Privacy policy
Version: 2026-09-03.02 Published: 03/09/2026 Binding version: the French text, at /fr/legal/privacy. This English translation is provided for information only. Where the two differ, the French governs.
---
1. Who is responsible for your data
The controller is:
- Legal name: Ethan Consulting
- Legal form: société par actions simplifiée unipersonnelle (SASU)
- Share capital: 10 000 €
- Registered office: 10 allées des boutons d'or, 78180 Montigny-le-Bretonneux, France
- Trade register: RCS Versailles 801 930 694
- SIRET: 801 930 694 00022
- Intra-Community VAT number: FR 80 801930694
- Publication director: Henrique Vidal
Data protection contact: contact@hexeon.io
No data protection officer (DPO) is currently designated. The Article 37(1) test has not yet been run; it will be, and this section updated, if designation becomes mandatory or if we appoint one voluntarily.
Telephone number: No telephone number is published. This omission is deliberate. Article 1-1 of the French law on trust in the digital economy (LCEN) lists the mandatory information for a publisher and includes a telephone number. The non-publication of this number creates an exposure to an infraction sanctioned under Article 1-2 of the same law.
---
2. What this policy covers
The Hexeon game, its mobile app, its web app and the services behind them. It sets out what data we process, why, on what legal basis, for how long, who receives it, and what you can require of us.
It does not cover the rules of the game or the terms of service, which are in the terms of use.
Hexeon is in alpha. Section 13 says what that changes for your data.
---
3. What we do not collect
This comes first because it is the shortest section and because it changes how the rest reads.
- No password. Hexeon has none, so we store none, not even hashed.
- No date of birth. See section 12.
- No advertising identifier, no advertising, no advertising profiling.
- No analytics tool, no third-party tracker, no analytics SDK, not in the game, not on the sign-in
- screens, and not in our emails (our emails contain no remote images and no tracking pixel).
- No font loaded from a third-party server. Our fonts are self-hosted, and an automated test
- fails the build if a link to a remote font service appears anywhere in the code.
- No payment data. During the alpha the flows that will later be paid stay usable, but the
- payment step is replaced by a free one: nothing is sold, nothing is billed, no card number reaches
- us and no payment provider is involved.
- No special-category data within the meaning of Article 9, and we do not ask for any.
- No geolocation. We do not run IP-to-location lookups.
- Never your full IP address in a stored record. See section 4.5.
---
4. What we process, why, on what basis, and for how long
4.1 Overview
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Email address | It is your login: it is what makes the account possible | Art. 6(1)(b) performance of a contract; before you accept the terms, pre-contractual steps at your request | Life of the account |
| Six-digit codes and their context (target address, attempts, resends) | Signing you in, and stopping someone else doing it for you | Art. 6(1)(b) for sending the code; Art. 6(1)(f) account security for the counters and limits | 24 hours after the code expires. The code itself lives ten minutes and is never stored in the clear (it is stored hashed) |
| Sessions: the device label you choose, platform, truncated IP address, timestamps | Keeping you signed in, showing you your active sessions, letting you revoke them, spotting abnormal use | Art. 6(1)(b) and Art. 6(1)(f) security | 90 days after the session is revoked or ends. A session lasts at most 30 days |
| Email change requests (old and new address) | The email change tunnel and its revocation window | Art. 6(1)(b) and Art. 6(1)(f) protection against account takeover | 90 days after the tunnel closes. Revocation from the old address stays possible for 7 days |
| Preferences: language, time zone, board visibility | Rendering the game correctly and respecting your choice | Art. 6(1)(b) | Life of the account |
| Messages in the in-game inbox, including when you read them | Telling you what happened, even when no notification reached you | Art. 6(1)(b) | 180 days |
| Mail delivery events (address, hard bounce, complaint) | Knowing that an address no longer receives, and telling you | Art. 6(1)(f) deliverability and security | 90 days, whether or not the address belongs to an account |
