Hexsummon Privacy Policy
Last updated: 25 October 2026
Hexsummon ("we", "us") is an online fantasy card game made by Jake Wheeler in London, United Kingdom. It's available at play.hexsummon.com and as the Hexsummon app on Google Play. This policy explains what information the game uses and why.
Contact: shadzbusiness@gmail.com. Our community Discord is linked from the game.
What we collect
- Account details. The username you choose (other players can see it in the lobby, on the ladder, in friends search and in duels; please don't use your real full name), a random player ID, session tokens, and your password, which is stored only as a salted, one-way hash. Playing requires a free account.
- Email (optional). If you choose to add a recovery email, we keep it so we can help you get back into your account. It's never shown to other players or used for marketing. You can change or remove it in Profile → Account at any time. We never ask for your phone number or real name.
- Friends. The friend requests you send and accept, so we can show your friends list. Your friends can see whether you're online, in a duel or offline, and can invite you to a duel.
- Gameplay data. Your card collection, decks, sparks balance, match results, rating, win/loss record and tutorial progress.
- Chat. Messages you send in the lobby chat are shown to online players, and the most recent lobby messages are kept as a short rolling history. Messages in duel chat are passed to your opponent live and aren't stored. All chat is filtered for offensive words, and you can mute your opponent.
- Technical data. Our host, Cloudflare, briefly processes your IP address to deliver the game. We also use it for short-lived rate limits that stop spam sign-ups.
What we don't do
- No ads, and no advertising or tracking SDKs.
- No selling or sharing of your data with third parties.
- No access to your location, contacts, photos, microphone or camera. The Android app only needs internet access.
Purchases (website only)
On the website you may be able to buy "sparks" (in-game currency) through Stripe. Stripe handles your payment details under its own privacy policy, and we only receive a record of what was bought. The Google Play app does not sell anything.
Where your data lives
Game data is stored and processed by Cloudflare, Inc. (Workers and Durable Objects), which acts as our service provider. Cloudflare may process data in data centres outside the UK, with appropriate safeguards in place. Data is always encrypted in transit (HTTPS/WSS).
How long we keep it
- Account and gameplay data is kept while your account exists.
- Lobby chat history keeps only the latest messages and older ones are automatically discarded.
- Rate-limit records expire within hours.
Your choices and rights
You can mute chat, or delete your account (Profile → Delete account, or at play.hexsummon.com/delete-account, or by contacting us). Deletion removes your player record (including any recovery email), sessions, collection and friends list, and your name is removed from past match records. Under UK GDPR you can also ask for a copy of your data, ask us to correct it, or complain to the Information Commissioner's Office (ico.org.uk).
Children
Hexsummon is intended for players aged 13 and over and isn't directed at children under 13. If you think a child under 13 has created an account, contact us and we'll delete it.
Changes
If this policy changes, we'll update the date above and post the new version at play.hexsummon.com/privacy.