Last updated: September 8, 2026
The short version: We collect your email and basic profile when you sign up. Your maps are stored locally or in the cloud when you choose cloud saves. Shared maps expose their underlying data to link recipients. Optional usage sharing is off by default. We don't sell your data, track you across the web, or spam you.
When you create an account, we collect:
If you link your Patreon account, we also store:
Patreon handles payment details; HexAtlas does not receive your card number. We keep membership status and its change history to verify Pro access.
Local storage: By default, your map data is stored in your browser using IndexedDB. This data stays on your device and we have no access to it.
Cloud storage: If you're a paid subscriber and use cloud saves, your map data is stored on our servers (hosted by Supabase). Cloud-stored maps are associated with your account. Publishing a cloud share makes the underlying map publicly accessible by link. Player-view filtering and fog do not remove private information from that data. Use a separate copy without private content before sharing. We use map data to provide storage and sharing you request, not for optional product analytics.
You can export your maps at any time as JSON files, and you can delete cloud-stored maps from within the app.
We use your information to:
We will never sell, rent, or share your personal information with third parties for marketing purposes.
HexAtlas uses browser local storage and IndexedDB to save your maps, preferences, and authentication session. We do not use third-party advertising cookies or tracking pixels. We do not track you across other websites.
The app keeps daily usage counters in this browser for up to 30 days and a first-save date, without map content. These counters are separate from your map files. Optional sharing is off by default. If you enable it, and the measurement service is launched, only an allowed event name (such as map_saved) and a broad source (such as local or cloud) are sent. No map names, notes, account IDs, email addresses, raw page URLs, or persistent visitor identifiers are included in these event payloads. Global Privacy Control and Do Not Track suppress this optional sharing.
The measurement endpoint processes the connection IP to create a daily salted hash for rate limiting; the application removes hashes older than the current and previous UTC day on the next accepted request. It stores aggregate daily event counts without the hash. Hosting providers may separately retain connection or security logs. Billing records are necessary account data, not optional visitor analytics. Turning sharing off stops future optional events; it does not delete your local counters or already aggregated counts.
Optional analytics are off unless you previously enabled them.
We use the following services to operate HexAtlas. Each has its own privacy policy governing how they handle your data:
We use industry-standard security practices to protect your data, including encrypted connections (HTTPS), secure authentication tokens, and server-side access controls. Your password is hashed and never stored in plain text.
However, no system is perfectly secure. We cannot guarantee absolute security of your data and are not liable for breaches beyond our reasonable control.
You can:
To request account deletion or data export, email us at the address below.
HexAtlas is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly.
We may update this policy as the product evolves. We will make reasonable efforts to notify users of significant changes. Continued use of HexAtlas after changes constitutes acceptance of the updated policy.
Questions or requests? Email us at thenerdyGM@gmail.com