Privacy Policy

1. What we collect

When you create an account

• Your username and password. The password is stored only as a one-way hash; we cannot read it.
• If you sign in with Google: the name, email address and profile picture Google shares with us.
• The alpha invite code you used, if any.

When you play

• Your character and progress: levels, items, currencies, achievements, settings, and the history of your fights, crafting, trades, market activity and guild activity.
• What you write: chat messages, whispers to other players, your bio, names you put forward, and feedback and bug reports.
• When you were last active.
• Moderation records: any mute or ban, with the reason.

Technical information

• Your IP address, used to limit repeated sign-up and sign-in attempts. It is kept only for that short window.
• Our hosting provider keeps standard server logs, which include IP addresses, for a limited time.

Fair-play records

To enforce the Rules on automation and on one account per person, we keep two kinds of record. Neither is ever used to act on an account automatically; a moderator reviews them.

• Where you play from. When you sign in and when you refill your action bank, we note the network and device you are using, at most once a day. We do not store your IP address: we store a scrambled code made from it (a keyed hash) that can only tell us whether two accounts share a network, plus which provider's network it is and whether that provider is a data centre or VPN. The device is identified by a random ID in a cookie (see below). Kept for 90 days after it was last seen.
• When you refill your action bank. The time of each refill, and how many actions were left. Kept for 14 days.

2. Cookies and browser storage

We use a sign-in cookie to keep you logged in, a few security cookies that protect sign-in, and a device cookie: a random ID, kept for a year, used only for the fair-play records above. The game also saves preferences in your browser, such as your theme and chat settings. All of these are needed for the game to work. We use no advertising, analytics or third-party tracking cookies.

3. Why we use it

• To run the game: your account, character, progress, chat and trades. This is necessary to provide the service you signed up for.
• To keep the game fair and safe: preventing cheating, multiple accounts, scams, abuse and attacks, and enforcing the Rules. This is in our legitimate interest, and in the interest of every other player.
• To improve the game: reading bug reports and feedback, and studying how the game is played, from the game's own records.
• To meet legal obligations, where they apply.

We do not use your information for marketing, and we do not sell or rent it. Any decision to restrict or ban an account is made by a person, not automatically.

4. What other players can see

Your character name, level, profile, bio, achievements, leaderboard positions, guild, market listings and public chat messages can be seen by other players. Whispers are seen by the player you send them to. Staff may read any messages, whispers included, when looking into a report or a breach of the Rules.

5. Who we share it with

We share information only with the services that run the game for us, and only what each needs:

• Render hosts the game and its database, in the United States.
• Google handles “Sign in with Google”, if you use it (United States).
• GitHub stores our encrypted nightly database backups (United States).

We may also disclose information if the law requires it, or where needed to protect players or the game from serious harm.

6. Information held overseas

Hextalon is run from Australia, but its servers and backups are in the United States, so your information is stored and processed there. We choose providers that protect it with industry-standard security.

7. How long we keep it

• Account and game information: for as long as your account exists.
• Chat messages: while the game runs, so reports can be checked.
• Backups: each nightly backup is deleted after 90 days.
• Sign-in attempt records: a short time only.
• Fair-play records: 90 days after last seen (where you play from), 14 days (refill times).

If you ask us to delete your account, we delete it from the live game. It disappears from backups as they expire, within 90 days. Some records, such as moderation and trade records involving other players, may be kept where needed to resolve disputes or prevent abuse.

8. Security

Passwords are hashed, connections are encrypted (HTTPS), backups are encrypted, and access to the database is limited to staff who need it. No system is perfectly secure. If a breach is likely to cause you serious harm, we will tell you and any regulator that requires it.

9. Children

Hextalon is not for children under 13. If we learn that an account belongs to a child under 13, we will delete it. Players under 18 need a parent or guardian's permission. A parent or guardian can contact us at hextalonidle@gmail.com.

10. Your rights

You can ask us to:

• give you a copy of the information we hold about you;
• correct information that is wrong;
• delete your account and information;
• stop or restrict a use of your information, or send it to you in a portable format, where the law gives you that right.

Email hextalonidle@gmail.com with your character name. We may need to confirm the account is yours, for example by asking you to send a message from it in the game. We reply within 30 days and do not charge for this.

11. Complaints

If you are unhappy with how we handled your information, email hextalonidle@gmail.com. We will look into it and reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the European Union or the United Kingdom, you can also complain to your local data protection authority.

12. Changes to this policy

We will update this policy when what we collect or how we use it changes. The date at the top shows the latest version, and we will announce significant changes in the game.