Privacy Policy

Effective from August 15, 2026

This Privacy Policy applies to the hexclaim.app website, the HexClaim app, and the associated online services.

Key Points at a Glance

Controller and Contact

The controller responsible for the processing of personal data is:

Jonathan Hasenburg, sole proprietorship

c/o IP-Management #11174, Ludwig-Erhard-Str. 18, 20459 Hamburg, Germany

Email: kontakt@hexclaim.app

Telephone: +49 156 79819237

You can find further information in the Legal Notice.

Use from the Age of 18

HexClaim is intended exclusively for adults. We do not perform identity or age verification.

Legal Bases

We process the data required for the account, app, and product functions in order to provide HexClaim and thereby perform the user agreement pursuant to Art. 6(1)(b) GDPR.

We process technical log data on the basis of our legitimate interest in operating HexClaim securely, stably, and protected against misuse (Art. 6(1)(f) GDPR).

Where we require data to comply with legal obligations, Art. 6(1)(c) GDPR is the legal basis.

Required and Voluntary Information

For an account, we require a guest or Apple identifier and a display name. This information is generated by the app, transmitted by Apple, or provided by you. For a Claim, we require a location; the app or our backend generates the Claim time unless you select a different permitted time. Without this information, we cannot provide the account or the respective Claim function.

Notes, tags, participations, short labels, and the selection of a photo are voluntary. Connecting with Apple is initially voluntary. Without it, the number of new Claims for a guest account is limited, and the account cannot be restored on another device.

Visiting the Website

When you visit our website, our server processes technically necessary connection and log data. This includes, in particular, your IP address, the time and destination of the request, and technical information for processing the request.

This processing is necessary to deliver the website and to detect errors and abusive access. The website does not use cookies and uses neither Local Storage nor comparable browser storage for analytics or advertising purposes. Technically necessary files may be stored temporarily in the browser cache. We do not integrate externally hosted fonts, analytics tools, or advertising services.

Account and Sign-In

For a HexClaim account, we process an internal user identifier, your display name, a shareable profile code, and information about the creation and modification of the account.

You can initially use HexClaim with a guest identifier generated on your device. This identifier is used to recognize your guest account. If you connect your account with Apple, we process the unique user identifier transmitted by Apple. Depending on your selection with Apple, we may also receive your name and email address or a relay address generated by Apple.

To verify and secure sign-in, we process the sign-in and session data required for this purpose. We do not permanently store the identity token transmitted by Apple. The Apple identifier connected with the account and the profile information transmitted by Apple remain stored until the account is deleted.

The app stores the identifiers and session keys required for sign-in securely on your device.

Location and Claims

HexClaim requests your location only when you use a corresponding function in the app, for example, to display your current hexagonal map cell or to create a Claim. For this purpose, the app uses the iOS “While Using the App” permission. Continuous background location tracking does not take place.

For the mere display of your current position, the location is used only for the current operation on your device. When you save a Claim, the app transmits the latitude and longitude selected by you, the Claim time, and the hexagonal map cell determined from them to our backend. You can also save a note, tags, and participations together with the Claim.

This Claim data remains associated with your account until you delete the Claim or your account. HexClaim does not create routes or a continuous movement profile from your locations.

Aggregate Statistics

We may analyze the association of Claims with map cells in aggregate to further develop HexClaim and operate it on a sustainable commercial basis. Sponsors may receive the total number of Claims in a map cell assigned to them. They do not receive user identifiers, content from individual Claims, or movement histories. The legal basis is our legitimate interest in analyzing data using as little data as possible and financing HexClaim (Art. 6(1)(f) GDPR). Deleted Claims are no longer included in updated statistics.

Claims with HexClaim Friends

You can invite another HexClaim user to a Claim using their profile code. The invited user sees the Claim and profile data required for the invitation. If the user accepts the invitation, they receive their own copy of the Claim, including the location, time, note, tags, and the participation context existing at that time.

The copy then belongs to the accepting user's account and can be edited independently. Subsequent changes to the original Claim are not automatically applied to the copy. If you remove a participation, a copy that has already been created continues to exist. If you delete your original Claim or your account, your participation is removed from the remaining copies; however, the independent copies of the other users continue to exist.

Instead of a HexClaim account, a freely chosen short label can also be stored for a Claim. No separate profile or complete personal data record is created for this purpose.

Insofar as a short label makes a connection to another person recognizable, it originates from the user who enters it. We process it on the basis of our legitimate interest in representing the participation context requested by the user with as little data as possible (Art. 6(1)(f) GDPR).

Profile Code, QR Scanner, and Sharing

Your profile code is intended for deliberate sharing with other HexClaim users. Signed-in users can use it to retrieve your internal user identifier and your display name in order to add you to a Claim. You can change the profile code in the app; old codes will then no longer resolve to your profile. Existing relationships remain unaffected by this.

