← Back to HexAtlas

Privacy Policy

Last updated: November 1, 2026

The short version: We collect your email and basic profile when you sign up. Your maps are stored locally or in the cloud when you choose cloud saves. Shared maps expose their underlying data to link recipients. Optional usage sharing is off by default. We don't sell your data, track you across the web, or spam you.

1. What We Collect

When you create an account, we collect:

If you link your Patreon account, we also store:

Patreon handles payment details; HexAtlas does not receive your card number. We keep membership status and its change history to verify Cloud Membership and the Holiday Styles.

2. Your Maps and Data

Local storage: By default, your map data is stored in your browser using IndexedDB. This data stays on your device and we have no access to it.

Cloud storage: If you're a paid subscriber and use cloud saves, your map data is stored on our servers (hosted by Supabase). Cloud-stored maps are associated with your account. Publishing a cloud share makes the underlying map publicly accessible by link. Player-view filtering and fog do not remove private information from that data. Use a separate copy without private content before sharing. We use map data to provide storage and sharing you request, not for optional product analytics.

You can export your maps at any time as JSON files, and you can delete cloud-stored maps from within the app.

3. How We Use Your Information

We use your information to:

We will never sell, rent, or share your personal information with third parties for marketing purposes.

4. Cookies and Local Storage

HexAtlas uses browser local storage and IndexedDB to save your maps, preferences, and authentication session. The website also uses Google Analytics, which sets its own cookies to count visits (described below). We do not use advertising cookies.

The app keeps daily usage counters in this browser for up to 30 days and a first-save date, without map content. These counters are separate from your map files. Optional sharing is off by default. If you enable it, and the measurement service is launched, only an allowed event name (such as map_saved) and a broad source (such as local or cloud) are sent. No map names, notes, account IDs, email addresses, raw page URLs, or persistent visitor identifiers are included in these event payloads. Global Privacy Control and Do Not Track suppress this optional sharing.

The measurement endpoint processes the connection IP to create a daily salted hash for rate limiting; the application removes hashes older than the current and previous UTC day on the next accepted request. It stores aggregate daily event counts without the hash. Hosting providers may separately retain connection or security logs. Billing records are necessary account data, not optional visitor analytics. Turning sharing off stops future optional events; it does not delete your local counters or already aggregated counts.

Optional analytics are off unless you previously enabled them.

These buttons control HexAtlas's own optional usage counts only, not Google Analytics.

Google Analytics. The website and app load Google Analytics 4 to count visits and see which features are used. It records the pages you view, the site that referred you, your browser, device type and screen size, and an approximate location that Google works out from your connection. In the app it also receives the event names listed above (such as map_saved) with a broad source; it never receives map content, map names, notes, account IDs or email addresses. Google Analytics sets first-party cookies (such as _ga) that tell repeat visits apart and last up to two years. It is not loaded when your browser sends Global Privacy Control or Do Not Track, inside embedded maps, or on local copies of the app. You can also block it with a content blocker or Google's opt-out browser add-on.

5. Third-Party Services

We use the following services to operate HexAtlas. Each has its own privacy policy governing how they handle your data:

6. Data Security

We use industry-standard security practices to protect your data, including encrypted connections (HTTPS), secure authentication tokens, and server-side access controls. Your password is hashed and never stored in plain text.

However, no system is perfectly secure. We cannot guarantee absolute security of your data and are not liable for breaches beyond our reasonable control.

7. Your Rights

You can:

To request account deletion or data export, email us at the address below.

8. Children's Privacy

HexAtlas is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly.

9. Changes to This Policy

We may update this policy as the product evolves. We will make reasonable efforts to notify users of significant changes. Continued use of HexAtlas after changes constitutes acceptance of the updated policy.

10. Contact

Questions or requests? Email us at thenerdyGM@gmail.com