Privacy Policy

1.Who is responsible

The controller of your personal data is ONEXPLOIT SECURITY LABS SRL, Str. Broscariei 70, Maldaeni, Teleorman, 147195, Romania (Trade Register number J2020000526348). For anything about your data, write to [email protected]; for everything else, [email protected].

2.What we collect

When you create an account

• Your email address and a password, which we store only as a one-way hash. If you sign in with Google, GitHub, Facebook or Apple instead, we receive your account id with that provider, your email address, your name and, from Google and GitHub, your profile picture. Sign in with Apple is offered in the iOS app; if you choose to hide your email there, Apple gives us a private relay address instead, and your name only the first time.
• A handle and display name, generated for you at sign-up; you can change the display name later.

What you choose to add

• First and last name, a short bio and an avatar image. We re-encode uploaded images, which removes hidden details such as location metadata.
• Your answers to the four skill questions during onboarding.

When you play

• Your answers, scores, how long each answer took, whether you used a hint, your progress, streaks, XP, tokens, rewards, achievements and duel results.
• The type of device you answer on (phone, tablet or desktop), worked out from your screen width.

If you turn on notifications in the app

• The push token your phone is given for Hexret, and whether it is iOS or Android, so we can deliver the season pings. We remove it when you sign out of that device or delete your account, and when the device reports the token as no longer valid.

When you pay

• Your Paddle customer and subscription identifiers, plan, and renewal or end dates. Paddle collects and holds your card details and billing address; we never see them. For a subscription bought in the apps, the store and RevenueCat hold the purchase record and we keep only the plan and its dates.
• If you use the 14-day refund, a one-way hash of your email address. It is not linked to your account and stays after you delete it, so the refund cannot be claimed again by signing up with the same address.

When you send feedback or review a card

• Your message, the reasons you picked, and any screenshot you attach, together with your IP address.
• Technical details of the moment: the page you were on and the few before it, your browser and operating system, screen size, language, time zone and the last error the app saw. For general feedback this is optional and off unless you turn it on; for card and run reviews it is always included, because it is how we reproduce the problem you are reporting.

To keep your account and the service secure

• Each time you sign in, your IP address, browser details and the session's start, last activity and expiry.
• Signals that play may be automated, such as an unusual number of distinct cards seen in a day.
• In the apps, when you take a screenshot of a card we record that it happened: the screen, the card, your device type and the app version, never the image itself. It tells us if the library is being copied.

3.Why we use it, and on what legal basis

• To provide Hexret (your account, gameplay, progress, leaderboards, duels, rewards, the notifications you turn on and your Pro subscription): because it is necessary to perform our contract with you.
• To keep Hexret secure and fair (sign-in records, rate limits, anti-cheat and screenshot signals) and to fix and improve it(feedback, reviews and play statistics): our legitimate interest in running a safe, working service. You can object at any time; see section 7.
• To offer the 14-day refund once per person (the hashed email address): our legitimate interest in preventing refund abuse. You can object at any time; see section 7.
• To send account emails (address verification, email changes, password resets): to perform our contract. We do not send marketing email.
• To keep payment records: our legal obligations under tax and accounting law.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automatic limits (for example on how fast answers can be sent) pause play; they do not close accounts, and a person reviews any suspected cheating before we act on it.

4.What other players can see

Other signed-in players can see your handle, display name, level, mission, plan, equipped cosmetics, scores and ranks on leaderboards, and your duel rating, wins and losses in season standings. Anyone with its link can see your avatar image. Your email, real name and bio are shown only to you.

5.Who else handles your data

We use a small number of service providers. They handle your data only on our instructions and under a data processing agreement:

• DigitalOcean: hosts the app and its database, in the European Union.
• Paddle (Paddle.com Market Ltd): our reseller and Merchant of Record for purchases on the website. It takes the payment, issues the invoice and handles VAT, as an independent controller of the payment data under its own privacy policy. We send it your email address and your Hexret user id. When you delete your account we cancel your subscription there; Paddle keeps its records of your orders for as long as tax law requires, and you can ask Paddle to erase anything else.
• RevenueCat: records subscriptions bought in the App Store or Google Play so your account knows it is Pro. We send it your Hexret user id; Apple and Google send it the purchase. When you delete your account we delete your record there.
• Postmark: delivers account emails. We send it your email address and the message.
• Google, GitHub, Facebook and Apple: only if you choose to sign in with them. Their own privacy policies apply to what they collect on their side.

We may also disclose data when the law requires it, or to protect Hexret and its players from fraud or abuse.

6.Transfers outside the EU

Some of these providers are based in, or reach your data from, the United States. Where that happens, the transfer is covered by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.

7.Your rights

Under the GDPR you can ask us to:

• give you a copy of the personal data we hold about you (access);
• correct data that is wrong (rectification);
• delete your data and close your account (erasure);
• limit how we use it while a complaint is resolved (restriction);
• give you the data you provided in a machine-readable format (portability);
• stop using it where we rely on legitimate interests (objection).

You can edit your profile, remove your avatar and delete your account yourself in Settings; our data deletion page walks through it. For anything else, write to [email protected]. We reply within one month and may ask you to confirm it is really you before acting.

If you think we have mishandled your data, you can complain to the data protection supervisory authority in the EU country where you live or work, or to ours, the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 Bucharest, www.dataprotection.ro. We would appreciate the chance to put it right first.

8.How long we keep it

• Your account, progress and play history: while your account is open. When you delete it in Settings, it is deleted straight away.
• Detailed records of finished practice runs: 30 days. Your answers, progress and duel results stay with your account.
• Sign-in records (IP address and browser) and email links: 90 days after the session or link ends.
• Screenshot counts: 90 days after the day they belong to.
• Push tokens: until you sign out of that device or delete your account.
• Feedback and reviews: 24 months, or until you delete your account.
• Refund record (hashed email address): 24 months after the refund, including after you delete your account.
• Payment records: kept by Paddle (or by Apple or Google, for purchases in the apps) for as long as tax and accounting law requires.

9.Cookies and storage on your device

Hexret uses only what it needs to work, so it does not ask for cookie consent:

• hexret_session: keeps you signed in. It lasts until you close the browser, or 30 days if you choose “remember me”.
• hexret_oauth_state: protects social sign-in against forgery. It lasts 10 minutes.
• Local storage: a copy of recently loaded app data so pages open faster (cleared after 24 hours and when you sign out), your layout preferences, and the progress of a run you are in the middle of.

There are no advertising, analytics or other third-party tracking cookies.

10.Security

Connections to Hexret are encrypted. Passwords and session tokens are stored only as hashes, and access to personal data inside Hexret is limited to the people who need it to run the service. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

11.Age

Hexret is for adults. We do not knowingly collect data from anyone under 18, and we delete an account we learn belongs to someone under 18.

12.Changes to this policy

If we change this policy in a way that matters to you, we will tell you in the app before the change takes effect. The date at the top shows when it was last updated. Our Terms of Service explain the rest of our agreement with you.