Privacy Policy

Last updated:

This Privacy Policy explains what information Hexlands ("we", "us") collects when you use the Hexlands mobile application and the hexlandsgame.com website (together, the "Service"), and how we use and protect it. By using the Service you agree to the practices described here.

1. Who we are

Hexlands is an independently developed game. You can reach us through our Support page for any privacy-related questions or requests.

2. Information we collect

Information you provide to us

• Contact / bug-report form: when you submit the form on our Support page, we receive the email address and description you enter. We do not collect an email address for account creation — the Service does not have user accounts in the traditional sense, and email is used only to let us follow up on your bug report or support request.
• Nickname: a display name you choose in-app, which is shared with other players in the same game room.
• Device-generated player ID: when you first launch the app, your device creates a random identifier (a UUID) used to associate you with games you join so you can reconnect if disconnected. It is not linked to your Apple ID, email, or real-world identity, and you can reset it at any time (see Section 7).
• Player reports: if you report another player for abusive behavior, we receive your report, the reporting and reported player IDs, and a short snapshot of recent chat messages to help us evaluate the report.
• User-submitted content: anything you voluntarily send us (e.g. additional detail in a bug report).

Information collected automatically

• Contact form request metadata: when you submit the contact form, the request's IP address and user-agent are stored alongside the report to help us diagnose abuse and reproduce technical issues.
• Gameplay state: to allow you to reconnect to in-progress matches, we store game state on our servers, including room codes, tile placements, meeples, scores, and which nicknames are participating. This is not linked to your Apple ID or real-world identity.
• Single-player AI training data: when you play a single-player game against the AI and your score exceeds the AI's score, we automatically record a summary of that game — including tile placements, meeple placements, scores, and move sequences — and transmit it to our servers. This data is associated only with your device-generated random identifier (not your Apple ID, name, or email) and is used solely to improve the Hexlands AI. Raw game records are retained for 90 days and then automatically deleted; derived training data (mathematical summaries with no personally identifiable information) may be retained indefinitely. You can opt out by disabling single-player recording in Settings → Privacy in the app.

Information from Apple

• Subscriptions: purchases and renewals of the Hexlands Creator subscription are handled entirely by Apple. The app receives a signed receipt from StoreKit to verify your entitlement. We do not receive your Apple ID, name, email, billing address, or payment information.

Microphone and speech recognition

If you use voice chat, your speech is transcribed on your device using Apple's Speech Recognition. The resulting text is sent to the other players in your game room and retained as part of the chat log for that match. Raw audio is not transmitted to, or stored on, our servers.

Locally generated content

When you tap Share Score or Share Replay on the end-of-game screen, the Service generates an image or video on your device from your own gameplay. These files are stored in the app's temporary storage on your device and are not sent to our servers. They leave your device only if and when you choose to share them via the iOS share sheet.

3. What we do NOT collect

• No third-party analytics, advertising, or tracking SDKs.
• No advertising identifiers (IDFA).
• No cross-app or cross-site tracking.
• No precise location data.
• No reading of your contacts, photos, calendar, or health data. The app writes files to your Photos library only when you explicitly choose Save Video or Save Image from the iOS share sheet.

4. How we use information

• To operate the Service — matchmaking, game state, saving progress, voice-chat transcription delivery.
• To respond to bug reports and support requests.
• To improve the AI opponent in single-player mode by training machine-learning models on anonymised gameplay data.
• To detect, prevent, and address fraud, abuse, or violations of our Terms.
• To comply with legal obligations.

5. Sharing

We do not sell your personal information. We share information only:

• With infrastructure providers (Amazon Web Services) that host the Service on our behalf, subject to their own security controls;
• With other players in your game room, limited to your chosen nickname, in-game actions, and any chat text you send;
• If required by law, legal process, or to protect the rights, property, or safety of users or the public.

Your nickname and in-game actions may appear in screenshots or replay videos that other players in your game room generate and share outside the Service. Such content is created and distributed by those players and is not under our control.

