What this server keeps about you, who else sees it, and how to be rid of it.
The short version: we keep what a game needs and nothing else. There is no advertising here, no tracking pixel, no analytics service, and nothing about you is sold or handed on to anybody except the few services named below that do a job for us.
A guest needs no account and gives us nothing. Your browser holds a token this server signed, which expires after thirty days, and your guest name is worked out from that token rather than stored anywhere. The games you play are kept, as described below.
We store the username you chose, and:
Every finished game is kept: the map, the moves, how long they took, the names at each seat and which account or guest sat there. This is what replays and ratings are made of, and it is kept indefinitely, because a game is a shared record rather than only yours.
We send two kinds of message: a link to set a new password, and a link confirming your address. Both are stored only as a hash, so the link in your inbox is the only copy; the first expires after thirty minutes and the second after a week. Messages are sent through Mailgun, on their European service, who therefore see the address they deliver to.
A message sent through the contact page is kept with the name and address you gave, the time, and the account or guest that was signed in, if one was. A copy is mailed to our own inbox through Mailgun, so we can answer from there. Both are kept until we have dealt with the message and then deleted, and deleting your account deletes any message it sent. Nothing in them is used for anything but answering you.
Your network address is used while a request is being handled, to stop one machine opening a hundred tables or asking for a hundred password links. It is held in memory for that purpose and is not written into the database. The web server keeps ordinary request logs, as every web server does.
The typefaces the site is set in are files on this server rather than something fetched from a font service. Loading a page reaches this server and nobody else, so no third party learns your address from the act of reading one.
The server itself, and its database, run on one machine in Europe. There is no copy of it anywhere else except the backups taken before a deployment, which live on that same machine.
You can change your username yourself, and ask us at any time for a copy of what we hold, a correction to it, or its deletion. Write to info@hexalon.io.
Deleting an account removes the account itself and everything that signs in with it: the password, any linked Google or Discord identity, every session, and any outstanding links we mailed you. The games stay, because a finished game is the record of everybody who sat at that table, and removing one person's seat would rewrite theirs. What goes from those games is your name: the seat keeps an identifier nobody can look up and shows a neutral label instead.
If you are in the European Union, the law gives you these rights explicitly, along with the right to complain to your national data protection authority.
Last reviewed 2 October 2026.