| Idempotency keys and command receipts | Stopping a retried action from being executed twice | Art. 6(1)(b) | Until the key expires (hours) |
| Proof of acceptance of the terms: date, language, version and hash of the documents shown, age declaration, truncated IP | Demonstrating that the contract was formed and that you were informed | Art. 6(1)(f), read with Art. 5(2) accountability | Life of the account |
| Paid tunnels entered during the alpha: which one, when, completed or abandoned | Deciding what we will sell at launch and at what price (section 4.7) | Art. 6(1)(f) legitimate interest | Deleted at the end of the alpha, and at most 12 months after it was written. Anonymous totals remain |
| Your portability copy | Handing it to you | Art. 6(1)(c), giving effect to Art. 20 | The file 7 days, the record of the request 90 days |
| Notification preferences (the three categories) | Knowing what you agree to be told about | Art. 6(1)(a) consent for market and account; Art. 6(1)(f) for world, with a switch to refuse | Life of the account |
| Your device's push token service inactive | Reaching you on a lock screen | Art. 6(1)(a) and Art. 82 of Loi 78-17 | 30 days after revocation, 180 days after the device was last seen |
| Google or Apple identity service inactive | An additional door onto the same account | Art. 6(1)(b) | Life of the link |
| Database backups | Being able to restore the service after a failure or a mistake | Art. 6(1)(f) service continuity and security | 30 days. Erased data remains in a backup until that backup expires, and is never returned to live use from one (section 10.2) |
4.2 Your email address
It is not a profile field. It is the only identity anchor in the service: there is no password, and signing in means proving that you receive the mail sent to that address. That is why processing it rests on performance of the contract and not on your consent: without it there is no account at all, and withdrawing it would mean deleting the account, which section 10 lets you do at any time.
We display it in full on your account screen, and masked everywhere else.
4.3 The codes
A code lives ten minutes. It is never stored in the clear: we keep a cryptographic fingerprint, which is enough to check what you type and does not allow the code to be recovered. The row carrying the code, the target address and the attempt counter is deleted 24 hours after the code expires.
One point of honesty: that row carries the target address even if no account matches it, because it has to exist while the code is usable. It is gone within 24 hours of expiry, with no exception.
4.4 The device label
Text you choose ("kitchen iPhone"). It exists so that the list of your sessions is readable. It appears in an inbox message when a session is opened, and it would appear in a notification if notifications were active service inactive, which would mean it passes through Apple or Google (section 7).
4.5 Your IP address
Two distinct treatments, and the difference matters:
- In full, in memory and temporarily, as the counting key for the rate limits that protect the
- service from automated attacks. It is never written to disk or to a log in that form, and it is
- gone at the end of the counting window. Legal basis: Art. 6(1)(f).
- Truncated, when it is stored: we keep only the first three octets of an IPv4 address
- (
203.0.113.0/24) and the first three groups of an IPv6 address (/48). That truncated form, and - only that, is attached to a session, a code request or an acceptance of the terms, and appears in
- our technical logs.
A truncated address is still personal data and we treat it as such.
4.6 Public boards
Your feats may appear on boards visible to other players. Legal basis: Art. 6(1)(f), the interest of a shared game in having a common memory. You can leave at any time with the "do not appear on the boards" switch on your account screen, which needs no justification and takes effect immediately. That is your right to object (Art. 21(1)) made directly actionable. [PLANNED: the boards are not live yet.]
---
4.7 What we observe of the paid tunnels during the alpha
Everything is free during the alpha, but the flows that will later be paid stay in place and only the payment step is replaced by a free one (section 13). We record which of those flows you enter and whether you complete them, because that is what will let us decide what to sell at launch and at what price. It is the point of the alpha, and we would rather say so here than let you infer it.
What we record: which flow, the date, and whether it was completed or abandoned. Nothing else.
