Hexstead

Privacy policy

Last updated November 13, 2026

Hexstead is an online board game at hexstead.app. This page explains what we collect when you play, why, and what you can do about it. The short version: we keep only what the game needs to work, we don't sell anything, and any ads are on the home page only, never during a game. Those ads come from Google, which uses its own cookies; see Advertising below.

What we collect

  • Your account. A display name, avatar and colour. If you register, your email address and a securely hashed password (we never see or store the password itself). Guest accounts have no email or password.
  • Google or Discord sign-in. If you use one, we receive your account ID, email address and name from that service, only to sign you in and fill in your profile. We don't get your password or access to anything else in that account.
  • Games you play. Every move, the result and the players in each game, so games can be resumed, replayed and counted in profile stats. If you have an account, your rating from Find a match games is shown on your profile and on the public leaderboard.
  • Chat and reports. Room chat is kept for up to a day. If someone reports a player, the recent chat is saved with the report so we can review it.
  • Friends and blocks you set up, and your settings.
  • Technical data. A sign-in cookie, your browser type for each signed-in session, and your IP address, which we use briefly to stop abuse such as password guessing. If the game hits an error, a report with technical details may be sent to our error-tracking service.

What we don't do

  • No ads during a game, and no analytics or tracking of our own that follow you around the web.
  • We don't sell or rent your information, or share it for marketing.

Who can see what

Other players see your display name, avatar, profile stats and the games you've played. Your email address is never shown to other players.

Cookies and local storage

Our own cookie keeps you signed in, and your browser's local storage keeps preferences such as sound and theme. Neither is used for tracking. Ads on the home page are different: Google and its advertising partners may set or read their own cookies in your browser when an ad loads. See Advertising below.

Advertising

The home page may show ads served by Google AdSense. Games themselves never show ads, and the Google ad script isn't loaded unless an ad is about to appear.

  • Cookies. Google, as a third-party vendor, uses cookies (including the DoubleClick advertising cookie) to serve ads based on your visits to this and other websites. Google and its partners may also use device identifiers, your IP address and your browser type to show, measure and limit ads and to prevent fraud. We don't receive this data and can't read Google's cookies.
  • Personalised vs. non-personalised ads. Personalised ads use your past activity. Non-personalised ads are based on the page you're on and your general location instead, and may still use cookies for things like limiting how often you see an ad.
  • Opting out. You can turn off personalised ads in Google's Ad Settings. You can also opt out of many third-party advertising cookies at aboutads.info (or youronlinechoices.eu in Europe), or block or delete cookies in your browser settings. If you opt out, you'll still see ads, just less relevant ones.
  • Consent. Where the law requires it, for example in the European Economic Area, the UK and Switzerland, you'll be asked for consent before personalised ads are shown, and you can change your choice afterwards.
  • More about Google. Read how Google uses information from sites that use its services and Google's privacy policy.

Services we rely on

The game runs on Render (hosting and database) and Cloudflare (domain and DNS). If you use Google or Discord sign-in, their privacy policies cover what happens on their side. Account emails such as password resets are sent through an email delivery provider.

How long we keep it

Account data stays while your account exists. Game records are kept so replays and other players' histories keep working. When you delete your account, your email, password and sign-in links are removed, and your name is replaced with "Deleted player" in past games.

Your choices

  • Change your name, avatar and colour in Settings.
  • Delete your account any time from Settings.
  • Ask us for a copy of your data, or to correct or delete it, by emailing privacy@hexstead.app.

Children

Hexstead isn't meant for children under 13, and we don't knowingly collect information from them. If you think a child has signed up, contact us and we'll remove the account.

Changes

If we change this policy we'll update the date at the top. Big changes will also be announced in the game.

Contact

Questions about privacy: privacy@hexstead.app.