Privacy notice
Last updated 15 October 2026
Who is responsible
Alex O'Keeffe, trading as Hexus, decides how your data is used. Contact: support@hexuspuzzle.com.
What we collect
- Account data, if you sign in: your email address, and a password hash if you set a password. If you use Google sign-in, Google gives us your email address.
- Game data: your puzzle results, finish times and streaks. These are stored against your account if you are signed in, and on your device if you are not.
- Subscription data: your plan, its status and renewal date. Paddle holds your payment details. We never see your card number.
- Anonymous usage events: actions such as starting or solving a puzzle, with the game and level. We turn your IP address and browser details into a one-way code that changes every day, so we can count visitors but cannot follow you from one day to the next. We remove email addresses from any error text before we store it.
- On your device: we store settings and progress in your browser's local storage, which is needed for the game to work. We do not use advertising or tracking cookies.
Why we use it, and our legal basis
- To run your account, save your results and give you what you paid for (contract).
- To take payment and keep tax records (contract and legal duty, through Paddle).
- To count usage and find errors so we can improve the game (legitimate interest).
- To email you sign-in links and account notices (contract).
Who we share it with
- Supabase: hosts our database and sign-in.
- Cloudflare: hosts the website.
- Paddle.com: takes payment as seller of record. It is a separate controller of your payment data, see Paddle's privacy notice.
- Google: only if you choose Google sign-in.
- Our email provider: sends sign-in and account emails.
We do not sell your data. Some of these providers process data outside the UK and EEA, under standard contractual clauses or an adequacy decision.
How long we keep it
We keep account and game data until you delete your account. Deleting it removes your email, results, streaks and subscription record from our database, and cancels any live subscription. Anonymous usage events carry no email address and no stable identifier. Paddle keeps transaction records for as long as tax law requires.
Your rights
You can ask to see, correct, export or delete your data, object to how we use it, or withdraw consent. You can delete your account yourself on the Account page. For anything else, email support@hexuspuzzle.com. You can also complain to your data protection authority, such as the ICO in the UK or the Data Protection Commission in Ireland.
Children
Hexus is not aimed at children under 13, and we do not knowingly collect their data. Tell us if you think we have, and we will delete it.
Changes
If we change this notice, we will change the date above.