Last updated: 16/09/2026
This Privacy Policy explains how Hextale collects, uses, stores, and protects personal data when you use Hextale, including our website, game, account services, playtests, and related services.
Hextale is currently operated by two individual developers and is not operated through a registered company.
1. Data Controller
For privacy-related questions or requests, contact:
support@hextalegame.com
2. What Data We Collect
The information we collect depends on how you use Hextale.
2.1 Account created with email and password
When you create an account using email and password, we may collect:
- email address;
- password, stored by our authentication system in encrypted/hashed form and not stored by us as readable text;
- player name, chosen after account creation, up to 20 characters;
- email verification code and information related to the verification process, including the time it was sent and verification attempts;
- whether the email address has been verified;
- account creation date;
- account modification date.
2.2 Account created through Google
If you register or sign in through Google, Hextale receives information provided through Google's authentication service.
This includes:
- your Google account identifier;
- your email address.
Depending on the information returned and stored by the authentication system, additional Google profile information such as your name or profile image may also be stored.
We will only use information made available through the Google authentication process for account creation, authentication, and operation of the Service.
Google's own privacy practices also apply to information processed by Google.
2.3 Game and account data
After your first login, we may store:
- acceptance of the applicable Playtest Agreement, including its version and acceptance date/time;
- your game profile;
- card collection and progression;
- decks;
- season information;
- pack/progression information;
- information indicating whether your account is currently online.
2.4 Gameplay data and telemetry
During gameplay, Hextale may collect telemetry associated with your player ID.
This may include:
Sessions
- session duration;
- time spent on individual screens.
Matches
- whether the match was against another player or the game bot;
- player identifiers/names associated with the match;
- match start and end times;
- match duration;
- winner;
- decks used;
- cards drawn;
- moves;
- conquests;
- points and other gameplay events.
We use this information to understand how Hextale is played, identify problems, balance gameplay, improve the user experience, and develop the game.
The telemetry is not used for third-party advertising or advertising profiling.
2.5 Reports and communications
If you submit a report or other communication through Hextale, we may collect the information contained in that submission.
Messages submitted through the contact form are sent to:
support@hextalegame.com
The contact form uses Google reCAPTCHA as an anti-abuse and security measure. When the form is used, Google may process technical information, including the user's IP address, in accordance with Google's own policies.
2.6 Reports involving other players
If you report another player, we may store information about:
- the reporting player;
- the reported player;
- the player names involved;
- the content and context of the report.
This information is used to investigate reports, enforce the rules, maintain fair gameplay, and protect the Service.
3. Information We Do Not Intentionally Collect
Hextale does not intentionally request or collect the following information for account creation:
- date of birth;
- age;
- country of residence;
- telephone number;
- payment card information.
Payments and donations made through PayPal are processed by PayPal. Hextale does not directly collect your payment card details through the game.
4. Why We Use Personal Data
We use personal data for the following purposes:
Account and authentication
To:
- create and maintain your account;
- authenticate users;
- verify email addresses;
- provide Google-based authentication;
- maintain account security.
Providing the game
To:
- provide gameplay and online functionality;
- save game progress;
- maintain collections and decks;
- operate multiplayer matches;
- maintain seasons and other game systems.
Playtesting
To:
- manage participation in playtests;
- record acceptance of the applicable Playtest Agreement;
- evaluate player feedback;
- improve Hextale.
Game development and telemetry
To:
- understand how players use the game;
- identify bugs and technical problems;
- balance gameplay;
- analyze player behavior within the game;
- improve usability and game design;
- measure the effectiveness of new features.
Security and abuse prevention
To:
- protect accounts;
- detect suspicious activity;
- prevent cheating and abuse;
- investigate reports;
- protect the integrity of multiplayer games;
- prevent automated abuse of forms and account systems.
Communications
To:
- respond to support requests;
- respond to contact form messages;
- send service-related communications;
- where you have subscribed, send Hextale updates and newsletters.
5. Legal Bases for Processing
Depending on the circumstances, we process personal data on the following legal bases under the GDPR:
- Performance of a contract: to create and operate your Hextale account and provide requested game services.
- Legitimate interests: to maintain security, prevent abuse and cheating, operate multiplayer services, analyze gameplay, improve Hextale, and maintain appropriate records.
- Consent: where applicable, including certain optional communications or processing activities for which consent is required.
