Privacy Policy
Effective: 27 September 2026
Who we are
Hexology is a geospatial platform that lets people place stories, images, audio and collections into objects, spaces and places for others to discover. It is provided through our free iOS and Android apps, our web app when it is released, and our websites at hexology.co, about.hexology.co and blog.hexology.co (together, the “Services”).
The Services are operated by EoID Ltd, trading as Hexology, a company registered in England and Wales (company number 8555581) with its registered office at 10 Shingle Road, Shoreham-by-Sea, West Sussex BN43 5RH, United Kingdom. EoID Ltd is the data controller for the personal data described in this policy and is registered with the Information Commissioner’s Office (ICO).
This policy explains what personal data we collect, why, who we share it with and what your rights are. A shorter plain-language summary is on our Privacy 101 page. If anything here is unclear, please email hello@hexology.co.
What personal data we collect
Information you give us
- Account details. When you create an account we ask for your name, a @userhandle (your display name) and an email address, which we verify by sending you a confirmation email. You choose a password, which we store in encrypted form.
- Optional public email. You may add a second email address to be shown on your profile so that other people can contact you directly. This is optional and is public if you add it.
- Content you post. Posts, comments, collections, sources, images and any links you include, together with the location you attach the content to. Everything you publish is public.
- Reports. If you report a post, we record that the post was reported so that we can review it.
- Messages to us. Anything you send to hello@hexology.co or through the contact form on about.hexology.co (your name, email address, the reason for contacting us and your message), or by email in reply to a message from us.
- Newsletter sign-up. If you subscribe to our newsletter using the form on our websites, we collect your email address. You receive a confirmation email and are only added to the list if you click the link in it.
Information collected automatically
- Device identifier (browsing without an account). You can use the app to browse content without creating an account. To make this work we assign your device an anonymous identifier. It is not linked to your name or email. If you log out or uninstall the app, anything you collected while browsing anonymously is lost.
- Location. The app asks your device for its precise location while you are using the app. We use it only to show you content that has been placed nearby and, if you post, to let you place your content in the world. We do not store your location, keep a history of where you have been, use background location or track you. The only location we keep is the one you attach to a post, which is part of that public post. You can turn off location access in your device settings; the app cannot show nearby content without it.
- Crash and performance reports. If the app crashes or runs slowly, a report is sent to us so that we can fix the fault. It contains technical information about your device (model, operating system version, app version), the state of the app when the problem occurred, performance measurements such as how long screens took to load, and an installation identifier. It does not contain your name, email or content. We receive these reports through Google Firebase and, if you have opted in on your device, through Apple’s and Google’s own crash reporting.
- Website logs. When you visit our websites, your request passes through Cloudflare, which serves our pages and protects them from attack, and reaches our web host, IONOS. Both record standard server logs: your IP address, browser type, the pages you request and the time. We use these to keep the sites secure and running. To count visits we use Cloudflare Web Analytics, which runs on every page, sets no cookies, stores no personal identifiers and gives us aggregated page-view and performance figures only; it does not track you across sites. Our websites set no cookies for visitors; see our Cookie Policy.
We do not collect your phone number, date of birth, home address, contacts, photos other than those you choose to upload, or any data from social media accounts. We do not offer login through any third-party account.
Why we use your data, and our legal basis
UK data protection law requires us to have a lawful basis for each use of personal data.
| What we do | Data used | Lawful basis |
|---|---|---|
| Create and run your account, verify your email, let you post, comment and build collections, and show your public profile | Account details, content | Performing our contract with you (our Terms of Service) |
| Show you content near you and let you place content | Location (while using the app) | Performing our contract with you; you give the app permission to use location in your device settings |
| Let people browse without an account | Device identifier | Our legitimate interest in providing a free, open service |
| Resize uploaded images and scan them for content that breaches our standards; review reported posts | Content, reports | Our legitimate interest in keeping the Services safe and lawful, and our legal duties as an online service |
| Send you service emails (verification, account and security notices, replies to your requests) | Email address | Performing our contract with you; our legal obligations |
| Fix crashes and faults | Crash reports | Our legitimate interest in maintaining the Services |
| Keep our websites and systems secure, and count visits to them | Website logs | Our legitimate interest in security and in understanding how our sites are used |
| Answer enquiries | Name, email, message | Our legitimate interest in responding to you, or steps towards a contract with you |
| Send you our newsletter | Email address | Your consent, given when you confirm your subscription; you can withdraw it at any time by unsubscribing |
| Respond to legal requests and protect our rights | Any of the above | Legal obligation; legitimate interests |
We do not use your data for advertising, profiling or automated decisions that have legal or similarly significant effects on you. We do not sell personal data.
Content moderation
Every image you upload is checked automatically by an image-recognition service (Amazon Rekognition) for content that breaches our standards. If an image is flagged, the post is not published and is held for review by a member of our team. Any user can report a post from within the app; a reported post is removed from public view immediately and sent for human review, after which it is either restored, kept in quarantine or deleted. Moderation decisions are always reviewed by a person. If your post is removed and you think that was wrong, you can contact us and we will review it.
Our newsletter
Our newsletter is sent through Buttondown. When you subscribe, Buttondown sends you a confirmation email; if you do not click the link in it, you are not added to the list and receive nothing further. Every newsletter has an unsubscribe link, and unsubscribing takes effect immediately. Your email address is used only to send the newsletter and is kept until you unsubscribe, after which it is deleted from the list. We do not add app users to the newsletter; it is sent only to people who have signed up and confirmed. We do not track whether you open the newsletter or which links you click.
