Privacy policy

HΞXHQ (hexhq.blog) is a non-profit fan site run by HEX. For any privacy matter or to exercise your rights, email privacy@hexhq.blog. We reply within 30 days at most.

Only what the site needs to work. We don't sell data, and today there are no ads and no trackers. Members never see ads. If we ever show ads to visitors who aren't signed in, we'll update this policy first and ask for consent where the law requires it.

Your privacy first. HΞXHQ is free and open to read: rankings, State Ruler, guides, tools, news and the blog are available to everyone. What the community builds is different: comments, profiles, avatars, predictions, contributions and each member's activity are only visible to other signed in members. That is how we look after the people who take part: people without an account can't see what members post. Game data is different: rankings, server profiles and stats show players' in-game names, alliances and stats as the game shows them (never their profile pictures), and anyone can see them. Without an account you can see how many comments and reactions each post has and a sample of HΞX TV. Creating an account is free and opens everything else.

• Your account: your email address, to send you the sign-in link, and the date and version of this privacy policy you confirmed you read (kept as proof, it is never changed). Legal basis: the service you ask us for (performance of a contract); the record of your confirmation, our legal obligation to show it.
• Discord account (optional): if you sign in with Discord or link it, Discord sends us your email, your Discord ID, your username, your Discord display name and the address of your avatar. Our sign in provider (Supabase) keeps them with your account while Discord is linked. We use the email to open the account that already has it (or as your account email if you create the account with Discord) and the Discord ID to recognize you in the HΞXHQ Discord server. We never show your Discord ID or email to anyone. Your username shows on your player card (to members only) only if you share it in Discord options, and we copy your avatar (stored by us, so nobody's browser loads it from Discord) only if you turn it on there; saving Discord options again refreshes both. Your display name stays the one you choose here. Legal basis: the service you ask us for.
• Private rooms (optional): to check whether you can have a room, our Discord bot reads whether you are in the HΞXHQ Discord server and since when you boost it, and we work out the age of your Discord account from its ID (it must be 30 days or more). We store your room time (VIP days, boost days, when your current boost started and when your time ends), the boost periods already used for a room, the rooms you own or joined with your role and date, and room transfers, removals and invitations (who invited whom, to which room, and the answer). Members who own or moderate a room can find you by your display name to invite you, unless you turn off Receive room invitations in Preferences; when they invite you and you linked Discord, our bot sends you a direct message about it. To run the rooms, our bot tells Discord which Discord accounts can see each room and with what role, and the room's name. Members of a room see your display name and role in its list here, and your Discord profile inside the room, so they can tell both are yours. The bot never reads messages in the rooms. Legal basis: the service you ask us for; keeping your Discord ID in rooms and used boosts after you unlink, our legitimate interest in preventing abuse (one room per Discord account). For the HΞXHQ Discord server's statistics, our bot checks general server data, such as how many members there are, their roles and when they joined, without reading messages, and we keep only totals.
• Your profile: display name, avatar, bio, optional contact and your preferences (theme, what you share, notices). You decide which parts other members see from My profile; nothing in your profile is visible to people without an account. Legal basis: the service you ask us for; the contact, only if you turn it on (consent).
• Your avatar photo: if you upload one, we store the image (cropped to a square, converted to WebP and without metadata), its review status and dates, and, when the photo is rejected, the reason. Before other members see it, a model that runs on our own computers checks it first (the image is not sent to any other company): it approves only photos that are clearly safe, a person reviews the rest, and only a person can reject a photo. Only you see a photo in review. Legal basis: the service you ask us for (performance of a contract) and legitimate interest (keeping the site safe).
• Your name history: the display names you used before, with the date you stopped using each one. The random name assigned when you created the account is only kept if you commented with it. Only you (in your data download) and the HΞXHQ team, to moderate impersonation, can see it.
• What you post: comments, likes, State Ruler predictions and videos you submit to HΞX TV. Other people's predictions only show once each matchup closes, and the leaderboard shows your name according to what you share. Legal basis: the service you ask us for.
