Privacy Policy

1. Introduction

Welcome to Hexproof. We are committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website.

2. Information We Collect

We collect information you provide directly to us:

• Account Information: When you register, we collect your email address, username, and display name.
• Profile Information: Profile picture, bio, and any other information you choose to add to your profile.
• Content: Posts, comments, decks, and other content you create and share on the platform.
• Communications: Messages you send to other users through our platform.

We also collect information automatically:

• Device Information: Device type, operating system, and app version.
• Usage Data: How you interact with our app, including features used and time spent.
• Interaction Data: We track how you engage with content to personalize your experience. This includes which posts and videos you view and for how long, likes, reactions, comments, and search queries. This data is collected in batches from your device and is automatically deleted after 90 days.
• Push Notification Tokens: To send you notifications (with your permission).

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process and complete transactions
• Send you technical notices, updates, and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent or unauthorized activity
• Personalize your feed and recommend relevant content based on your interactions
• Send push notifications (with your permission)

4. Information Sharing

We do not sell your personal information. We may share information:

• With Other Users: Your public profile, posts, and decks are visible to other users.
• With Service Providers: Third-party companies that help us operate our platform (hosting, analytics, email services).
• For Legal Reasons: If required by law or to protect rights and safety.
• With Your Consent: When you explicitly agree to share information.

5. Data Hosting and Third-Party Services

Your data is hosted on servers located in the European Union:

• Website: Hosted on Vercel (EU region)
• API: Hosted on Heroku (EU region)
• Database: Hosted on MongoDB Atlas (EU region)

We also use the following third-party services:

• Scryfall API: For Magic: The Gathering card data and images
• Sentry: For error tracking and crash reporting
• Plausible: For privacy-friendly website analytics (no cookies, no personal data collected)
• Expo: For push notification delivery
• Bunny.net: For video hosting and delivery

Each of these services has their own privacy policies governing how they handle data.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal information:

• All data transmission uses HTTPS/TLS encryption
• Passwords are hashed using bcrypt
• Database encryption at rest
• Regular security reviews and updates

7. Your Rights and Choices

You have the following rights:

• Access: Request a copy of your personal data.
• Correction: Update or correct inaccurate data.
• Deletion: Request deletion of your account and data.
• Notification Preferences: Control which notifications you receive.
• Data Portability: Request your data in a portable format.

To exercise these rights, contact us at hello@hexproof.app.

8. Account Deletion

You can delete your account at any time through the app settings. When you delete your account:

• Your personal information is permanently deleted
• Content others have interacted with is anonymized (attributed to "Deleted User")
• Your messages and private data are removed
• Group ownership is transferred to another member

9. Data Retention

We retain your information for as long as your account is active or as needed to provide services. Raw interaction data (post views, video views, search queries) is automatically deleted after 90 days. Aggregated preference profiles used for content personalization are retained while your account is active. When you delete your account, all personal data, interaction data, and preference profiles are permanently deleted.

10. Children's Privacy

Hexproof is not intended for children under 13. We do not knowingly collect information from children under 13. If we learn we have collected such information, we will delete it promptly.

11. International Users

Hexproof is operated from Norway and our primary infrastructure is hosted in the European Union. Your data is stored and processed on EU-based servers. If you are accessing Hexproof from outside the EU, your information will be transferred to and stored in the EU.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Effective Date" at the top. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

Email: hello@hexproof.app