Privacy Notice

1. Who is responsible and what this notice covers

This notice explains how personal data is handled across the two official HexArena surfaces:

• the website at hexarena.io (the “site”), and
• the playable lobby at play.hexarena.io (the “lobby”).

These two surfaces behave differently. The site stores nothing on your device and makes no third-party request while you read it. The lobby is an interactive product with accounts, gameplay, and analytics. This notice describes each one separately.

The data controller for both is:

I operate HexArena as an OSVČ. HexArena is not a separate company. My IČO is 06475990.

For any privacy question or request, email matejstrnad@icloud.com.

2. The site: hexarena.io

The site provides information and a dedicated Privacy choices page. The rules below apply to its information pages, including this notice:

• No third-party service runs in your browser. Fonts, images, icons, and the social preview are served from hexarena.io itself.
• These pages do not use scripts to read or write cookies or local storage. Your browser can send existing HexArena consent cookies with site requests.
• These pages show no consent banner. The separate Privacy choices page manages the consent controls described in §3.11.

Two kinds of processing still happen:

Hosting and access logs

The site is hosted by Vercel Inc. To deliver the pages and keep the service secure, Vercel processes standard request data such as your IP address, the requested URL, the time of the request, and your browser's user-agent string. This is necessary to operate the site and to protect it against abuse.

• Data categories: IP address, request metadata (URL, timestamp, user-agent).
• Legal basis: legitimate interest in delivering and securing the site (Art. 6(1)(f) GDPR).
• Recipient: Vercel Inc. (hosting and content delivery).
• International transfer: Vercel is a US company; transfers rely on the EU Standard Contractual Clauses.
• Retention: short-term server and delivery logs, kept only as long as needed for operation and security.

Storage-free measurement

The site may use Vercel Web Analytics and Vercel Speed Insights. Both run same-origin, set no cookie, and store nothing on your device. They record aggregate page views and performance without a persistent identifier, so they do not identify you.

• Data categories: aggregate, non-identifying page and performance events.
• Legal basis: legitimate interest in understanding site usage and performance (Art. 6(1)(f) GDPR).
• Recipient: Vercel Inc.
• Retention: aggregate metrics retained by the analytics service; no per-visitor record is created.

Community-published maps

Some pages on the site display custom maps that lobby users have chosen to publish, shown together with the author's username. These pages are served from hexarena.io like the rest of the site: they set no cookies, store nothing on your device, and make no third-party request when you view them. How a map comes to be published, and the author's data involved, is described in §3.9.

3. The lobby: play.hexarena.io

The lobby is where you actually play. It uses accounts, sign-in, gameplay data, analytics, cookies, and device storage. The processing below applies to the lobby only.

3.1 Playing as a guest

You can play without an account, as a guest. A guest identity is tied to your browser through a short-lived session credential so you keep the same guest identity across tabs. A guest has no account record, never affects anyone's rating, and never appears on the leaderboard.

• Data categories: a server-assigned guest name and a session credential stored in your browser; gameplay actions during a match.
• Legal basis: legitimate interest in letting you play without registering (Art. 6(1)(f) GDPR).
• Recipient: the game-server host (see §3.12).
• Retention: the guest session credential is accepted for at most 24 hours after it is issued and is backed by no database record.

3.2 Creating an account and signing in

You can sign in with Google, or with your email address and password.

If you sign in with Google, Google provides your account identifier, email address, and basic profile data. HexArena does not receive your Google password. Google and email accounts remain separate, even with the same email address. HexArena does not merge them.

First-Password Enrollment establishes your first email password through a time-limited Mailbox Proof link. Opening the link does not sign you in. You must complete the password form. For an existing email account without a password, enrollment preserves the selected account, its entitlements, and existing sessions. Mailbox Verification records that you controlled the mailbox at that time. It does not establish your real-world identity or permanent mailbox ownership.

Password Recovery requires a fresh Mailbox Proof to replace an existing password. For an email account without a password, recovery leads to First-Password Enrollment. A signed-in password change requires your current password. Either form of Password Replacement invalidates earlier account sessions, but existing game access continues until that game ends. Support cannot bypass Mailbox Proof to recover an account.