• On-site notices: when another member likes or replies to one of your comments, we store who did it, which comment and when, to show you a notice while you browse. Only you can see your notices; the name of the other member only shows if they share it. You can turn them off in My profile → Preferences. Legal basis: the service you ask us for.
• Points and levels: your VIP level and Intel Points, calculated from your approved videos and contributions, from your State Ruler predictions and from the tasks in My profile, Points (we store which task you did and on which day) (the VIP points of each round are stored with your account), to show your levels and unlock cosmetic rewards. Donations don't add points. Legal basis: the service you ask us for.
• Without an account: if you like something or report a video, a cookie with a random identifier (see Cookies). Post views are counted without cookies, using a code that changes every day and can't identify you; your IP address isn't stored. Legal basis: legitimate interest (avoiding duplicate counts and reports).
• Reports (of comments, users or videos): the reason, the text you write and, without an account, a hashed version of your identifier. Legal basis: legitimate interest (moderating the site).
• Analytics: Vercel Web Analytics measures visits in aggregate, without cookies and without identifying you. Legal basis: legitimate interest (knowing which parts of the site get used).
• Feedback: the message you send from Feedback, the page and contact you enter, up to 3 screenshots, your browser, your account and the hashed visitor ID, to read it, fix what you report and prevent spam. Screenshots are converted to WebP and any hidden metadata (such as the location of phone photos) is removed before they are stored. If we need more details, we ask in that report's thread on the site (My reports, in Feedback), never by email; your replies and their screenshots are stored with the report. Legal basis: our legitimate interest in improving the site.
• Contributions: the screenshots you upload from Community → Contribute, the activity type, server group, date, note and in-game name you enter, and your account, to review them and turn approved ones into data on the site. Screenshots are converted to WebP and any hidden metadata is removed before they are stored. We never publish your in-game name without asking you. If you delete your account, your contributions stay without being linked to it. Legal basis: the service you ask us for.
• Player cards: when you upload a player card, the Profile and Details screenshots, the values read from them and the ones you confirmed, the server and your account. Screenshots are converted to WebP without metadata and kept in private storage that only HΞXHQ can access; we use them to check the values against our own game captures. Other signed in members see the values with the upload date unless you turn off the switch when uploading or later in My profile (then only you see them). Visitors without an account never see them. Community cards are not official data and never feed the site's rankings or stats. Legal basis: the service you ask us for.
• Creator channel: the YouTube channel you register, its verification code and status, to verify that it is yours (we read your channel's public description and videos with the YouTube API) and show your videos. Legal basis: the service you ask us for.
• Players HUB: the reactions you give and the players you mark as favorites, linked to your account. Your favorites list is private: nobody else can see it. Your contributions appear in the HUB only while you share your activity.
• Tech Research: with an account, your progress in each research tree (the level of each node) is saved with your account so you see it on any device. Only you can see it. Without an account it stays in your browser. Legal basis: the service you ask us for (performance of a contract).
• Player card: what your card shows (likes received, verified badge, accolades, your contributions and your comments) comes from what you already do on the site. Accolades you earn are stored with the date. You can hide accolades, comments and activity in My profile; contact stays hidden unless you turn it on. Legal basis: the service you ask us for.
• Shares: when you tap Share on a ranking or post while signed in, we record that your account shared it and on which day, to know which content the community spreads. Only the site's admin sees it. Without an account we only add one to the count, with no identifier. Legal basis: our legitimate interest in knowing what gets shared.
• Moderation: if your account is sanctioned we keep the type of sanction, its reason and dates, who applied it, and your appeal with our answer, to enforce the rules and review appeals. Legal basis: legitimate interest (keeping the site safe).

Rankings, server profiles and State Ruler show information any player can see inside the game: player names, alliance, server, power and kills. We don't show players' in-game profile pictures: that picture is between each player and the game's developer. We take it from screenshots of the game itself; it doesn't come from any private database.

We publish it on the basis of legitimate interest: informing the game's community. If you're one of those players and don't want to appear, email privacy@hexhq.blog with your in-game name and server, and we'll hide you. We remove you from rankings, server profiles and State Ruler. If you change your in-game name, ask again with the new name.

