Privacy Notice

1. Who is responsible and what this notice covers

This notice explains how personal data is handled across the two official HexArena surfaces:

• the website at hexarena.io (the “site”), and
• the playable lobby at play.hexarena.io (the “lobby”).

These two surfaces behave differently. The site stores nothing on your device and makes no third-party request while you read it. The lobby is an interactive product with accounts, gameplay, and analytics. This notice describes each one separately.

The data controller for both is:

I operate HexArena as an OSVČ. HexArena is not a separate company. My IČO is 06475990.

For any privacy question or request, email matejstrnad@icloud.com.

2. The site: hexarena.io

The site is a static, information-only surface. When you visit it:

• No third-party service runs in your browser. Fonts, images, icons, and the social preview are served from hexarena.io itself.
• Nothing is stored on your device and nothing is read from it. There are no cookies and no local storage.
• Because of this, the site shows no cookie banner. There is nothing to consent to.

Two kinds of processing still happen:

Hosting and access logs

The site is hosted by Vercel Inc. To deliver the pages and keep the service secure, Vercel processes standard request data such as your IP address, the requested URL, the time of the request, and your browser's user-agent string. This is necessary to operate the site and to protect it against abuse.

• Data categories: IP address, request metadata (URL, timestamp, user-agent).
• Legal basis: legitimate interest in delivering and securing the site (Art. 6(1)(f) GDPR).
• Recipient: Vercel Inc. (hosting and content delivery).
• International transfer: Vercel is a US company; transfers rely on the EU Standard Contractual Clauses.
• Retention: short-term server and delivery logs, kept only as long as needed for operation and security.

Storage-free measurement

The site may use Vercel Web Analytics and Vercel Speed Insights. Both run same-origin, set no cookie, and store nothing on your device. They record aggregate page views and performance without a persistent identifier, so they do not identify you.

• Data categories: aggregate, non-identifying page and performance events.
• Legal basis: legitimate interest in understanding site usage and performance (Art. 6(1)(f) GDPR).
• Recipient: Vercel Inc.
• Retention: aggregate metrics retained by the analytics service; no per-visitor record is created.

Community-published maps

Some pages on the site display custom maps that lobby users have chosen to publish, shown together with the author's username. These pages are served from hexarena.io like the rest of the site: they set no cookies, store nothing on your device, and make no third-party request when you view them. How a map comes to be published, and the author's data involved, is described in §3.9.

3. The lobby: play.hexarena.io

The lobby is where you actually play. It uses accounts, sign-in, gameplay data, analytics, cookies, and device storage. The processing below applies to the lobby only.

3.1 Playing as a guest

You can play without an account, as a guest. A guest identity is tied to your browser through a short-lived session credential so you keep the same guest identity across tabs. A guest has no account record, never affects anyone's rating, and never appears on the leaderboard.

• Data categories: a server-assigned guest name and a session credential stored in your browser; gameplay actions during a match.
• Legal basis: legitimate interest in letting you play without registering (Art. 6(1)(f) GDPR).
• Recipient: the game-server host (see §3.12).
• Retention: the guest session credential is accepted for at most 24 hours after it is issued and is backed by no database record.

3.2 Creating an account and signing in

You can sign in with Google, or with a code sent to your email address.

If you sign in with Google, Google confirms your identity to HexArena and provides basic profile data associated with your Google account, such as your account identifier and email address. HexArena does not receive your Google password.

If you sign in by email, HexArena sends a one-time sign-in code or link to the address you enter, using Amazon Simple Email Service (Amazon SES).

• Data categories: email address; Google account identifier and basic profile data (when you use Google); the sign-in code.
• Legal basis: performance of the service you request — creating and accessing your account (Art. 6(1)(b) GDPR).
• Recipients: Google LLC (identity verification, when you choose Google); Amazon Web Services, Inc. (email delivery via Amazon SES).
• International transfer: Google and AWS are US companies; transfers rely on the EU Standard Contractual Clauses.
• Retention: your account data is kept while your account exists; sign-in codes are short-lived and expire quickly.

3.3 Your account profile and gameplay

With an account you have a chosen name, a tracked rating, and a record of your finished games.

• Data categories: chosen display name, rating, match participation and results, and in-lobby chat messages you send.
• Legal basis: performance of the service (Art. 6(1)(b) GDPR) for your profile, rating, and match history; legitimate interest in a fair and civil community (Art. 6(1)(f) GDPR) for rating integrity and chat moderation.
• Recipient: the game-server host (see §3.12).
• Retention: kept while your account exists; see §5 on deletion.

3.4 Players Online

The lobby shows a public Players Online list to anyone who visits it.

If you have an account, the list can show your chosen display name and one current activity category:

• In Game means that you are joining or alive in a matchmaking or Bot-Only Game.
• In Queue means that you hold a place in the matchmaking queue.
• Online means that you have an active lobby connection, including while you watch a game.

Each account appears in only one category. In Game takes priority over In Queue, which takes priority over Online.

Tutorials do not put you in In Game. The list does not show Guest names. It shows only the Guest total for each category.

• Data categories: chosen display name and current activity category; aggregate Guest total for each category.
• Purpose: show current community activity and help players decide when to join the matchmaking queue.
• Legal basis: legitimate interest in supporting an active game community (Art. 6(1)(f) GDPR).
• Recipients: anyone who visits the lobby; the server host named in §3.12.
• Retention: HexArena keeps no separate history of the list. The server holds current categories and Guest totals only while qualifying activity continues. Your chosen display name remains with your account as described in §3.3 and §5.

3.5 Community, rating, and moderation

Ratings adjust after matches, and the lobby has chat and a leaderboard. To keep this fair and civil, HexArena keeps rating records and can mute accounts that break the rules.

