Privacy policy

Hex Limited, company number 17468671, registered in England and Wales, registered office 167-169 Great Portland Street, London, England, W1W 5PF, is the controller of the personal data described here. Write to us at hello@hexeria.com.

Everything below is also listed live, with a count, on the “Your data” page of your account, where you can check this policy against what is actually held.

• Your account: your account ID, email address, password (as a hash, never the password), display name, about text and profile picture, and whether two-factor authentication is on. To let you log in and to show other people who you are. Lawful basis: performing our contract with you.
• Sign-ups and email links: when you sign up, the address and a hash of your password wait, with a hash of the link we mail you, until you open it; no account exists until then. While you change your address, the new one waits the same way. So the address on every account is one its owner can read. Basis: taking steps at your request before a contract. Deleted when the link is used, or a day after it was sent.
• Logged-in devices: for each device, the browser and system, the IP address it signed in from, when it was last seen, and which organisation it is acting as. To keep you logged in and let you see and sign out every device. Kept thirty days from sign-in, or until you sign the device out. Basis: contract, and our legitimate interest in keeping your account secure.
• Security activity: logins, failed logins, password and two-factor changes, passkeys added or removed, devices signed out, each with its IP address and browser. So you can spot a login that wasn’t you. Basis: legitimate interest in security. Kept for now; a retention limit is planned.
• Passkeys and recovery codes: a passkey’s public key and name; recovery codes as hashes. To let you log in. Basis: contract.
• Chat: the messages you send, with their attachments and edit times, the conversations you are in, your read position, mutes and blocks, and, if you turn notifications on, the address your browser’s push service gave your device. To deliver your messages and notify you. Basis: contract.
• Drive: your folders, files and share links, and the record of who uploaded or deleted what in an organisation’s drive. Basis: contract.
• Hex Limited’s own records: if you are one of Hex Limited’s directors, shareholders or staff, its company records and books hold what the Companies Act 2006 requires of it. They are the company’s records, kept by its administrators, not an app you use. Basis: legal obligation.
• Email you send us: every message sent to a hexeria.com address is kept in full, as it arrived: who it was from and to, its words and its attachments, readable only by Hexeria’s administrators. It is our correspondence, the same as keeping letters, and it is how reports, complaints and appeals by email reach us. Basis: our legitimate interest in keeping a record of what people write to us, and our legal obligation where the message is a complaint or a report. Kept for now; a retention limit is planned.
• Organisations: which organisations you belong to and your role in each. Basis: contract.
• Reports: reports you make (what, why, your words, and an email address if you gave one without an account), and reports about content of yours, each with a copy of what was reported so a person can judge it, and the decision. You are never told who reported you. Basis: our legal obligations under the Online Safety Act 2023. A dismissed report’s copy is deleted at once; an actioned one’s a year after the decision; the record of the decision is kept.

Every app opens at its own age, 18 unless it says otherwise, and the Online Safety Act 2023 requires us to use highly effective age assurance to keep children out of what is for adults. So before you can use any app, your identity is verified by our provider, Didit Identity Spain, S.L. (“Didit”), which reads a photo of your identity document, matches a selfie to it and checks that a live person is present.

• During the check, Didit processes the images of your document and your face, including facial geometry for the match, on our behalf, on servers in the European Union. Didit does not use your data for its own purposes; we have turned off its option to train its models on it.
• What we keep: your date of birth; your legal name as the document gives it; the document’s type, number, issuing country and expiry date; the day you were verified and how. Your date of birth is held under our legal obligation, because every app’s age gate is worked out from it. The document’s particulars are held in our legitimate interests: so that an account carries one verified identity, so that a document verifies one account only (one person, one account is a term of service), and for features that will need a verified name.
• What we never keep: the images of the document or of you, the machine-readable zone, your address, nationality or any personal number the document carries. As soon as we have the result we tell Didit to erase the whole check, images included. Your Verification page shows exactly what was kept.
• How long: for the life of your account. There is no re-check. A document showing an age under 13 is refused and nothing from it is kept at all.

• No analytics or tracking: no third-party scripts, no advertising identifiers, no behavioural profile.
• No selling or sharing of your data for anyone else’s purposes, ever.
• No location, and no device fingerprint beyond your browser’s own User-Agent string.
• No reading of your messages or files, except to deal with a report, a complaint or a legal duty.
• No copy of a photo as you uploaded it: profile and group pictures are redrawn as pixels only, with the camera’s metadata removed.
• No message contents in our admin tools: administrators see that messages exist, not what they say.

• Other people on Hexeria see what you choose to show them: your display name, picture and about text, what you send them, and what you share.
• Didit, our verification processor, during an identity check (section 3).
• Push services (Apple, Google or Mozilla, whichever your browser uses) carry chat notifications to your device. Each notification is encrypted to your device, so they carry bytes they cannot read.
• Our hosting provider, IONOS, runs the server in a UK data centre. It has no access to the data on it in the ordinary course.
• Our mail server, a machine of ours rented from Namecheap, receives email sent to us and passes it straight on without keeping it; it sends our emails the same way.
• Authorities, where the law requires it: for example, child sexual abuse content must be reported to the National Crime Agency.

Link previews in Chat are fetched by our server, not by your browser, so a site you are sent a link to never learns your address.

Your data is held on our server in the United Kingdom. Identity checks are processed by Didit in the European Union, which the UK recognises as providing adequate protection, under a data processing agreement that names the UK GDPR.

• Your account and what you put in the apps: until you delete it, or your account is deleted.
• One app’s data (Hexeria ID → Apps): you can delete everything an app holds for you, at once, without touching the others, and wipe the files you put in your drive. An organisation’s admins can do the same for it.
• Deleting your account (Hexeria ID → Security): it can’t be logged into from then on, but for fifteen days you can undo it, from the email we send or from the login page. From day seventeen and a half everything is deleted: your files, notes, calendar, repositories, your own books and every message you sent as yourself, with your direct messages deleted whole. Within thirty days it is gone everywhere, backups included. Only the account number stays, shown as “Deleted account”, where an organisation’s own records name what you did for it. A report about something you wrote keeps its copy for as long as section 2 says, because it is the record of a safety decision.
• Logged-in devices: thirty days from sign-in, or until signed out.
• Files in the Drive’s trash: thirty days.
• Backups: an encrypted copy is taken every night and kept for twelve nights, on our server and on a second one of ours, so something deleted can remain in a backup for up to twelve days.
• Records a law requires to be kept, such as a company’s statutory registers or accounting records, are kept for as long as that law says, even after the account that made them closes.

Hexeria sets one cookie, hex_session, which keeps you logged in across the apps for thirty days. It is strictly necessary, so no consent banner is needed and none is shown. Your browser’s own storage may hold your preferences, such as which chat categories you collapsed; that never leaves your device.

Passwords are stored with Argon2id. Everything travels over HTTPS. Two-factor keys are encrypted on the server, and share links and other secrets are random, never guessable. You can add passkeys and two-factor authentication, see every device logged in, and sign any of them out.

Under the UK GDPR you can ask to see the data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive a copy of it. The “Your data” page in your account already shows you what is held; for anything else, write to hello@hexeria.com and we will answer within a month. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Two things we cannot undo on request: a document that verified an account stays matched to that account while the account exists (so that it cannot verify another), and records a law requires us to keep are kept for as long as it says. If an account that was suspended for breaking our terms is deleted, we keep a one-way fingerprint of its identity document (not the document or its number) so it cannot verify a new account.

When this policy changes we put the new date at the top and, for a change that matters to you, tell you in the app. The rule behind it does not change: nothing is recorded without a duty that needs it.