What we do not record, and will not build: no estimate of what you would be willing to pay, no score, no profile. We do not cross-reference these records with any other data, and no decision about you is taken from them: nobody is shown a different price from anybody else, during the alpha or at launch.
Legal basis: Article 6(1)(f), our legitimate interest in knowing what the thing we are building is worth. We cannot rely on performance of the contract: these observations are not necessary to provide you with the game, they are useful to us in designing it, and processing that is useful but not objectively necessary to the service falls outside Article 6(1)(b). We have written down the balancing exercise that supports this interest; it rests on four limits, and if any one of them falls the analysis has to be redone: how little is recorded, the absence of any individual decision, a short retention, and a refusal that takes one gesture.
Your right to object (Article 21(1)). You can refuse this processing at any time, with no need to justify yourself, by writing to contact@hexeon.io. We then stop recording anything for your account, and we erase what had already been recorded. The law would allow us to decline your objection if we demonstrated compelling legitimate grounds; we will never claim that a pricing study is such a ground, so we treat your refusal as unconditional. Refusing has no effect on your access to the game or on anything else.
How long: these records are deleted at the end of the alpha, and at most twelve months after they are written. What remains afterwards is an anonymous total, carrying no identifier, from which you cannot be recovered.
---
5. What we store on your device, and why there is no banner
The rules here do not come from the GDPR but from Article 82 of Loi 78-17, which subjects any reading or writing of information in your terminal equipment to prior consent, except what is strictly necessary to deliver a service you expressly requested.
We write two things, both inside that exemption:
| What it is | Name | Role | Duration |
|---|---|---|---|
| A cookie | hexeon_refresh | Carries the credential that stops a page reload from signing you out. HttpOnly, SameSite=Strict, Secure, and restricted by its path to the single endpoint that renews it. No script on the page can read it | The life of the session, at most 30 days |
| Local storage | hexeon.idem.* | Meaningless random strings that stop an action retried after a network drop from being executed twice | Until the action finishes |
There is no other cookie, no tracker, no advertising or analytics cookie. That is why you see no banner: there is nothing to ask you. If that ever changes, your consent will be collected before, not after.
On mobile, your session token is held in the operating system's secure store (Keychain on iOS, Keystore on Android), never in storage a web page can read.
---
6. Who receives your data
We do not sell, rent or pass on data for marketing. The only third parties that process it are our processors under Article 28, each on our instructions and for the stated purpose alone.
| Processor | Role | What it receives | Where | Art. 28 contract |
|---|---|---|---|---|
| Brevo | Sending the service's emails (sign-in codes, address change notices, deletion confirmations) | Your email address, the subject and the body | France | Signed |
| Scaleway | Hosting the application: one container for the game, one for the API, and a dedicated PostgreSQL database | All the data described in section 4 | France | Signed |
| OVHcloud | Hosting the public site (marketing pages and legal documents) | No account data. Its access log contains an IP address, as any web server's does | France | Signed |
| Apple (APNs) service inactive | Delivering notifications to an iOS device | Your device token and the text shown on the lock screen | Outside the EU, see section 7 | not applicable while the service is inactive |
| Google (FCM) service inactive | Delivering notifications to an Android device | Your device token and the text shown on the lock screen | Outside the EU, see section 7 | not applicable while the service is inactive |
| Google and Apple (sign-in) service inactive | "Sign in with Google", "Sign in with Apple" | Nothing from us: you authenticate with them, and we receive a stable identifier and your address in return | Outside the EU | not applicable while the service is inactive |
| Content delivery network to be settled before activation | Distributing the world snapshot, identical for every player | No account data. Its access log contains an IP address, as any web server's does | not applicable while the service is inactive | not applicable while the service is inactive |
We disclose data to an authority only where the law requires it, and we tell you when we do unless we are forbidden to.
---
7. Transfers outside the European Union
Hosting and mail are in the European Union, which leaves the whole identity path (your address, your codes, your sessions) free of any transfer.