• Data categories: rating history, moderation state (such as a mute), and chat content.
• Legal basis: legitimate interest in a fair and civil community (Art. 6(1)(f) GDPR).
• Recipient: the game-server host (see §3.12).
• Retention: kept while your account exists or as needed to enforce the rules.

3.6 Security and abuse prevention

HexArena processes technical data to keep accounts and matches secure — for example to authenticate requests and to detect abuse.

• Data categories: session and authentication tokens, IP address, and request metadata.
• Legal basis: legitimate interest in securing the service and preventing abuse (Art. 6(1)(f) GDPR).
• Recipients: the game-server host (see §3.12); Vercel Inc. (lobby hosting and delivery).
• Retention: short-term, for the period needed to operate and protect the service.

3.7 Analytics in the lobby

The lobby uses Google Analytics 4 to understand how the product is used. GA4 sets cookies and uses device storage (see §4).

• Data categories: usage events, an analytics identifier, IP address, and device and browser information.
• Legal basis: your consent where required for analytics cookies and similar technologies; underlying processing supports the legitimate interest of improving the product (Art. 6(1)(a) and 6(1)(f) GDPR).
• Recipient: Google LLC (Google Analytics).
• International transfer: Google is a US company; transfers rely on the EU Standard Contractual Clauses.
• Retention: per Google Analytics retention settings for event and user data.

Note: today the lobby loads Google Analytics without a separate consent step. A consent mechanism covering analytics and advertising cookies is being introduced (see §3.11); until it is live, this note describes the lobby as it is today.

3.8 Premium Membership

Premium Membership is a time-limited entitlement on your account that unlocks the arena editor. I grant it by hand. No payment is taken, and Stripe is not involved yet.

• Data categories: the expiry time of your Premium Membership, and a source value that records how it was granted.
• Legal basis: performance of the service you request (Art. 6(1)(b) GDPR).
• Recipient: none. This data stays on your HexArena account record.
• International transfer: none.
• Retention: kept with your account record and deleted when your account is deleted (see §5).

3.9 Publishing custom maps

A Premium Membership lets you create maps in the arena editor and, if you choose, publish them so others can find them. Publishing is optional. When you publish a map, it appears publicly on hexarena.io alongside your username; no other account detail is shown. You can unpublish a map, and published maps are removed when your account is deleted (see §5).

• Data categories: your username, shown publicly with each map you publish, and the map content you create.
• Legal basis: performance of the service you request — publishing a map you chose to make public (Art. 6(1)(b) GDPR).
• Recipient: served from hexarena.io; visible to anyone who views the site.
• Retention: until you unpublish the map or delete your account.

3.10 Advertising (Google AdSense)

HexArena is introducing advertising in the lobby, served by Google AdSense. No ads are shown today; this notice is being published ahead of that change. When advertising goes live, Google may set cookies and read device storage to select, cap, and measure ads, and whether ads are personalized will depend on your consent (see §3.11).

• Data categories: an advertising or cookie identifier, IP address, device and browser information, and ad interaction events.
• Legal basis: your consent for advertising cookies and ad personalization (Art. 6(1)(a) GDPR); HexArena's legitimate interest in funding a free-to-play game (Art. 6(1)(f) GDPR) for non-personalized ad delivery where that is permitted without consent.
• Recipient: Google LLC (Google AdSense).
• International transfer: Google is a US company; transfers rely on the EU Standard Contractual Clauses.
• Retention: per Google's advertising cookie and data-retention policies.

3.11 Consent for analytics and advertising

A consent mechanism — a Google-certified consent management platform — is being introduced to govern analytics and advertising cookies in the lobby. When it is live, you will be able to accept or decline these cookies and change your choice at any time; declining stops the associated processing going forward. This mechanism is not yet in place, which is why §3.7 notes that analytics currently loads without a separate consent step.

3.12 Where lobby data is stored

Account, gameplay, rating, and moderation data are stored in a database on a server operated for HexArena at Hetzner Online GmbH's data center in Ashburn, Virginia, USA. Amazon SES processing for sign-in email occurs in Amazon Web Services' US East (us-east-1) region. If a paid subscription is introduced, Stripe, Inc. processes billing data in the United States. Because this hosting and processing is in the United States, data transferred from the EU/EEA relies on the EU Standard Contractual Clauses, as described in §3.2.

4. Cookies and device storage

The site (hexarena.io) uses no cookies and no device storage.

The lobby (play.hexarena.io) uses the following:

The Stripe cookies are not set today. They can apply if you use future subscription checkout.

The AdSense and consent rows describe cookies that are not set today.

The lobby also serves Google-hosted fonts on some pages; removing that dependency is planned. This notice will be updated to match.

5. Your rights

Under the GDPR you have the right to:

• access the personal data held about you,
• correct inaccurate data,
• erase your data (“right to be forgotten”),
• restrict or object to certain processing,
• data portability, and
• withdraw consent at any time, where processing is based on consent.

Withdrawing analytics consent, or clearing the relevant cookies and storage in your browser, stops the associated processing going forward. It does not affect processing that already happened.

To exercise any right, email matejstrnad@icloud.com. As a solo operator I handle these requests myself and will respond within the time the GDPR requires.

6. Complaints

If you believe your data has been handled unlawfully, you can complain to the Czech supervisory authority:

You may also complain to the supervisory authority in your own country of residence.

7. Changes to this notice

This notice is kept in step with the systems in use and is updated before new processing begins. Advertising through Google AdSense, a paid subscription with payments through Stripe, and a consent mechanism for the lobby are being introduced; this notice has been updated ahead of those changes so the disclosure is in place before the processing starts. The effective date above changes whenever the notice is materially updated.