Hexhold is a free Android app and web service operated by Hexhold, based in Romania. This policy explains what data we collect, why, and your rights as an EU/EEA resident under the GDPR. For all data-related contact, reach us at support@hexhold.app.
We collect the minimum data needed to run a gaming app whose central mechanic uses your real-world wellness activity (sleep, walking, heart rate) to boost the XP your gaming sessions earn. We never sell your data. You can delete your account and all associated data at any time.
| Category | Examples | Source |
|---|---|---|
| Account | Email, username, country, sign-in provider tokens (Steam, FACEIT, Discord if used) | You / OAuth provider |
| Health & fitness | Step count, distance walked, exercise session metadata, heart rate samples, sleep duration | Android Health Connect (with your explicit permission) |
| Gaming activity | Steam match history (Dota 2: match IDs, outcomes, hero, MMR-adjacent stats; playtime). FACEIT match data if connected. | Steam Web API, FACEIT API |
| In-app behavior | XP earned, hexes claimed, crew membership, season participation, crew chat messages | Hexhold servers |
| Device + diagnostics | Crash reports, app version, device model class, OS version | Anonymized telemetry (Sentry or equivalent) |
| Push tokens | Firebase Cloud Messaging registration ID | You (when you consent to notifications) |
We do NOT collect:
| Data | Purpose |
|---|---|
| Account & sign-in | Identify you across sessions; allow you to sign in |
| Steps, distance, exercise, HR, sleep | Compute your boost multiplier — the core game mechanic in which real-world wellness increases the XP your gaming earns |
| Gaming activity | Compute XP from matches you played (the game's primary reward); display match summaries |
| In-app behavior | Run the game (XP balances, crew leaderboards, season standings) |
| Diagnostics | Identify crashes and bugs; improve stability |
| Push tokens | Send you the post-match notification you opted into |
Hexhold requests the following Android Health Connect permissions:
READ_STEPSREAD_DISTANCEREAD_EXERCISEREAD_HEART_RATEREAD_SLEEPThese are used only to compute your boost multiplier and unlock daily streak progress. You may revoke any permission at any time via Android Settings → Health Connect → App permissions, with no loss of account access. Revoking a permission disables only the corresponding XP source.
We do not transmit raw Health Connect data to third parties. The data is processed by our server (Supabase, EU region) to compute aggregate signals (boost active yes/no; daily total steps; sleep duration). Raw heart-rate series are retained for up to 90 days for anti-cheat plausibility checks, then deleted.
For the full per-permission justification we submitted to Google, see the Health Connect data-usage page.
We share your data only with the following processors:
We do not sell your data. We do not share your data with advertisers. We have no advertising in v1.
If you live in the EU/EEA you have the right to:
Email support@hexhold.app to exercise any of these rights. We respond within 30 days.
Hexhold is not intended for users under 16. We do not knowingly collect data from anyone under 16. If we learn that we have, we delete it.
Data is encrypted in transit (HTTPS / TLS) and at rest (Supabase-managed encryption). Authentication uses industry-standard OAuth flows. We do not store passwords (sign-in is via email magic-link or third-party OAuth).
We will notify users in-app of material changes and update the "Last updated" date above. Prior versions are preserved in our public git repository.