheat and screenshot signals) and to fix and improve it(feedback, reviews and play statistics): our legitimate interest in running a safe, working service. You can object at any time; see section 7.
• To send account emails (address verification, email changes, password resets): to perform our contract. We do not send marketing email.
• To keep payment records: our legal obligations under tax and accounting law.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automatic limits (for example on how fast answers can be sent) pause play; they do not close accounts, and a person reviews any suspected cheating before we act on it.

4.What other players can see

Other signed-in players can see your handle, display name, level, mission, plan, equipped cosmetics, scores and ranks on leaderboards, and your duel rating, wins and losses in season standings. Anyone with its link can see your avatar image. Your email, real name and bio are shown only to you.

5.Who else handles your data

We use a small number of service providers. They handle your data only on our instructions and under a data processing agreement:

• DigitalOcean: hosts the app and its database, in the European Union.
• Stripe: takes payments and manages subscriptions. We send it your email address and your Hexret user id. When you delete your account we delete your customer record there too; Stripe keeps records of past payments for as long as tax law requires.
• Postmark: delivers account emails. We send it your email address and the message.
• Google, GitHub, Facebook and Apple: only if you choose to sign in with them. Their own privacy policies apply to what they collect on their side.

We may also disclose data when the law requires it, or to protect Hexret and its players from fraud or abuse.

6.Transfers outside the EU

Some of these providers are based in, or reach your data from, the United States. Where that happens, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

7.Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you (access);
• correct data that is wrong (rectification);
• delete your data and close your account (erasure);
• limit how we use it while a complaint is resolved (restriction);
• give you the data you provided in a machine-readable format (portability);
• stop using it where we rely on legitimate interests (objection).

You can edit your profile, remove your avatar and delete your account yourself in Settings; our data deletion page walks through it. For anything else, write to [email protected]. We reply within one month and may ask you to confirm it is really you before acting.

If you think we have mishandled your data, you can complain to the data protection supervisory authority in the EU country where you live or work, or to ours, the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro. We would appreciate the chance to put it right first.

8.How long we keep it

• Your account, progress and play history: while your account is open. When you delete it in Settings, it is deleted straight away.
• Detailed records of finished practice runs: 30 days. Your answers, progress and duel results stay with your account.
• Sign-in records (IP address and browser) and email links: 90 days after the session or link ends.
• Screenshot counts: 90 days after the day they belong to.
• Push tokens: until you sign out of that device or delete your account.
• Feedback and reviews: 24 months, or until you delete your account.
• Payment records: kept by Stripe for as long as tax and accounting law requires.

9.Cookies and storage on your device

Hexret uses only what it needs to work, so it does not ask for cookie consent:

• hexret_session: keeps you signed in. It lasts until you close the browser, or 30 days if you choose “remember me”.
• hexret_oauth_state: protects social sign-in against forgery. It lasts 10 minutes.
• Local storage: a copy of recently loaded app data so pages open faster (cleared after 24 hours and when you sign out), your layout preferences, and the progress of a run you are in the middle of.

There are no advertising, analytics or other third-party tracking cookies.

10.Security

Connections to Hexret are encrypted. Passwords and session tokens are stored only as hashes, and access to personal data inside Hexret is limited to the people who need it to run the service. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

11.Age

Hexret is for adults. We do not knowingly collect data from anyone under 18, and we delete an account we learn belongs to someone under 18.

12.Changes to this policy

If we change this policy in a way that matters to you, we will tell you in the app before the change takes effect. The date at the top shows when it was last updated. Our Terms of Service explain the rest of our agreement with you.