Version 1.0 · effective 6 September 2026

Privacy

Controller and contact

Dmitrii Khriashchikov, Germany, operates Hex Momentum and is responsible for this notice. Contact: [email protected].

Data we use

• Account and sign-in data: nickname, display name, password hash or Google sign-in data, account settings, session and security metadata.
• Game and social data: profile and avatar, matches, ratings, game events, friendships, training progress, chat messages, and bug reports that you submit.
• Technical data: IP address, browser or device information, request and error data needed to deliver, secure, and diagnose the service.
• Optional notifications: a browser-push subscription and notification delivery data only after you enable browser notifications.

Why we use it

We use this data to create and secure your account, run matches and community features, deliver requested notifications, provide support, prevent abuse, and maintain the service. Account and game data are needed to provide the requested service. You may use password sign-in or, where offered, choose Google sign-in; browser notifications are optional.

Where the GDPR applies, the usual legal bases are performance of the service you request, legitimate interests in security and operation, and consent where an optional feature asks for it.

Who receives data

Authorized operators access data only as needed to run and support the service. netcup GmbH provides hosting infrastructure. Google receives data required for Google sign-in when you choose that method. Browser notifications are delivered through the push service used by your browser. Other players can see information that the game or community feature makes visible, such as your display name, avatar, match activity, and messages.

Retention and deletion

We keep account and game data while your account is active and only as long as needed to operate the service. Technical logs are kept for the operational period needed for security and diagnostics. Exact operational log and backup retention periods are not yet published.

You can request account deletion from Settings after signing in. The request immediately disables account access, then an erasure job removes direct account records and authored chat text. Deleted chat is left only as an identity-free placeholder so conversation structure remains intact. Shared match history may retain de-identified technical game records. A minimal internal record that deletion completed is retained to prevent an erased external sign-in identity from being recreated accidentally.

Cookies and device storage

Hex Momentum does not use advertising, analytics, or attribution cookies. A strictly necessary, HttpOnly refresh-session cookie is used on the web to keep you signed in. The Android app stores its refresh token in Android SecureStore. The web app may cache static files for installation and store the identifier of a browser-push subscription after you explicitly enable notifications. These are used for account, app, and notification functions, not tracking. No cookie banner is shown for this necessary storage.

Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction, objection, or a copy of your personal data. You may withdraw an optional permission, such as browser notifications, at any time. Email [email protected] and include enough information, such as your nickname, for us to verify and handle the request. You may also complain to a competent data-protection supervisory authority.

Changes

We may update this notice when the service or its data processing changes. The current version and effective date are shown at the top of this page.