Privacy Policy

• Your account: your email address and, if you set one, a hash of your password (never the password itself). If you sign in with Google or GitHub, the ID and verified email address they give us.
• Billing: your subscription, invoices and billing address. Card details go straight to Stripe; we never see or store card numbers.
• Your lattice's setup: its size, region, hostname and status.
• Technical data: IP addresses and request details in our servers' logs, kept for up to 30 days to run and protect the service.
• Messages: emails you send us and the account emails we send you.

What you store in your HexDB lattice is yours. We process it only on your behalf, to run the service, as described in the Terms of Service. It's encrypted on disk, and we don't read, sell or analyze it, or use it to train AI models. If you need a data processing agreement, email support@hexdb.app.

• to create your account, sign you in and keep it secure (our contract with you, and our legitimate interest in preventing abuse);
• to run and bill your lattice (our contract with you);
• to email you about your account, your lattice and your bills (our contract with you);
• to keep records the law requires, such as invoices (legal obligation).

We don't sell your personal information. We use these providers to run the service, each only for its part:

• A cloud hosting provider runs your lattice's hexes and stores their disks. We'll tell you which on request.
• Vercel hosts this website and its account functions.
• Stripe takes payments, calculates tax and sends invoices.
• Resend delivers our emails.
• Google provides reCAPTCHA, which checks the sign-in and sign-up forms for bots, and Google sign-in if you use it.
• GitHub provides GitHub sign-in if you use it.

We may also disclose information when the law requires it, or to protect people's safety or our rights.

We use only the cookies the service needs: one that keeps you signed in (for up to 30 days, or until you sign out), and a short-lived one that protects Google and GitHub sign-in. reCAPTCHA sets Google's own cookies on the account pages. We don't use advertising or analytics cookies.

• Your account, for as long as you have it. When you close it, we delete it within 30 days.
• Your lattice and its data, until your subscription ends, then within 30 days (see the Terms of Service).
• Invoices and payment records, for as long as tax law requires (usually up to 7 years).
• Server logs, for up to 30 days. Sign-in links expire within 48 hours, password reset links within an hour.

You can see, correct, export or delete your personal information, and object to how we use it. Depending on where you live (for example the EU, UK or California), the law gives you these rights and the right to complain to your data protection authority. Email support@hexdb.app and we'll answer within 30 days.

Passwords are stored only as salted scrypt hashes. Everything in your lattice is encrypted at rest with AES-256, and traffic to it uses TLS. Our own account records are kept in a HexDB lattice with the same protections. No system is perfectly secure; if a breach affects your information, we'll tell you without undue delay.

We're based in the United States of America, and our providers may process information in other countries. Your lattice's data is stored in the region you choose. Where the law requires it, transfers are covered by safeguards such as the European Commission's standard contractual clauses.

The service isn't for children, and we don't knowingly collect information from anyone under 16.

We'll post changes here and email you about significant ones. Questions, or a request about your information: support@hexdb.app. Martinforged, LLC (doing business as Dream In Hex), 708 Rembrandt Avenue, Ponte Vedra, Florida 32081, is responsible for your information.