hexxWho operates this service
hexx.lol is operated by Nathaniel Coddington, who is responsible for the information described here. You can contact the operator at necoddington@gmail.com.
Information we collect
We store your account identifier, verified email address, and available name and profile information from your sign-in provider. We also store information you submit: your username, bio, optional location, social links, appearance settings, uploaded images, audio or video, templates, template favorites, interests, guestbook comments, messages, and support requests. Draft recovery stores profile edits on your browser, separately for each signed-in account, for up to seven days. Guestbook comments are queued for profile-owner or staff approval before publication.
Unread-message tracking records which conversations you have opened. Optional delivery and read receipts share received/viewed status with the other participant when enabled; receipt sharing is off by default. Community records include message requests, conversation participants, timestamps, blocks, reports, and report-related message snapshots. Account records may include Premium access status and payment references when applicable.
Our hosting and authentication services process technical information such as IP addresses, browser information, requests, and security logs. An optional browser identifier cookie lasts up to 90 days and supports returning-visitor and experiment reports. Security records include browser descriptions, sign-in times, last activity, and session revocation. Optional activity email alerts use your verified sign-in email and can be disabled from Activity. Profile analytics record views and link clicks, date, referring website hostname, approximate country, and a broad device category. The application uses a hash derived from an IP address, date, and profile or event to reduce duplicate counts. This is pseudonymous information, not a guarantee of anonymity.
How we use information
We use information to authenticate you, save and display profiles, deliver messages and sign-in emails, provide templates and analytics, manage account access, respond to requests, investigate reports, reduce abuse, and keep the service working. Public view totals also support the leaderboard. We do not sell personal information or use Google account data for advertising or general-purpose AI model training.
Google, Discord, and email sign-in
Supabase manages authentication. Google sign-in requests basic profile and email information to identify your account; it does not request access to Gmail messages, contacts, or Drive files. Discord sign-in can supply account information such as your Discord identifier, username, avatar, and available avatar decoration. Hexx can use supported Discord appearance information when you select those options.
We do not receive your Google or Discord password. Authentication providers manage their own passwords and account security. Resend delivers email sign-in links and receives the destination email address and email content needed to send them. Keep sign-in links private.
You can revoke provider access in your Google or Discord account settings. Revoking access or signing out does not automatically delete your Hexx account or saved profile information; contact us for deletion.
Public content and private messages
Published profiles and public templates are available to anyone, including people without an account. Profile names, links, media, selected Discord details, and view totals may appear on public pages, the leaderboard, or discovery features. Public templates are intended for others to reuse. Search engines and other visitors may copy public content.
Group chats are invitation-based. Active members can read the group’s recent history; removing a member blocks future access through the app. Group chats and DMs are restricted to conversation participants through the application, but are not end-to-end encrypted. Authorized service administration and infrastructure providers may access stored information as needed to operate the service, handle reports, or comply with legal obligations. Reports may include a stored snapshot of conversation content. Recipients can copy or share messages outside Hexx.
Unpublishing limits profile visibility but does not erase external copies. Uploaded media URLs are not a confidential file vault; do not upload sensitive documents or content you need to keep secret.
Retention and security
Account information and submitted content are retained while needed to provide the service. Analytics, messages, report records, and logs may remain until removed or no longer needed for their operational purpose. Signing out, blocking someone, disconnecting an integration, or hiding a link does not by itself erase stored records.
Contact us to request deletion. Some information may need to remain for legal obligations, security investigations, dispute handling, or backup recovery; deletion may not immediately remove backup copies or copies held by other users. We use access controls and encrypted connections, but no online service can promise absolute security.
Our providers may process information in the United States and other countries where they operate. Applicable privacy protections can differ by location.
Your choices and requests
You can edit your profile, control publication, hide links, choose whether to participate in discovery, and use available DM and blocking settings. To request account deletion, a copy of your information, correction, or restrictions on processing, email necoddington@gmail.com. We may need to verify account ownership before acting. Do not include passwords or authentication codes.
Depending on your location, you may have additional rights to access, delete, correct, transfer, or object to processing of your information, and to complain to your local privacy authority. We handle requests subject to applicable law.
Age requirements
Hexx is not intended for children under 13 or anyone below the minimum age required to use the service in their country. If you believe a child has provided personal information in violation of these requirements, contact us so we can investigate and remove it where appropriate.
Policy changes
We may update this policy as the service changes. The effective date above identifies the current version. For material changes, we will provide notice through the service or an appropriate contact method, and obtain consent where required.