Privacy Policy for Hexakai

Effective date: October 4, 2026

This Privacy Policy explains how Hexakai handles information across the website at hexakai.com, the Android and iOS apps, and Hexakai Plus. Hexakai is operated by Brandon Quinn ("we," "us," or "Hexakai"). Our Terms and Conditions govern your use of the service.

You can play Hexakai without an account. Creating an account and subscribing to Hexakai Plus are both optional, and each one adds to the information described below.

1. Information We Collect

1.1 Information stored on your device

• Local storage: We store your game progress, puzzle history, achievements, and interface settings directly on your device. This lets you resume a game and keeps your settings between sessions. If you never create an account, this data stays on your device and is not sent to us.

1.2 Account information

If you create a Hexakai account, we store:

• Your email address, used to identify your account, send password resets, and send a welcome message.
• Your first and last name, if you provide them or if they are supplied by a sign-in provider you choose to use.
• A password hash. If you sign in with an email and password, we store a one-way hash of that password. We never store your password itself and cannot recover it.
• A pseudonymous account identifier derived from your email address. This identifier, not your email address, is what we attach to your synced game data and to your Hexakai Plus entitlement, and it is what we share with our subscription provider.
• Session records, so you stay signed in, and failed sign-in attempts for a limited period so we can rate-limit password guessing.

1.3 Game data synced to your account

When you are signed in, we sync a limited set of game data to our servers so it follows you between devices:

• Achievements, game settings, gameplay metrics, and your selected theme.
• Saved boards, if you use the Hexakai Plus save-and-load feature. A saved board includes the puzzle state, its name, its size and difficulty, and a small preview image of the board.

This data is about gameplay. It is stored against your pseudonymous account identifier.

1.4 Hexakai Plus purchase information

If you subscribe to Hexakai Plus, we store a record of your entitlement so we know whether to unlock Plus features. That record contains:

• Your pseudonymous account identifier.
• Whether the subscription is currently active and when it expires.
• The product you purchased and which store processed it (App Store, Google Play, or web billing).

Purchases in the Android and iOS apps. When you buy Hexakai Plus in the app, the store purchase is first recorded by RevenueCat under a random identifier generated on your device. It is not your name, email address, or store account. If you were signed in at checkout, we link that identifier to that Hexakai account, so the purchase unlocks Plus on that account. If you bought without an account, the purchase stays on your device until you sign in on that same device and choose to link it. We store that link: the random identifier and your pseudonymous account identifier. To make sure a link can come only from the device that bought, the app also creates a random code on your device and sends us a one-way hash of it with the random identifier. The code itself is sent only when you link the purchase from that device, so we can check it against the hash. Each store purchase can be linked to only one Hexakai account, and signing in to a different account on the same device later does not move it.

Plus on this device. The app also keeps a record, on your device only, of whether this device's App Store or Google Play account has an active Hexakai Plus purchase. That lets Plus work on that device even when a different Hexakai account, or no account, is signed in. Using Restore Purchases checks the store for an existing purchase and updates that on-device record. It does not link the purchase to the Hexakai account that is signed in.

We never receive or store your payment card details, billing address, or store account credentials. Payment is handled entirely by Apple, Google, or our web payment processor. See section 4 for who is involved in a purchase.

1.5 Analytics

• Google Analytics: We use Google Analytics to understand how visitors interact with Hexakai, including how often users visit, which pages they view, and which site they came from. Google Analytics records the IP address assigned to you on the day of your visit rather than your name. We do not combine Google Analytics data with information that identifies you personally.
• Firebase Analytics: In the Android and iOS apps, Google's Firebase Analytics records app usage in the same way, using an app instance identifier and, on Android, the device's advertising identifier. The iOS app does not use Apple's advertising identifier.
• Hexakai Plus events: We send Google Analytics and Firebase Analytics a record when you see a Hexakai Plus offer, open the Plus page, start a checkout, or subscribe, together with whether you currently have Plus. These records say where in Hexakai the action happened; they do not include your name, email address, or account identifier. RevenueCat also reports app store purchases and renewals to Firebase Analytics for the same app instance.
• Gameplay events: We record aggregate, non-identifying events about how puzzles are played so we can tune difficulty and find broken features.

1.6 Advertising

• The free version of Hexakai may display advertisements. Ad providers may use cookies or similar technologies to select ads and measure their effectiveness.
• An active Hexakai Plus subscription removes ads.
• Advertising Hexakai: We use the Hexakai Plus events described in section 1.5 to show ads for Hexakai and Hexakai Plus on Google's ad network, for example to people who looked at Plus but have not subscribed, and to measure which of those ads lead to subscriptions. Google receives these events through Google Analytics and Firebase Analytics, not from our servers.