- Legal obligations: where processing is necessary to comply with applicable law.
Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
6. Game Analytics and Telemetry
Hextale does not currently use third-party analytics services such as Google Analytics, Google Tag Manager, Cloudflare Web Analytics, Plausible, Umami, PostHog, Microsoft Clarity, Hotjar, Meta Pixel, or Sentry.
Instead, Hextale uses its own server-side telemetry system.
Telemetry is associated with a player ID and is therefore treated as personal or pseudonymous data rather than anonymous data.
Telemetry is used exclusively for Hextale development, operation, security, balancing, and improvement.
7. Service Providers
Hextale may use third-party providers to operate the Service.
These may include:
Nakama
Nakama is used to provide authentication, multiplayer, game services, and server-side functionality.
PostgreSQL
PostgreSQL is used as the database infrastructure associated with the Hextale server.
Cloudzy
Cloudzy provides the virtual server that hosts the Hextale game servers (Nakama and PostgreSQL). The server is located in Switzerland.
Google
Google may provide authentication through Google Sign-In and reCAPTCHA services.
Brevo
Brevo may be used to manage the Hextale mailing list and send newsletters or updates to subscribers.
PayPal
PayPal processes donations and, in the future, may process certain payments associated with Hextale.
Cloudflare
Cloudflare may provide infrastructure and security services for certain Hextale domains, including anti-bot protection.
These providers may process personal data on our behalf or independently depending on the service involved.
8. Data Storage and International Transfers
Hextale's game servers are hosted by Cloudzy in Switzerland, which the European Commission recognizes as providing an adequate level of data protection. Some third-party services used by Hextale may process data in countries outside the European Economic Area.
Where personal data is transferred outside the EEA, we will use an appropriate legal mechanism where required by applicable law, such as an adequacy decision or appropriate safeguards.
9. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.
Active accounts
Account information is generally retained while the account remains active.
Account deletion
When an account is deleted, account information intended for deletion will be removed or disabled as part of the deletion process.
Some information may remain after account deletion where necessary for:
- security;
- fraud and abuse prevention;
- maintaining the integrity of multiplayer records;
- resolving disputes;
- complying with legal obligations;
- maintaining legitimate development and statistical records.
Retention period for gameplay records
Gameplay telemetry, match records, and player reports may be retained for up to 12 months after account deletion for game development, security, abuse prevention, and maintenance of the integrity of Hextale.
Information may be retained for longer where required by law or where necessary to establish, exercise, or defend legal claims.
10. Account Deletion and Its Effects
Deleting your account does not necessarily mean that every record associated with your previous activity is immediately erased.
For example, match records, reports, and certain telemetry may remain for the retention periods described above.
Where retained information is no longer associated with an active account, it will be retained only for the purposes described in this Policy and subject to the applicable retention period.
11. Cookies and Local Storage
Hextale's website does not currently use advertising or analytics cookies.
The main website does not use cookies or local storage for its normal pages.
The game may use local storage (in the app, or in the browser when playing in a browser) when the user selects the "Remember me" option. In that case, the game stores a renewal token and email address under:
hextale.ricordami
This information is used to maintain the user's login session and is deleted when the user disconnects or deletes their account.
Further information is provided in our Cookie Policy.
12. Your GDPR Rights
Depending on applicable law, you may have the right to:
- access your personal data;
- request correction of inaccurate data;
- request deletion of personal data;
- request restriction of processing;
- object to certain processing;
- request data portability;
- withdraw consent where processing is based on consent;
- lodge a complaint with a competent data protection authority.
To exercise your rights, contact:
support@hextalegame.com
We may need to verify your identity before fulfilling certain requests.
13. Data Security
We take reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.
However, no internet service can guarantee absolute security.
14. Children's Privacy
Hextale is intended for users aged 13 and over.
Because Hextale does not intentionally collect date of birth or age during registration, users are expected to comply with the applicable age requirements.
Where applicable law requires parental or guardian authorization for the processing of a minor's personal data, such authorization must be obtained.
If you believe that a child has provided personal data to Hextale in circumstances where this was not permitted, please contact us at support@hextalegame.com.
15. Changes to This Privacy Policy
We may update this Privacy Policy when our services, data processing practices, or legal requirements change.
The "Last updated" date at the top of this Policy will indicate when it was most recently revised.
16. Contact
For any privacy-related question or request:
support@hextalegame.com
