Privacy Policy

Effective from October 10, 2026

What's new: We explain the optional local photo index, when it is deleted, and possible downloads from iCloud. We also clarify which photo-derived Claim data reaches our server and have shortened repeated explanations.

This Privacy Policy applies to the hexclaim.app website, the HexClaim app, and the associated online services.

Key Points at a Glance

Controller and Contact

The controller responsible for the processing of personal data is:

Jonathan Hasenburg, sole proprietorship

c/o IP-Management #11174, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany

Email: kontakt@hexclaim.app

Telephone: +49 156 79819237

You can find further information in the Legal Notice.

Use from the Age of 18

HexClaim is intended exclusively for adults. We do not perform identity or age verification.

Legal Bases

We process the data required for the account, app, and product functions in order to provide HexClaim and thereby perform the user agreement pursuant to Art. 6(1)(b) GDPR.

We process technical log data on the basis of our legitimate interest in operating HexClaim securely, stably, and protected against misuse (Art. 6(1)(f) GDPR).

Where we require data to comply with legal obligations, Art. 6(1)(c) GDPR is the legal basis.

Required and Voluntary Information

For an account, we require a Guest ID or Apple identifier and a display name. This information is generated by the app, transmitted by Apple, or provided by you. For a Claim, we require a location; the app or the HexClaim server generates the Claim time unless you select a different permitted time. Without this information, we cannot provide the account or the respective Claim function.

Notes, tags, information about other people, and photo features are optional. Connecting with Apple is initially voluntary. Without it, the number of new Claims for a guest account is limited. To sign in on another device, you need your Guest ID; if it is lost, the guest account may not be recoverable.

Visiting the Website

Our server processes your IP address, request time and destination, and technical connection data to deliver the website, diagnose errors, and prevent misuse. The website uses no cookies, analytics tools, advertising services, or externally hosted fonts.

Account and Sign-In

For a HexClaim account, we process an internal user identifier, your display name, a shareable profile code, and information about the creation and modification of the account.

You can initially use HexClaim with a Guest ID generated on your device by default. An existing Guest ID can also be entered on another device to access the associated guest account. The Guest ID is associated with your account and stored until the account is deleted. After connecting with Apple, it can no longer be used to sign in but remains stored as part of the account history until the account is deleted.

If you connect your account with Apple, we process the unique user identifier transmitted by Apple. Depending on your selection with Apple, we may also receive your name and email address or a relay address generated by Apple.

To verify and secure sign-in, we process the sign-in and session data required for this purpose. We do not permanently store the identity token transmitted by Apple. The Apple identifier connected with the account and the profile information transmitted by Apple remain stored until the account is deleted.

The app stores the identifiers and session keys required for sign-in securely on your device.

Location and Claims

When you use a location function, the app uses iOS location access to show your position or prepare a Claim. Displaying your current position does not send it to the HexClaim server.

Optional notifications about nearby unclaimed hexes require “Always” location access, Precise Location, and notification permission. iOS may provide occasional background locations, which the app checks only on your device. To avoid repeat notifications, it keeps the notified hexes and notification times locally for up to 30 days. Neither these locations nor the notification history is sent to us. You can disable the feature in HexClaim settings.

When you save a Claim, the app sends its selected coordinates, date, hex, and Claim type, together with any notes, tags, and information about other people, to the HexClaim server. This applies equally to Claims created from photos.

Claim data remains associated with your account until you delete the Claim or account. After a Claim is deleted, a deletion record containing your user identifier, hex, and deletion time remains until account deletion so that synchronized devices can remove it.

HexClaim does not continuously track your location or record routes.

Aggregate Statistics

We may analyze the association of Claims with hexes in aggregate to further develop HexClaim and operate it on a sustainable commercial basis. Sponsors may receive the total number of Claims in a hex assigned to them. They do not receive user identifiers, content from individual Claims, or movement histories. The legal basis is our legitimate interest in analyzing data using as little data as possible and financing HexClaim (Art. 6(1)(f) GDPR). Deleted Claims are no longer included in updated statistics.

Claims with HexClaim Friends

You can invite a friend using their profile code. They see the Claim and profile data needed for the invitation. If they accept, they receive an independently editable copy of the Claim, including its location, date, type, note, tags, and participations. Photos and the local photo index are not shared.

Later changes to the original Claim do not update the copy. Removing a participation or deleting your Claim or account does not delete another user's copy. Deleting your Claim or account removes your participation from surviving copies.

You can also enter a short label for another person without a HexClaim account. This information comes from the person entering it. We process it on the basis of our legitimate interest in representing the requested participation with minimal personal data (Art. 6(1)(f) GDPR).

Profile Code, QR Code, and Sharing

Your profile code is intended for deliberate sharing with other HexClaim friends. Signed-in users can use it to retrieve your internal user identifier and your display name in order to add you to a Claim. You can change the profile code in the app; old codes will then no longer resolve to your profile. Existing relationships remain unaffected by this.