HexArena stores a password hash, not your readable password. Zoho's ZeptoMail service (Zoho CPaaS) delivers enrollment and recovery emails. The provider receives your email address, the sender, subject, and message content, including the Mailbox Proof link and its secret. Your password is not sent to the email provider. Email open and click tracking are disabled.

• Data categories: email address, password hash, mailbox-verification time, credential and session revisions, temporary proof records, and issuance-quota records. Google account identifier and basic profile data apply when you use Google.
• Legal basis: performance of the service you request — creating, accessing, and recovering your account (Art. 6(1)(b) GDPR). Abuse prevention serves our legitimate interest in protecting accounts (Art. 6(1)(f) GDPR).
• Recipients: Google LLC for Google sign-in, Zoho for email delivery through ZeptoMail, and the HexArena backend host in §3.12.
• International transfer: Google is a US company; transfers rely on the EU Standard Contractual Clauses. Our email delivery uses Zoho's EU account and endpoint. This does not guarantee exclusively EU processing. Zoho's privacy policy describes international group and service-provider transfers, contractual protections, and an available Data Processing Addendum. We do not claim a completed account-specific transfer assessment.
• HexArena retention: account data remains while your account exists. Enrollment proofs expire after one hour and recovery proofs after thirty minutes. Proof records become eligible for automatic deletion at expiry. Issuance-quota records become eligible one hour after the latest recorded attempt. Database cleanup can occur later. Proof records store secret digests, not readable secrets.
• Provider retention: optional message-content storage is disabled. This does not establish immediate deletion from delivery queues or backups. Zoho documents a default of 60 days for email logs and one year for activity logs. Account-specific extensions, suppression-record retention, and exact backup-deletion times are not confirmed. Provider retention can outlast the proof's validity.

3.3 Your account profile and gameplay

With an account you have a chosen name, a tracked rating, and a record of your finished games.

• Data categories: chosen display name, rating, match participation and results, and in-lobby chat messages you send.
• Legal basis: performance of the service (Art. 6(1)(b) GDPR) for your profile, rating, and match history; legitimate interest in a fair and civil community (Art. 6(1)(f) GDPR) for rating integrity and chat moderation.
• Recipient: the game-server host (see §3.12).
• Retention: kept while your account exists; see §5 on deletion.

3.4 Players Online

The lobby shows a public Players Online list to anyone who visits it.

If you have an account, the list can show your chosen display name and one current activity category:

• In Game means that you are holding a loading reservation or alive in a Multiplayer or Bot-Only Game.
• Online means that you have an active lobby connection, including while you watch a game.

Each account appears in only one category. In Game takes priority over Online.

Tutorials do not put you in In Game. The list does not show Guest names. It shows only the Guest total for each category.

• Data categories: chosen display name and current activity category; aggregate Guest total for each category.
• Purpose: show current community activity and help players see who is playing.
• Legal basis: legitimate interest in supporting an active game community (Art. 6(1)(f) GDPR).
• Recipients: anyone who visits the lobby; the server host named in §3.12.
• Retention: HexArena keeps no separate history of the list. The server holds current categories and Guest totals only while qualifying activity continues. Your chosen display name remains with your account as described in §3.3 and §5.

3.5 Community, rating, and moderation

Ratings adjust after matches, and the lobby has chat and a leaderboard. To keep this fair and civil, HexArena keeps rating records and can mute accounts that break the rules.

• Data categories: rating history, moderation state (such as a mute), and chat content.
• Legal basis: legitimate interest in a fair and civil community (Art. 6(1)(f) GDPR).
• Recipient: the game-server host (see §3.12).
• Retention: kept while your account exists or as needed to enforce the rules.

3.6 Security and abuse prevention

HexArena processes technical data to keep accounts and matches secure — for example to authenticate requests and to detect abuse.

• Data categories: session and authentication tokens, IP address, and request metadata.
• Legal basis: legitimate interest in securing the service and preventing abuse (Art. 6(1)(f) GDPR).
• Recipients: the game-server host (see §3.12); Vercel Inc. (lobby hosting and delivery).
• Retention: short-term, for the period needed to operate and protect the service.