1.7 Technical and security logs

• Our servers log requests, response times, error reports, and the IP address the request came from. We use these to keep the service working, diagnose faults, and detect abuse.
• For some account actions, such as linking a store purchase to your account, we briefly record when each request was made against your pseudonymous account identifier so we can limit how often it is repeated.
• If you use the contact form, we receive the message and any contact details you include in it.

2. How We Use Information

• To run the game and save your progress.
• To create and secure your account, keep you signed in, and let you reset your password.
• To sync your game data between your devices.
• To determine whether your account has an active Hexakai Plus subscription and unlock the corresponding features, including linking a purchase made in the app to the account that made it.
• To display and measure advertising in the free version.
• To advertise Hexakai and Hexakai Plus on Google's ad network and measure those ads.
• To understand how Hexakai is used and improve it.
• To keep the service secure, including rate-limiting sign-in attempts and purchase linking, and investigating abuse.
• To respond to you when you contact us.

We do not sell your personal information.

3. Cookies and Similar Technologies

We use a session cookie to keep you signed in. Google Analytics and our ad providers may set their own cookies or use similar identifiers as described above. Local storage on your device is used for game state and settings and is not shared with anyone.

4. Hexakai Plus, Payments, and Third Parties

Hexakai Plus subscriptions are managed through RevenueCat, which sits between Hexakai and the app stores. Checkout itself happens through the App Store on iOS, through Google Play on Android, and through RevenueCat's web paywall, processed by Stripe, on the website.

4.1 What is shared with RevenueCat

To check and record your entitlement, we send RevenueCat your pseudonymous account identifier. We do not send RevenueCat your email address, your name, or your gameplay data. RevenueCat returns whether the subscription is active, when it expires, which product it is, and which store processed it. RevenueCat also notifies our servers when your subscription renews, lapses, or is refunded.

In the Android and iOS apps, RevenueCat's software runs on your device to process purchases and restores with the App Store or Google Play, using the random device identifier described in section 1.4. When we link a purchase to your account, we look up that identifier with RevenueCat to confirm the purchase is real and active.

4.2 What the stores receive

Apple, Google, and Stripe handle the purchase itself and hold your payment details under their own privacy policies. We receive confirmation that a purchase occurred, not the payment instrument used.

4.3 Other service providers

• Google Analytics and Firebase Analytics — usage analytics and Hexakai Plus events, described in section 1.5.
• Google Ads — advertising Hexakai using those events, described in section 1.6.
• Advertising providers — ad selection and measurement in the free version.
• Our email provider — delivery of welcome and password-reset messages.
• Our hosting provider — operation of the website, API, and databases.

We share information with these providers only so they can perform these functions for us, and we otherwise disclose personal information only where required by law.

5. Data Storage and Security

Personal information is stored on our hosting provider's servers and accessed only by authorized personnel. Passwords are stored only as one-way hashes. We use industry-standard measures to protect the information we hold. No method of transmission over the Internet, and no method of electronic storage, is completely secure, so we cannot guarantee absolute security.

6. Data Retention and Deleting Your Data

We keep account information for as long as your account exists. Security logs and failed sign-in records are kept only as long as needed for the purpose described above. Request-limit records are removed after about 15 minutes.

You can delete your Hexakai account from the account page, or by asking us through the contact form. Deleting your account removes your account record, your stored password, your sessions, your synced game data, your saved boards, your Hexakai Plus entitlement record, and any link between a store purchase and your account from our servers. Plus remains available on a device whose store account holds an active purchase, as described in section 1.4.

Deleting your Hexakai account does not cancel a subscription. An App Store, Google Play, or web billing subscription must be canceled separately through that store, as described in our Terms and Conditions, or you may continue to be charged. Records that the store or RevenueCat keeps about a purchase are governed by their policies, and we may retain transaction records where we are required to.

Game data held only in your device's local storage is removed when you clear your browser storage or uninstall the app.

7. Your Choices

• You can play Hexakai without creating an account.
• You can delete your account and its associated data at any time, as described in section 6.
• You can request a copy of the personal information we hold about you, or ask us to correct it, by using the contact form.
• You can opt out of Google Analytics using Google's browser add-on, and you can manage advertising identifiers in your device or browser settings.
• You can turn off personalized ads from Google, including ads for Hexakai based on the events in section 1.5, at My Ad Center.

8. Children's Privacy

Hexakai is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

9. International Users

Hexakai is operated from the United States, and information we collect is processed there. Our service providers may process information in other countries. By using Hexakai, you understand that your information will be handled as described in this policy.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the new version on this page with a revised effective date. You are advised to review this Privacy Policy periodically for any changes.

11. Contact

If you have questions about this Privacy Policy or about the information we hold, reach us through the contact form.