When you scan a QR code, the camera image is analyzed on your device. HexClaim does not store or transmit the camera image. Only the recognized profile code is sent to the HexClaim server for the profile search.

When you share a profile link, the app passes the link to the app or person selected by you. The respective provider is responsible for further processing by this recipient.

Photos

You can select an individual photo to create a Claim from its location and capture date without granting full library access.

If you enable Photos integration and grant full library access, the app reads photo metadata and builds an account-specific index on your device. It stores photo identifiers, locations, dates, associated hexes, and basic image properties to group photos on the map and display them alongside Claims. The index is updated as your library changes. Photos remain in your Photos library; neither the photos nor the index are uploaded to the HexClaim server.

Turning integration off in HexClaim settings deletes the index. Revoking Photos access stops its use but does not delete it; signing out also leaves it stored. Deleting your account or the app removes the local index without deleting photos from your library.

Viewing photos or Live Photos may download them from iCloud through Apple's Photos services. Only when you save a Claim does the app send the chosen location and date as Claim data, as described above.

Local Data on Your Device

The app keeps account data and downloaded content locally for display and synchronization. Device-only data, such as the photo index and notification history, is handled as described in the relevant sections above.

Signing out leaves local account data stored. Account deletion clears it on the device used for deletion; deleting the app also removes its local data. You control device and iCloud backups through your Apple settings.

The app may write technical diagnostics to your device's system log. Any transmission to Apple depends on your device and privacy settings.

Maps and Apple Services

The app uses Apple MapKit to display maps and Apple's Photos services to access your library and, where needed, download photos from iCloud. Apple may process device, map, and location data for MapKit and the data needed to deliver iCloud photos under its own responsibility.

Further information can be found in Apple's Privacy Policy and the information about “Sign in with Apple”.

Operations, Security, and Logs

For operations, error diagnosis, and protection against misuse, we create technical operations and security logs. These may contain connection, request, account, and resource identifiers, affected hexes, as well as, in the case of security events, IP addresses and information about sign-in attempts. Content such as notes or photos is not deliberately logged for these purposes.

Operations logs are generally deleted after 30 days. Security-relevant logs may be stored for up to 90 days if they are required to investigate a specific security incident.

Hosting and Service Providers

The website, HexClaim server, database, and DNS are operated by IONOS SE in the European Union. IONOS processes the data generated in this context on our behalf.

For operations monitoring and technical logs, we use Better Stack, Inc., a US contracting partner. The telemetry data transmitted by us is stored in a German data region and deleted after 30 days. Access from the United States or other third countries nevertheless cannot be completely ruled out. For transfers to the United States, Better Stack relies, according to its Data Processing Agreement, on its certification under the EU-US Data Privacy Framework. Insofar as this is not applicable or no longer provides a valid basis for transfers, the European Commission's Standard Contractual Clauses apply.

Apple processes data for “Sign in with Apple,” MapKit, Photos and iCloud, and the iOS platform under its own responsibility. For users in the European Economic Area, Apple Distribution International Limited in Ireland is generally responsible. Apple may process data worldwide and particularly in the United States. The data protection safeguards described by Apple apply to these transfers.

We also disclose personal data where this is required by law, necessary for the establishment, exercise, or defense of legal claims, or where you initiate a disclosure. Personal data is not sold.

Storage Period and Backups

We generally store account, profile, and Claim data for as long as your account exists or until you delete individual content. We delete completed contact requests and other data as soon as they are no longer required for their purpose and no statutory retention or documentation obligations prevent deletion.

For restoration after technical failures, we create encrypted backups. These are not used for ongoing product operations and are deleted or overwritten after no more than 180 days. Deleted accounts and content are not made available again as active data during a restoration.

Account Deletion

You can delete your account in the app. When you do so, your account and the active product data associated with it are deleted from the live system. Independent Claim copies already accepted by friends continue to exist; the connection to your account is removed from them.

Time-limited operations and security logs as well as encrypted backups may continue to exist until the periods stated above expire. They are no longer used as active product data.

Deleting the HexClaim account does not automatically end an authorization through “Sign in with Apple.” You can subsequently remove this connection in the settings of your Apple account under “Sign-In & Security” and “Sign in with Apple.”

Contact Requests, Access, and Data Export

If you contact us by email or by another means, we process your contact details and the content of your message in order to handle your request. You can also request access to or an export of your data stored by HexClaim via kontakt@hexclaim.app. Before providing it, we may require appropriate evidence that the request belongs to your account.

Your Data Protection Rights

Subject to the statutory requirements, you have, in particular, the right to:

To exercise your rights, a message to kontakt@hexclaim.app is sufficient. Exercising your rights is generally free of charge.

You also have the right to lodge a complaint with a data protection supervisory authority. In particular, you may contact a supervisory authority at your habitual place of residence, your place of work or the place of the alleged infringement.

Automated Decisions

We do not use your personal data for personalized advertising, user tracking, or automated decisions, including profiling within the meaning of Art. 22 GDPR.

Changes to This Privacy Policy

We update this Privacy Policy when our data processing or legal requirements change. The current version is available on this page.