3.7 Analytics in the lobby

The lobby uses Google Analytics 4 to understand how the product is used. GA4 sets cookies and uses device storage (see §4).

• Data categories: usage events, an analytics identifier, IP address, and device and browser information.
• Legal basis: your consent in the EEA, UK, and Switzerland (Art. 6(1)(a) GDPR). Outside those regions, measurement supports the legitimate interest of improving the product where permitted (Art. 6(1)(f) GDPR).
• Recipient: Google LLC (Google Analytics).
• International transfer: Google is a US company; transfers rely on the EU Standard Contractual Clauses.
• Retention: per Google Analytics retention settings for event and user data.

In the EEA, UK, and Switzerland, GA4 loads only after you consent to analytics. Refusal or no choice means no GA4 data is sent. Outside these regions, GA4 can run without a consent prompt after a trusted regional check. Your saved refusal keeps analytics off. Vercel derives the country from the request IP address. Our regional endpoint returns only whether consent is required, not the country or IP address. The lobby and Privacy choices use this check without waiting for advertising scripts. If neither this check nor Google establishes the region, analytics stays off. Where consent is required, an unavailable consent service keeps analytics off.

3.8 Premium Membership

Premium Membership is a time-limited entitlement on your account that unlocks the arena editor. I grant it by hand. No payment is taken, and Stripe is not involved yet.

• Data categories: the expiry time of your Premium Membership, and a source value that records how it was granted.
• Legal basis: performance of the service you request (Art. 6(1)(b) GDPR).
• Recipient: none. This data stays on your HexArena account record.
• International transfer: none.
• Retention: kept with your account record and deleted when your account is deleted (see §5).

3.9 Publishing custom maps

A Premium Membership lets you create maps in the arena editor and, if you choose, publish them so others can find them. Publishing is optional. When you publish a map, it appears publicly on hexarena.io alongside your username; no other account detail is shown. You can unpublish a map, and published maps are removed when your account is deleted (see §5).

• Data categories: your username, shown publicly with each map you publish, and the map content you create.
• Legal basis: performance of the service you request — publishing a map you chose to make public (Art. 6(1)(b) GDPR).
• Recipient: served from hexarena.io; visible to anyone who views the site.
• Retention: until you unpublish the map or delete your account.

3.10 Advertising (Google AdSense)

The desktop lobby can show one Google AdSense advertisement on Home when you are not signed in. All signed-in Users remain ad-free. Ads are non-personalized. Every request uses Google's child age treatment and restricted data processing. HexArena asks no age question and collects no Age Band. These restrictions do not replace consent.

Google can use cookies, device storage, and network data to deliver, limit, and measure ads. In the EEA, UK, and Switzerland, ads require affirmative advertising consent. Elsewhere, ads require known regional privacy signals. Regional opt-outs and Global Privacy Control keep ads off. You can turn advertising off through Privacy choices and continue to play.

• Data categories: an advertising or cookie identifier, IP address, device and browser information, and ad interaction events.
• Legal basis: your consent where required, including the EEA, UK, and Switzerland (Art. 6(1)(a) GDPR). Elsewhere, our legitimate interest in funding free Guest play through restricted, non-personalized ads (Art. 6(1)(f) GDPR, where applicable), subject to local consent and opt-out requirements.
• Recipient: Google LLC (Google AdSense).
• International transfer: Google is a US company; transfers rely on the EU Standard Contractual Clauses.
• Retention: per Google's advertising cookie and data-retention policies.

3.11 Consent choices and records

HexArena uses Google's certified consent management platform from AdSense Privacy & messaging. When the European message is active, visitors in the EEA, UK, and Switzerland can choose Consent, Do not consent, or Manage options. Consent renews after 12 months. HexArena shows no custom consent prompt and asks no age question. The lobby and Privacy choices page use the AdSense script to deliver the Google consent service. The settings page never requests an ad.

Privacy choices links open hexarena.io/privacy-choices. The lobby Home page has no footer. Other lobby pages retain these links. The settings page shows your available preference and preserves your saved Google consent on entry. This Privacy Notice never loads the Google consent service, analytics, or advertising code. Other information pages also remain free of Google runtime. Google can require a separate choice on each hostname.