Who we share your data with
Everyone. Your name, @userhandle, any public email you add, and everything you post — including the location you attach to it — are public. Anyone using the app or, when released, the web app can see them, and they may be indexed by search engines. Please think before including anything private in a post, and remember that a location attached to a post can reveal where you have been.
Service providers who process data for us. We use a small number of companies to run the Services. They act on our instructions and may not use your data for their own purposes.
- Amazon Web Services (AWS) hosts our platform, database and media storage in its Frankfurt, Germany data centre; provides our authentication system; sends our service emails; and provides the Amazon Rekognition image-scanning service.
- Google. Google Maps draws the map in the app and receives your device’s coordinates to do so; Google Firebase receives crash and performance reports.
- Apple and Google (app stores) distribute the apps and provide their own crash reporting where you have opted in on your device. Their handling of your data is governed by their own policies.
- Cloudflare sits in front of our websites, delivering the pages, protecting them from attack and keeping server logs; its Web Analytics counts visits without cookies or personal identifiers.
- IONOS hosts our websites and keeps their server logs.
- Web3Forms (Web3Creative, India) operates the contact form on about.hexology.co. It receives your name, email address, reason and message, emails them to us at hello@hexology.co and keeps a copy for 7 days before deleting it. Its own hosting is on Amazon Web Services, Cloudflare and Hetzner, and it may pass your IP address and email address to the spam-filtering services CleanTalk and Akismet to check that the submission is not automated.
- Buttondown (Buttondown, LLC, United States) stores the email addresses of newsletter subscribers, sends the confirmation email and the newsletter, and handles unsubscribes.
Others. We may disclose personal data if the law requires it, to respond to a lawful request from a court, regulator or law-enforcement body, to enforce our Terms of Service, or to protect the rights, property or safety of Hexology, our users or others. If Hexology is sold or merges with another business, user data may be transferred to the new owner, who will be bound by this policy.
We do not share your data with advertisers, and we have no advertising partners.
Where your data is stored and international transfers
Our platform and your data are hosted by AWS in Germany. The UK government has recognised the European Economic Area as providing adequate protection for personal data, so transfers between the UK and Germany do not need additional safeguards. Google, Cloudflare and Buttondown may process data on servers outside the UK and EEA, including in the United States; where that happens, the transfer is covered by the UK–US Data Bridge or by standard contractual clauses approved for use in the UK. Web3Forms operates from India and processes contact-form submissions on infrastructure in several regions; those transfers are covered by standard contractual clauses and the UK International Data Transfer Addendum under our data processing agreement with Web3Forms. If you use the Services from outside the UK, your data will be transferred to and processed in the locations above.
How long we keep your data
- Account and content: for as long as your account exists. When you delete your account, your account details and content are removed from the Services immediately and automatically.
- Backups: our systems are backed up; deleted data may persist in backups for a limited period before being overwritten.
- Anonymous device identifiers: until you log out, uninstall the app or clear its data.
- Crash and performance reports: retained by Google Firebase for the period set by Google.
- Website logs: retained by Cloudflare and IONOS for a short period for security purposes. Cloudflare Web Analytics holds only aggregated figures.
- Messages and enquiries: for as long as needed to deal with your enquiry and any follow-up. Contact-form submissions are also held by Web3Forms for 7 days and then deleted.
- Newsletter subscriptions: until you unsubscribe. Sign-ups that are never confirmed are not used.
- Moderation records: we keep a record of removed content and moderation decisions for as long as needed to meet our legal duties and to deal with any dispute.
We may keep data for longer where the law requires it or where it is needed to resolve a dispute.
Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you, and receive a copy of it.
- Download your data. You can request a copy of your account data and content; we prepare this manually and will provide it within 28 days.
- Correct inaccurate data. You can update your account details in the app. Posts and collections cannot be edited once published, but you can delete them and post again.
- Delete your data. You can delete individual posts and collections, or delete your whole account, from within the app. Deletion is immediate.
- Object to processing based on our legitimate interests, and ask us to restrict processing in some circumstances.
- Withdraw consent at any time: location permission in your device settings, and the newsletter through the unsubscribe link in any issue.
- Complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113) if you are unhappy with how we handle your data. We would appreciate the chance to resolve your concern first.
To exercise any of these rights, email hello@hexology.co or use the contact form on about.hexology.co. We may ask you to confirm your identity before acting on a request. We will respond within one month.
Children
You must be at least 13 years old to create a Hexology account. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has created an account, please contact us and we will remove it.
Security
Your data is encrypted in storage and in transit. Access to our systems is restricted, and passwords are stored in a form we cannot read. No system is completely secure, so please choose a strong, unique password and tell us straight away if you think your account has been accessed without your permission.
Cookies
Our websites set no cookies for visitors and use no advertising tools. We count visits using Cloudflare Web Analytics, which sets no cookies, stores no personal identifiers and does not track you across sites. We also use Google Search Console, which tells us how our pages appear in Google Search and places nothing on our pages. Our apps store account and session information on your device so that you stay logged in. Details are in our Cookie Policy.
Links to other sites
Posts may contain links to other websites, and our websites link to services such as LinkedIn, the App Store and Google Play. We are not responsible for the privacy practices of other sites; please read their policies.
Changes to this policy
We will update this policy when our Services or the law change. The current version is always at about.hexology.co/privacy-policy, with its effective date at the top. If we make a significant change, we will tell you in the app or by email before it takes effect.
Contact
Email: hello@hexology.co
Contact form: about.hexology.co
Post: EoID Ltd, 10 Shingle Road, Shoreham-by-Sea, West Sussex BN43 5RH, United Kingdom