Privacy statement

Who is responsible?

HexHunting is a small, non-commercial game for a circle of friends, run by Kors Kuijper in Groningen, Nederland. Questions or requests about your data: info@hexhunting.com.

What data do we process?

• Account data: email address, display name, hashed password, creation date, the moment you accepted the terms and the time of your last login.
• Strava connection: your Strava athlete id and the access tokens that allow us to fetch your activities.
• Temporary copy of Strava activity data: the Strava activity ID, name and GPS route of your rides and runs.
• Game data: which hexagons you own or have ever touched, since when, your points, your takeovers and derived time/location anchors used to determine group rides per hex.
• Security data: failed and successful login attempts with email address and IP address, kept for at most 30 days.
• Server logs from the hosting provider (IP address, requested page, timestamp), used for troubleshooting and abuse prevention.
• A GPX file you upload in the GPX check is processed in memory only and is not stored.
• Push notifications (only if you turn them on yourself): per device the address your browser or phone creates for this, the associated keys, the kind of device and whether HexHunting is installed as an app; plus your notification preferences, quiet hours and a list of the notifications you received.
• iPhone explorer: the app uses your current position only when you tap My Location. The selected map position is sent to HexHunting to find 19 nearby hexes and is not stored as an activity route. Your saved target hex, optional app lock, hunt timer and daily reminder stay on your iPhone. If you turn on Apple push, the server stores your device token and APNs environment to deliver notifications.

We use no analytics, no trackers, no advertising and no profiling. Your data is never sold or shared for commercial purposes.

Why, and on what legal basis?

• Performance of the agreement: without an account, a connection and routes there is no game.
• Consent: you connect your own Strava account. You can withdraw that consent at any time via Account or in your Strava settings.
• Legitimate interest: security of the site (login attempts, server logs).

Routes are sensitive data

Sports routes reveal a lot about where you live, where you work and when you are away from home. Therefore:

• Other players only see your display name and which hexagons you own — never your activities, your routes, your email address or your explored map.
• A hexagon covers about 5 km²: that shows your playing area, not your address.
• The explored map is strictly personal and visible only to you.
• Activities with visibility Only You may count with your explicit consent. Other players never see the activity, GPS route, your name or your internal player ID.
• For the group-ride rule HexHunting retains only derived minute anchors around each hex passage. Other players cannot see them and they are not used to display a full route.
• After a deletion notice from Strava, HexHunting immediately erases the activity, GPS route, passages and location/time anchors. Affected hexes, shared ownership, loot, badges and leaderboards are then recalculated; automatic 7-day cleanup remains the fallback.

Who do we share data with?

• Strava (United States) — the source of your activities. Strava's own privacy policy applies there.
• Strava may monitor HexHunting's use of the Strava API and collect usage data in doing so.
• UwICTPunt — the hosting provider running the site and the database.
• Map providers — when the map is shown, tiles are loaded from OpenStreetMap, Esri and OpenTopoMap, and scripts from unpkg.com. Those parties see your IP address and which map area you request. They receive no account data.
• Apple Maps — the native iPhone explorer displays map data through MapKit. Apple processes data about the requested map under its own privacy policy. HexHunting does not send account data to Apple Maps.
• Push services — if notifications are on, your phone or browser push service delivers them (Apple, Google, Mozilla or Microsoft). Browser push is end-to-end encrypted. For native iPhone push, HexHunting sends the notification title, body and link through Apple Push Notification service. No account data is included in the message.

Garmin

Als je Garmin koppelt, gebruiken we je persoonlijke API-sleutel om activiteitbestanden met GPS, datum, tijd en sport op te halen voor het spel. De sleutel en tijdelijke toegangstokens worden versleuteld opgeslagen. Slaap, voeding en andere gezondheidsgegevens vragen we niet op. De eerste synchronisatie haalt je activiteitgeschiedenis vanaf 2000 op, in kleine stappen. Daarna volgen nieuwe activiteiten.

Bij ontkoppelen verwijderen we de sleutel en tokens en stoppen we de synchronisatie. De eerder verwerkte activiteiten en spelresultaten blijven bij je HexHunting-account staan totdat je deze of je account verwijdert. Je kunt de sleutel ook direct in Garmin Connect intrekken. Je ontvangt een e-mailherinnering voor het vernieuwen van de sleutel.

How long do we keep it?

• Temporarily stored Strava activity data and GPS routes are automatically deleted within 7 days at the latest.
• Account and game data: as long as your account exists. When Strava is disconnected, all Strava-derived activities and game data are removed and recalculated; deleting the account also removes the remaining account data.
• Login attempts: 30 days.
• Push notifications: the notification list 60 days. A device subscription until you turn notifications off, sign out on that device, or the device stops accepting them for a longer period.
• Dormant accounts (no login for 24 months) are deleted after an announcement by email.
• If you delete your account, your data is erased immediately and permanently. Hosting backups may briefly still contain a copy; those expire on their own.

Your rights

• Access and export: Account → Download all my data gives you a complete JSON file.
• Deletion: Account → Delete account, immediate and permanent.
• Correction or anything else: email the administrator.

If we cannot resolve an issue together, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

The site runs entirely over HTTPS, passwords are only stored as hashes, session cookies are HttpOnly and Secure, forms are protected against CSRF, all database queries use prepared statements and login attempts are rate limited.

Age

HexHunting is intended for participants aged 16 and over.

Changes

If anything material changes about what we process, we will update this statement and mention it on your next visit.