6. Retention

• Bug-report submissions (email, description, IP, user-agent) are automatically deleted one year after submission via an S3 lifecycle rule.
• Game state is retained while a match is active or recently completed so you can reconnect, and is periodically pruned.
• Chat logs exist only for the duration of the match in which they were sent.
• Single-player AI training records are automatically deleted 90 days after submission. Derived model weights trained on this data contain no personally identifiable information and may be retained indefinitely.

7. Your rights

Deleting your data in-app. You can erase your local player identity and request removal of your participation in game records at any time via Settings → Your Data → Delete My Data in the app. This (a) resets your device-generated player ID to a new random value, (b) clears your stored nickname and any saved reconnect state on your device, (c) removes you from any game you are currently in, and (d) asks our servers to remove you from games still in the waiting lobby and to replace your nickname with "Former Player" in any games that have already started or finished (scores and meeple counts are preserved so the historical game is not broken for other players). Chat messages are ephemeral and are not stored on our servers after a match ends.

Bug reports. You can request deletion of a bug report you submitted by contacting us via the Support page using the same email address you submitted the report with.

Gameplay. To stop sharing any nickname or gameplay activity with other players, leave the game session.

Subscriptions. To stop your Hexlands Creator subscription, manage it in Settings → Apple ID → Subscriptions on your device; cancellation and refunds for subscription charges are handled by Apple per its policies.

8. Children

The Service is rated for players ages 9 and up. To protect younger players, chat in public multiplayer games is limited to a fixed set of preset phrases, and open text and voice chat are available only in private games between players who already know each other. Players can also mute or report other players in-game, and parents can turn text chat off entirely in Settings.

In the United States, we do not knowingly collect personal information from children under 13 without verifiable parental consent, consistent with the Children's Online Privacy Protection Act (COPPA). We do not require an email address or real name to play, and the only persistent identifier tied to a player is a device-generated random UUID that can be reset from within the app at any time. If you are a parent or guardian and believe your child has provided us with personal information, contact us via the Support page and we will take appropriate steps to delete it. Where required by law, children must have parental consent to use the Service.

9. International users

The Service is operated in the United States (AWS region us-east-1). If you use the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States.

10. Security

We use standard industry practices — encrypted transport (TLS), private S3 storage, and least-privilege access — to protect the information we hold. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.

11. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above. Your continued use of the Service after changes become effective constitutes acceptance of the updated Policy.

12. California residents

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA ("CCPA") gives you the following rights with respect to your personal information:

• Right to know what categories of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it.
• Right to delete personal information we have collected from you, subject to certain exceptions.
• Right to correct inaccurate personal information we maintain about you.
• Right to limit the use and disclosure of sensitive personal information. (We do not use or disclose sensitive personal information for purposes requiring such a limit.)
• Right of non-discrimination for exercising any of these rights.

We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA. We have not done so in the preceding twelve months. To exercise any of these rights, use the in-app Delete My Data control or contact us via the Support page. We may need to verify your request using information you previously provided (for example, the email address used on a bug report).

13. EU / UK residents

If you are in the European Economic Area, the United Kingdom, or Switzerland, the UK GDPR and EU GDPR give you rights over your personal data. The data controller is Hexlands.

Legal bases. We process personal data under the following legal bases:

• Contract — to operate the Service you have requested (matchmaking, game state, subscription entitlement).
• Legitimate interests — to diagnose bug reports, detect abuse and cheating, secure the Service, and handle player reports. You can object to this processing at any time.
• Consent — for optional features you explicitly enable (e.g. microphone access for voice chat). You can withdraw consent at any time in system Settings.
• Legal obligation — where we must retain or disclose data to comply with law.

Your rights. Access, rectification, erasure, restriction of processing, portability, and objection. You also have the right to lodge a complaint with your local supervisory authority. To exercise any right, use the in-app Delete My Data control or contact us via the Support page. We respond to verified requests within one month.

International transfers. As noted in Section 9, personal data is processed in the United States. Transfers from the EEA/UK rely on standard contractual protections where applicable.

14. Contact

Privacy questions or requests? Reach us via the Support page.