Only with the providers that run the site, which process data on our behalf:

Email providers on Privacy tips: if you open one, you go to their site and their own policy applies. We don't send them any of your data; through an affiliate link they only learn that the visit came from HΞXHQ.

• Supabase: database and sign-in (servers in the United States).
• Vercel: site hosting and cookie-free analytics.
• Cloudflare R2: image storage, such as avatars.
• Cloudflare Turnstile: anti-bot check on sign-in and on the sign-in help form.
• Resend: sending the sign-in email, and telling us whether it bounced or could not be sent, so the sign in page can warn you about a mistyped address. We keep only that result, never the address itself, for one day.
• Buy Me a Coffee: donations. They handle the payment; we receive the email, the amount and currency, the date, the payment id, the event type and the message, to keep a record of donations and handle refunds. Donations don't unlock anything on the site.
• Discord: only if you sign in with it or link it. Discord sends us the data described above; for private rooms our bot reads whether you are in the HΞXHQ server and boosting it, and tells Discord who can see each room. Inside the HΞXHQ Discord server, Discord's own policy applies.
• YouTube and Twitch: only if you tap a video to play it; from then on their own policy applies. Thumbnails are served by this site, without contacting YouTube.
• Artificial intelligence: we don't send your data to external artificial intelligence services. The avatar photos you upload are first checked by an AI model that runs on our own computers: it approves only the ones that are clearly safe, a person reviews the rest, and only a person can reject a photo.

Some of these providers process data in the United States. They do so under the safeguards the GDPR requires: the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission, depending on the provider.

• Your account and what you posted: for as long as you have the account. Deleting it removes your profile, comments, predictions, points and activity right away. Feedback and contributions you sent stay without being linked to your account; you can ask us to delete them.
• On-site notices: up to 30 days after you see them; unseen ones, until you see them or delete the account (deleting a comment also deletes its notices).
• Name history: for as long as you have the account. Deleting the account deletes it.
• Discord: while it is linked. When you unlink it, within a day at most we delete your username, the avatar copy and the Discord data our sign in provider kept, take your Discord ID out of your room time and remove you from the rooms you joined. Your Discord ID stays only in rooms you own and in boosts already used for a room; archived rooms are kept so they can come back, so it stays until you delete your account or ask us at privacy@hexhq.blog. Room time and room history: for as long as you have the account.
• Avatar photo: until you delete it or upload a new one that gets approved. A rejected photo is deleted right away; a photo uploaded before a membership ended, 30 days after it ended. Deleting the account deletes them.
• Support payments: for as long as you have the account. Payments not linked to an account, until someone claims them with that email or you ask us to delete them.
• Resolved reports: 180 days.
• Feedback and its screenshots: while they help us fix what you reported. You can ask us to delete them at any time. If you delete your account, your feedback stays without being linked to it.
• Contributions and their screenshots: for as long as the data they produced is shown on the site. You can ask us to delete them at any time.
• Player cards and their screenshots: while you have the account. Removing a card hides it from everyone, you included; we keep it and its screenshots to check data quality, and you can ask us to delete them. Deleting your account deletes your cards and their screenshots.
• Shares: for as long as you have the account. Deleting it deletes them.
• Visitor cookie: 1 year from your last like, report or feedback.
• View and like counts: kept anonymously to show the totals.
• Banned accounts: deleted 15 days after the ban or after the appeal is rejected (they can download their data first). Other sanctions and appeals: for as long as you have the account.

You can ask to access your data, correct it, delete it, take it with you (portability), restrict its use or object to it. You can edit or delete almost everything yourself from My profile, including the whole account (My profile → Delete account). For anything else, email privacy@hexhq.blog.

To delete only your Discord data, unlink Discord in My profile, Account, or email privacy@hexhq.blog if you own a room or Discord is your only way to sign in.

To get a copy of your data, use Download my data in My profile → Account.

If you think we're not handling your data properly, you can lodge a complaint with the data protection authority in your country.

You must be 16 or older to create an account. If we learn an account belongs to someone younger, we'll delete it.

If this policy changes in a meaningful way, we'll update the date above and let you know on the site.