Privacy Notice

Last updated: 1 November 2026.

Who is responsible

Data and purposes

We process nicknames, game and session identifiers, game activity, connection times and optional chat messages to provide HËXE. Nicknames, chat and shared game activity are visible to others in the same room. A nickname and session cookie are needed to play; no account or email is required.

IP addresses, request details and IP-derived security counters are processed to deliver the site and prevent abuse. If you contact us, we process your contact details and message to respond. The legal basis is our legitimate interest in providing a secure game and handling enquiries (Article 6(1)(f) GDPR), and Article 6(1)(c) where legally required.

Browser storage

First-party session cookies authenticate your access and last up to 24 hours, unless you leave earlier. Local storage remembers your nickname, recent session, read-chat status, theme and guide completion until removed by the app or cleared in your browser. You can block or delete storage in your browser; blocking cookies prevents play and blocking local storage prevents remembered settings. We use no advertising or analytics trackers.

Retention

Room access expires five minutes after inactivity or game completion. Expired game, chat and session records are deleted during subsequent requests; deletion may be delayed without further traffic. Database security counters become eligible for cleanup after two minutes; server-memory counters remain until replaced by traffic or the server instance ends. Database recovery copies may remain for up to seven days.

Correspondence is kept as needed to handle the enquiry and related follow-up, or longer where required by law or necessary for legal claims. Browser storage is separate from server deletion. Cloudflare may retain service/security metadata as needed for service operation, security and legal obligations under its privacy policy; optional application-log storage is disabled.

Recipients and transfers

Cloudflare, Inc. provides hosting, security, the EU-jurisdiction game database and email forwarding. Global network processing can include countries outside the EEA. Cloudflare's Data Processing Addendum includes standard contractual clauses for applicable transfers; subprocessors are listed here. Contact us for safeguard details or a copy.

Email reaches an Apple iCloud Mail inbox (EU provider: Apple Distribution International Limited, Ireland; privacy information). Clear-Media UG (Online-Impressum) handles post and its external contact form (privacy information). These providers may process data internationally under their applicable safeguards.

Your rights

Contact hi@playhexe.com to request access, correction, erasure, restriction or, where applicable, portability. You may object to processing based on legitimate interests for reasons relating to your situation. We may need information to identify your session. You can complain to the Bavarian Data Protection Authority (BayLDA) or another competent authority. We do not make automated decisions with legal or similarly significant effects.