One category of processing leaves the Union: notifications service inactive. Putting a line on the lock screen of an iPhone or an Android phone requires Apple's and Google's gateways, which are established in the United States. They then receive your device token and the sentence displayed, which may contain the label you gave that device.
to be settled before activation
This is the only transfer, and you can avoid it entirely: not granting notification permission, or revoking it, deletes the token and the flow with it. You keep receiving everything in the in-game inbox.
---
8. How long we keep your data
The periods in section 4 are the ones actually applied, by a scheduled job that deletes data past its term and reports what it deleted. They are not intentions.
In short: nothing touching your identity outlives your account by more than 90 days.
Two points we would rather write than leave out:
- An inactive account is deleted after two years. If you do not sign in for **two consecutive
- years, your account and everything attached to it are deleted. We warn you by email one month
- before**, that is after twenty-three months of inactivity, and simply signing in resets the clock.
- This gives effect to the storage limitation principle (Art. 5(1)(e)): an account nobody returns to
- has no reason to be kept indefinitely.
- An account created but whose terms were never accepted is deleted after 30 days without
- activity. Nothing was agreed, nothing was played, and the only datum is an address typed once.
-
[PLANNED: to be implemented with the acceptance screen.]
---
9. Notifications
Notifications do not run today. This section describes what will apply on the day they are enabled, and nothing it describes happens before then.
Three separate categories, because agreeing to be told that your week resolved is not agreeing to be told that you were outbid:
| Category | What it is | Default | Legal basis |
|---|---|---|---|
world | The beat of the game: your week resolved | On | Art. 6(1)(f), with a switch to refuse |
market | Your trades and auctions | Off | Art. 6(1)(a) consent |
account | Your account: a session opened, an address changed | Off | Art. 6(1)(a) consent |
You can change each at any time from the notifications screen, and refusing is as easy as accepting. Withdrawing permission does not erase what you were already told and has no retroactive effect, which is the limit Article 7(3) sets.
Refusing notifications costs you nothing. Everything meant for you is written to the in-game inbox, whether or not your lock screen lights up. The notification is only a courier.
We hold ourselves to two limits you can see in the app: a weekly cap on the number of notifications, and quiet hours you set. We will never notify you that something is about to be lost: the game does not manufacture urgency.
---
10. Deleting your account
You can delete it from inside the app, without writing to us and without giving a reason. Deletion requires a recent authentication, which protects an unlocked phone left unattended.
10.1 The delay before erasure
The request opens a 7-day window before erasure becomes irreversible. During it:
- your account is unreachable and your avatars are no longer playable;
- no notification is sent to you;
- your sessions are revoked immediately and your device tokens are deleted immediately, without
- waiting for the term;
- the only available gesture is to cancel the deletion.
This window is not a retention period. It is room to undo a mistake, because "I meant the other account" is a common one and a permanent loss cannot be repaired. It sits well inside the one-month period Article 12(3) gives us to act on your request: we erase faster than the law requires, not slower. What that sentence compares is when we act, not when the last copy is gone: backups run on their own 30-day cycle (section 4.1), so erased data can still sit in one long after it has left our live systems.
Do not confuse it with the 7 days during which your old address can cancel an email change (section 4). The two periods are the same length and the two mechanisms are unrelated.
10.2 What is erased
At the end of the window, erased irreversibly: your account, your email address, any linked Google or Apple identities, your sessions, your codes, your email change requests, your device tokens, your notification preferences, your entire inbox, your preferences, and the proof of your acceptance of the terms.
Backups are the one exception, and we would rather write it down than let you find out. Erasure removes your data from live systems as soon as the window ends. Our backups are kept for 30 days, and until the one holding it expires they still carry the erased data. Nothing erased is ever returned to live use from a backup, and if a restore were ever performed the erasure would be re-applied immediately afterwards.