In the EEA, UK, and Switzerland, Change consent clears your previous Google choice and opens the Google message. Analytics and advertising stay off until a new qualifying choice. HexArena saves refusal separately from analytics cookies and deletes controllable GA4 cookies. Open lobby tabs apply the change. Active analytics documents reload to stop their background code. A suspended tab checks the preference when it resumes. The game remains available regardless of your choice or a consent-service failure.

Outside these regions, the settings page provides separate controls for analytics and advertising when the required signals are available. Opening Privacy choices does not change your preference. Advertising cannot restart while a regional opt-out or Global Privacy Control applies. No consent popup is required for these app controls. Google can show regional privacy notices in the lobby.

HexArena stores separate, minimal Consent Receipts for affirmative analytics consent, advertising consent, and later withdrawal. Regional permission without consent does not create a consent receipt. Each receipt contains only a random receipt identifier, the event type, timestamp, hostname, granted purposes, and Google message or configuration version. It contains no IP address, User or Guest identity, account identifier, or full user-agent string. The receipt service does not receive your account credentials. Hosting providers still process network data needed to deliver requests, as described in §3.6 and §3.12.

• Legal basis: compliance with the duty to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR); legal claims where applicable (Art. 6(1)(f) GDPR).
• Recipient: the HexArena backend host described in §3.12.
• Retention: while consent-based processing continues, then for 3 years and 1 month. A complaint, inspection, corrective proceeding, or legal claim pauses deletion until final closure.

3.12 Where lobby data is stored

Account, gameplay, rating, moderation data, and Consent Receipts are stored in a database on a server operated for HexArena at Hetzner Online GmbH's data center in Ashburn, Virginia, USA. Zoho processes enrollment and recovery emails through our EU account and endpoint, subject to the processing, transfer, and retention limits in §3.2. Game servers run at Hetzner locations in Ashburn, Virginia, USA; Falkenstein, Germany; and Singapore. Your browser sends a latency probe to each available region once per lobby visit. These requests expose your IP address and ordinary connection metadata to the regional hosts. Multiplayer uses your selected region. Solo Arena and Tutorial use the region with the lowest measured latency. The selected game server processes your participation and gameplay data and sends game reports to the US backend. Regional game servers do not host separate account databases. If a paid subscription is introduced, Stripe, Inc. processes billing data in the United States. Because this hosting and processing is in the United States, transfers from the EU/EEA for those US services rely on the EU Standard Contractual Clauses. The EU email endpoint does not change the US location of the HexArena backend database.

4. Cookies and device storage

The Privacy choices page and the lobby use the shared consent storage below. Other information pages run no storage code. Your browser can send shared consent cookies with requests to HexArena hostnames.

The lobby (play.hexarena.io) uses the following:

The Stripe cookies are not set today. They can apply if you use future subscription checkout.

AdSense storage depends on advertising permission. Consent storage remembers your choices, including refusal, independently of ad delivery.

The lobby also serves Google-hosted fonts on some pages; removing that dependency is planned. This notice will be updated to match.

5. Your rights

Under the GDPR you have the right to:

• access the personal data held about you,
• correct inaccurate data,
• erase your data (“right to be forgotten”),
• restrict or object to certain processing,
• data portability, and
• withdraw consent at any time, where processing is based on consent.

Withdrawal through Privacy choices stops future analytics and advertising processing. It does not erase historical data or affect the lawfulness of earlier processing. For historical data erasure, send a separate request to matejstrnad@icloud.com. Clearing analytics cookies alone does not withdraw a saved consent choice.

To exercise any right, email matejstrnad@icloud.com. As a solo operator I handle these requests myself and will respond within the time the GDPR requires.

6. Complaints

If you believe your data has been handled unlawfully, you can complain to the Czech supervisory authority:

You may also complain to the supervisory authority in your own country of residence.

7. Changes to this notice

This notice is kept in step with the systems in use and is updated before new processing begins. Advertising through Google AdSense, a paid subscription with payments through Stripe, and a consent mechanism for the lobby are being introduced; this notice has been updated ahead of those changes so the disclosure is in place before the processing starts. The effective date above changes whenever the notice is materially updated.