When you scan a QR code, the camera image is analyzed on your device. HexClaim does not store or transmit the camera image. Only the recognized profile code is sent to our backend for the profile search.

When you share a profile link, the app passes the link to the app or person selected by you. The respective provider is responsible for further processing by this recipient.

Claim from a Photo

When you select a photo, the app reads its location and capture time on your device. The photo itself is not transmitted to HexClaim and is not stored by us. Only when you save a Claim from it do we process the adopted location and time like other Claim data.

Local Data on Your Device

The app stores account data and previously retrieved content locally on your device so that they can be displayed and synchronized with our backend.

A normal sign-out does not delete the locally stored data. The local account data remains until the account or the app is deleted. Device and iCloud backups are managed by you through the settings of your Apple device and are your responsibility.

The app may leave technical diagnostic information in your device's system log. Any transmission of diagnostic data to Apple is governed by your device and privacy settings.

Maps and Apple Services

The map display uses Apple MapKit. In this process, technically necessary device, map, and location data may be processed by Apple. For users in the European Economic Area, Apple services are generally provided by Apple Distribution International Limited in Ireland. Processing by Apple or affiliated companies outside the European Economic Area, particularly in the United States, cannot be ruled out.

Further information can be found in Apple's Privacy Policy and the information about “Sign in with Apple”.

Operations, Security, and Logs

For operations, error diagnosis, and protection against misuse, we create technical operations and security logs. These may contain connection, request, account, and resource identifiers as well as, in the case of security events, IP addresses and information about sign-in attempts. Content such as notes or photos is not deliberately logged for these purposes.

Operations logs are generally deleted after 30 days. Security-relevant logs may be stored for up to 90 days if they are required to investigate a specific security incident.

Hosting and Service Providers

The website, backend, database, and DNS are operated by IONOS SE in the European Union. IONOS processes the data generated in this context on our behalf.

For operations monitoring and technical logs, we use Better Stack, Inc., a US contracting partner. The telemetry data transmitted by us is stored in a German data region and deleted after 30 days. Access from the United States or other third countries nevertheless cannot be completely ruled out. For transfers to the United States, Better Stack relies, according to its Data Processing Agreement, on its certification under the EU-US Data Privacy Framework. Insofar as this is not applicable or no longer provides a valid basis for transfers, the European Commission's Standard Contractual Clauses apply.

Apple processes data for “Sign in with Apple,” MapKit, and the iOS platform under its own responsibility. For users in the European Economic Area, Apple Distribution International Limited in Ireland is generally responsible. Apple may process data worldwide and particularly in the United States. The data protection safeguards described by Apple apply to these transfers.

We also disclose personal data where this is required by law, necessary for the establishment, exercise, or defense of legal claims, or where you initiate a disclosure. Personal data is not sold.

Storage Period and Backups

We generally store account, profile, and Claim data for as long as your account exists or until you delete individual content. We delete completed contact requests and other data as soon as they are no longer required for their purpose and no statutory retention or documentation obligations prevent deletion.

For restoration after technical failures, we create encrypted backups. These are not used for ongoing product operations and are deleted or overwritten after no more than 180 days. Deleted accounts and content are not made available again as active data during a restoration.

Account Deletion

You can delete your account in the app. When you do so, your account and the active product data associated with it are deleted from the live system. Independent Claim copies already accepted by friends continue to exist; the connection to your account is removed from them.

Time-limited operations and security logs as well as encrypted backups may continue to exist until the periods stated above expire. They are no longer used as active product data.

Deleting the HexClaim account does not automatically end an authorization through “Sign in with Apple.” You can subsequently remove this connection in the settings of your Apple account under “Sign-In & Security” and “Sign in with Apple.”

Contact Requests, Access, and Data Export

If you contact us by email or by another means, we process your contact details and the content of your message in order to handle your request. You can also request access to or an export of your data stored by HexClaim via kontakt@hexclaim.app. Before providing it, we may require appropriate evidence that the request belongs to your account.

Your Data Protection Rights

Subject to the statutory requirements, you have, in particular, the right to:

To exercise your rights, a message to kontakt@hexclaim.app is sufficient. Exercising your rights is generally free of charge.

You also have the right to lodge a complaint with a data protection supervisory authority. In particular, you may contact a supervisory authority at your habitual place of residence, your place of work or the place of the alleged infringement.

Automated Decisions

We do not use your personal data for personalized advertising, user tracking, or automated decisions, including profiling within the meaning of Art. 22 GDPR.

Changes to This Privacy Policy

This is the first version of the Privacy Policy. We update it if HexClaim, the service providers used, or legal requirements change materially. The current version is available on this page.