10.3 What survives, and why we do not write "anonymised"
Today, nothing survives. Hexeon keeps no game history: the tables do not exist yet. Deleting your account therefore erases everything concerning you.
planned What follows describes what is intended once the game keeps an economic history. A new version of this policy will be published, and you will be told, before that is the case.
A trade has two sides. When your avatar sells a cargo to another player, the operation is as much in the buyer's ledger as in yours, it formed a price the marketplace showed to everyone, and it moved the production totals of a shared world. Rewriting that history because one of the two parties leaves would mean erasing other players' data and falsifying the state of a common world. We therefore intend to irreversibly cut the link between the avatar and the account, delete its name, and keep its numbers.
We will not call this anonymisation, because it is not. The CNIL applies three criteria: it must be impossible to single out an individual in the dataset, to link records concerning them, or to infer new information about them. An avatar keeps an identifier, so it singles out. Its ledger links it to its counterparties over time, so it links. And a player who traded with it every week can recognise it. This data will therefore remain pseudonymised personal data, subject to the GDPR, and not anonymous data outside its scope.
What that means concretely:
- Basis: Article 6(1)(f). The legitimate interest is the integrity of a shared economic record
- which is simultaneously other players' data and the state of a common world.
- Your right to erasure applies and is not excluded in advance. You can ask us to erase these
- records. We will examine your request case by case, and we can refuse only if we demonstrate
- compelling legitimate grounds overriding your interests within the meaning of Articles 17(1)(c) and
- 21(1). We would then have to tell you which.
- We do not claim the question is settled. We believe the position is sound, it has not been put
- to a supervisory authority, and if we turned out to be wrong we would delete these records.
- What we rule out in every case: keeping any mapping table that would let an avatar be linked
- back to an account. The cut is made to be irreversible on our side, and that is what distinguishes
- this from merely setting the data aside.
Aggregates carrying no identifier (tick totals, gauge histories, price series) are anonymous data and are kept without a time limit.
---
11. Your rights
| Right | Article | How to exercise it |
|---|---|---|
| Access: know what we hold | Art. 15 | Account screen, or our contact |
| Portability: receive a machine-readable copy | Art. 20 | Account screen, export control. The file is served once, through the authenticated service, never from a public link. One request per 24 hours. Its exact contents are set out in section 11.1 |
| Rectification: correct what is wrong | Art. 16 | Your preferences from the account screen. Your address through the email change tunnel |
| Erasure | Art. 17 | Account screen, section 10. Also through our contact |
| Restriction | Art. 18 | Our contact |
| Objection to processing based on our legitimate interest | Art. 21(1) | Our contact. For the boards and for the world notification category, an in-app switch does it immediately and without justification |
| Withdrawal of consent, for what rests on it | Art. 7(3) | Notifications screen. As easy to withdraw as to give, with no consequence for the rest of the service |
| Directives on the fate of your data after your death | Art. 85 of Loi 78-17 | Our contact |
11.1 What the copy you export actually contains
We would rather list it than write "your data", which means nothing and leaves you unable to check. The file currently contains, as JSON:
- your account and its preferences (language, time zone, board visibility);
- your ways of signing in: your email address, and any linked Google or Apple identities;
- your sessions, with the label you gave them, the platform, the truncated IP address and the dates;
- your entire in-game inbox.
It contains no game history, because there is none: those tables do not exist yet (section 10.3). The day your avatar has an economic history, it joins this list and this section is updated at the same time. We state that commitment here so that it can be held against us: an export omitting your game history would not answer an Article 20 request.
If you think something is missing, ask. The export control is the automated route and it does not exhaust your rights: your right of access (Article 15) covers all data concerning you, including anything not in the file, and it is exercised through our contact with the same one-month deadline.
Data concerning other people. Article 20(4) provides that portability must not adversely affect the rights of others. Your messages may name another player by their in-world name, where that is what the message already said to you on screen: we are then giving you back what you already had. We never export a third party's contact details, and in particular never someone else's email address.
