Your data in HEXMARCH

HEXMARCH keeps only what it needs to run your matches. There are no ads, no tracking, no third-party analytics, and your data is never sold.

HEXMARCH is a turn-based strategy game for the web, iPhone, iPad and Mac, made by Alejandro Pacheco (“we” below). This policy covers the game, its website and the HEXMARCH server. If anything here is unclear, get in touch.

What we store

Data	What it is and why
Display name	The name you pick (up to 24 characters). If you sign in with Apple and share your name, that name is used. Other players see it in your matches, on your invite page and in their turn notifications. Pick a nickname if you'd rather not use your real name.
Account id	A random id we create for your account.
Guest device id	When you play as a guest, the game makes up a random id and keeps it on your device, so the server can recognise your guest account. It isn't a hardware or advertising identifier.
Sign in with Apple	If you sign in with Apple, we store the user identifier Apple gives HEXMARCH. We ask Apple only for your name, never your email address.
Matches	Each match's settings (map, factions, seats, turn length), every move made in it with its time, saved copies of the game state, the result and the scores, and which account sits in which seat. Players in a match can see whether you're online and when you were last seen in it.
Friends	When someone joins a match you created, or you join theirs, you're remembered as friends.
Invites	The invite codes you create and the match each one is for. Codes work for 7 days.
Notifications	Only if you turn on turn alerts: in the app, your device's Apple push notification token; in a browser, the push subscription your browser creates (an address at your browser's push service and the keys to encrypt messages to it). We use them to tell you when it's your turn, when time is running out, when someone nudges you and when a match ends.
Purchases	Not live yet. When the optional Full Game unlock arrives, RevenueCat (our purchase provider) will tell our server which product your account owns and until when. We never see your payment details; Apple handles payment.

We don't collect your email address, phone number, contacts or location, and we don't store IP addresses or any advertising identifier in our database.

On your device

The game keeps a few things in your browser's local storage (in the app, in its built-in web view): your sign-in session, your name, your guest device id, your settings, the invite codes you made recently, which tips you've seen, and a copy of the game's content so it loads faster. HEXMARCH doesn't use cookies.

Where it's stored

Everything runs on Cloudflare: Cloudflare Workers for the server, a Durable Object for each match (its moves and game state), a D1 database for accounts, friends, invites and the match list, and R2 for the game's content files. Cloudflare processes this data for us. Our server's own logs record errors and match ids to help us fix problems, not names or tokens. Cloudflare's own systems handle requests under Cloudflare's privacy policy.

Who else is involved

• Cloudflare hosts the game and its data, as described above.
• Apple, if you use Sign in with Apple (on the web, the sign-in button loads Apple's sign-in script from Apple; we check your sign-in with Apple's public keys), and for notifications in the app.
• Your browser's push service (run by your browser's maker, such as Apple, Google or Mozilla), if you turn on turn alerts in a browser. It only carries encrypted messages.
• RevenueCat, later, for purchases only, as described above.

A notification's text can include an opponent's display name and the turn number. That's the whole list: no ad networks, no analytics or crash-reporting services, no social SDKs.

What we don't do

• No ads, and no data shared with advertisers.
• No tracking across other apps or websites.
• No third-party analytics.
• We never sell or rent your data.

How long we keep it

• Your account (name, ids, friends, notification tokens, purchases) stays until you delete it.
• Matches are kept after they end, so match history works for everyone who played. When you delete your account, your name and account id are removed from them (see below).
• Invite codes stop working after 7 days.
• Notification tokens and subscriptions are removed when the push service reports them as no longer valid, when another account signs in on the same device or browser and turns alerts on, or when you delete your account.
• Your session stays signed in on your device for up to a year. Signing out removes it from the device.

Deleting your account

In the game, open Settings → Delete account and confirm with Delete forever. This:

• deletes your account, your notification tokens and subscriptions, your friends list, your purchase records and your invite codes;
• removes your name and account id from your matches, where you then appear as “Deleted player”;
• resigns your seat in matches that are still going; they carry on without you, with a bot playing your old seat.

The moves already played stay in those matches so they still make sense for the other players, but they're no longer linked to you. Deleting can't be undone.

Your device keeps its own copy of your settings until you clear the site's data in your browser or delete the app. If you can't reach the game (for example, a guest account in a browser whose data was cleared), contact us with your display name and a match you played, and we'll delete it by hand.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it, wherever you live. Write to us through alepacheco.dev/contact and we'll answer within 30 days. We use your data only to run the game you asked to play, to keep it secure and to fix problems. You can also complain to your local data protection authority.

Children

HEXMARCH doesn't ask for age, real names or contact details, and has no chat: players can only send a fixed set of emotes. We recommend children play under a nickname.

Changes

If this policy changes, we'll update this page and its effective date.