Response time: one month from receipt of your request (Article 12(3)). It may be extended by two months where the request is complex or where there are many, and we will tell you within the first month, and why.
How we check it is you. A request from the account's email address, or made from an authenticated session, is enough. If we have a serious doubt we will ask for one further element, and we will never require a copy of an identity document for an ordinary request.
Complaints. If our answer does not satisfy you, you can lodge a complaint with the French supervisory authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at www.cnil.fr.
A limit we owe you. Your address is the only anchor of your account and there is no support-side recovery procedure: it would be a door to impersonation wider than everything else we defend. If you are about to lose access to your address, change it from a session that is still open while you have one.
---
12. Age
Hexeon is for people aged 15 or over. That threshold comes from Article 45 of Loi 78-17, giving effect to Article 8 GDPR: in France a minor may consent alone to processing in the context of an online service from the age of fifteen; below that, consent must be given jointly by the minor and the holder or holders of parental authority.
When you create an account we ask you to declare that you are 15 or over. We do not ask for your date of birth and we do not store it: we record only that the declaration was made, with its date. Keeping an exact birth date for ever in order to answer a yes/no question once would be disproportionate (Art. 5(1)(c)).
We are aware that a declaration is not a verification. We consider it proportionate for a game with no advertising, no advertising identifier and no third-party tracker. If you hold parental authority and find that a child under fifteen has created an account, write to us and we will delete it.
Our texts are written in clear and plain terms, which Article 45 requires where the reader may be a minor.
---
13. The alpha
Hexeon is in development. The service may change, be interrupted, or be withdrawn.
Your game data is not erased at the end of the alpha. A world may be reset if a fix requires it; we will tell you through the in-game inbox. Otherwise your game history is kept as described in section 8.
Resetting a world deletes neither your account, nor your address, nor your inbox, and takes away none of the rights in section 11.
Everything is free during the alpha. The flows that will later be paid stay visible and usable: only the payment step is replaced by a free one. So we collect no payment data, no payment provider is involved, and no sale takes place. The day a real payment is introduced, that will be a material change within the meaning of section 16: a new version of this policy will be published and you will be told before it takes effect.
---
14. Security
What we do, stated without an absolute promise, because no service can give one:
- Sign-in codes and session tokens are never stored in the clear.
- Session tokens are opaque, revocable at any instant, and a session lasts at most 30 days.
- Every sensitive operation (changing your address, unlinking a provider, deleting the account)
- requires an authentication less than five minutes old.
- An address change sends a notice to the old address, with a revocation link valid for 7 days.
- Our technical logs never contain a code, a token, a full email address or a full IP address.
- Traffic is encrypted in transit.
In the event of a data breach likely to result in a risk to your rights, we notify the CNIL within 72 hours of becoming aware of it (Article 33), and we tell you directly where the risk is high (Article 34).
---
15. Points under legal review
We would rather say what is unsettled than write a comfortable sentence. Five points in this text are under review by a lawyer and may be reworded:
1. The characterisation and fate of the economic history that survives account deletion (section 10.3). 2. The strength of the compelling legitimate grounds we would rely on against an erasure request for that history. 3. The basis for processing your address between account creation and acceptance of the terms. 4. How long the proof of acceptance is kept after the account is deleted. 5. The balancing exercise that bases our observation of the paid tunnels on legitimate interest rather than on your consent (section 4.7).
---
16. Changes to this policy
Every version is published at its own address and is never edited afterwards, so you can always re-read the one in force on a given date.
A material change (a new purpose, a new processor, a longer retention period, a change to what survives deletion) is announced through the in-game inbox before it takes effect. A wording correction is not.
This policy is not signed and not accepted: it is information we owe you under Article 13 GDPR, not a contract. The contract is the terms of use, which is a separate document.
---
Version 2026-09-01. Hash of the published text: [computed at publication].