Privacy Policy

Last updated: 9 October 2026

This page is available in English and Greek. If the two differ, the Greek version prevails.

1. Who is responsible for your data

HexSwan is an independent game studio and a brand name. It is not a company or any other legal entity. It is run by one person, Giorgos Apostolopoulos, who operates HexSwan and the game Starwoven at hexswan.com and is the controller of your personal data, as an individual. HexSwan may become a company in the future. If that happens, this policy will be updated before the change, you will be told, and the company will take over as controller.

For any question about personal data, write to info@hexswan.com. We process personal data in line with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the Greek data protection law 4624/2019 and, for cookies and similar technologies, Greek law 3471/2006.

2. In short

• No advertising, no tracking tools, no analytics and no external scripts or fonts.
• To play as a guest you only need a nickname. Please do not use your real name.
• An account is optional. If you sign in with Google we receive your email, name and profile picture, and we never show your email to other players.
• Games are deleted automatically when nobody plays them (see section 6).
• We do not sell your data and we do not collect payment details.

Minors should participate with the knowledge and appropriate supervision of a parent or legal guardian, who assesses whether the game is suitable for the child. Where required by applicable law, use of online features and processing of personal data require the necessary parental consent. Users and guardians must comply with applicable law. This provision does not limit any rights or liabilities that cannot lawfully be excluded.

3. Who may use the service

You must be at least 13 years old to use HexSwan and Starwoven, and at least 15 to create an account. The service is a general-audience strategy game and is not directed to children under 13. If we learn that a child under 13 has used the service or given us personal data, we will delete it. If you believe this has happened, write to info@hexswan.com.

4. What data we process, why, and on what legal basis (GDPR Art. 6)

• Playing online as a guest: the nickname you type, your game moves, the room title and a random key stored in your browser so you can return to your seat. We use them to run the game you asked for (performance of the service, Art. 6(1)(b) GDPR).
• Account: from Google we receive your email address, name, profile picture and an identifier of your Google account. You also choose a public username (“handle”) and display name, and you may add friends. We use them to run your account, friends, invitations and to let you return to your games from any device (performance of the service, Art. 6(1)(b)). A session cookie keeps you signed in.
• When you write to us: your email address and your message, to reply to you (legitimate interest and answering your request, Art. 6(1)(f)).
• Technical data: to deliver the site securely, our hosting provider (Cloudflare) processes technical connection data such as your IP address and browser type. We do not keep our own IP logs (legitimate interest in security and availability, Art. 6(1)(f)).
• We do not ask for, and do not need, your real name, date of birth, phone number, postal address or payment details.
• Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google data only to sign you in and run your account, never for advertising.
• Features that are not available yet (such as sign-in by email link and turn notifications by email) will be added to this policy before they are launched.

5. Cookies and local storage

Guests are not given cookies. The game stores on your device (in the browser’s local storage) your language, your name, the keys of your rooms, the notices you dismissed and your local autosave. This is necessary for the service to work, and you can delete it in your browser (you then lose access to your seats). If you sign in, we set one strictly necessary session cookie (hs_session) that is HttpOnly and expires after 30 days. Strictly necessary storage does not require consent.

6. How long we keep data

• Game rooms (nickname, moves, title, seat key): deleted automatically when nobody takes part. A lobby that never started: after 7 days. A game in progress: after 60 days. A finished game: 90 days after it ended. Only human activity counts, not bot moves or timers. Deletion is permanent.
• Account: until you delete it. If an account is not used for more than 12 months, we will email you, and if you do not sign in it is deleted automatically 30 days after we send the message.
• Sign-in session: 30 days. Sign-in attempts in progress: 10 minutes.
• Messages to info@hexswan.com: as long as needed to answer you and keep reasonable records, then deleted.

7. Who we share data with

We do not sell personal data. We use providers that process data on our behalf, only to run the service:

• Cloudflare, Inc.: website hosting, network, DNS and the database that stores games and accounts.
• Google: only if you choose to sign in with Google.
• Oracle Cloud: hosts the mail server of info@hexswan.com in Milan, Italy.
• GitHub: stores our source code only, not player data.

Other players see only what is needed for the game: your nickname or display name and, for accounts, your username and picture. We may disclose data if the law requires it or to protect against abuse or security threats.

8. Transfers outside the European Economic Area

Cloudflare and Google are based in the United States and may process data outside the EEA. Such transfers rely on the safeguards required by the GDPR: the EU–US Data Privacy Framework and, as a fallback, the European Commission’s standard contractual clauses, as described in these providers’ own data protection terms.

9. Security

All connections use HTTPS. Sign-in session tokens are stored only in hashed form on our side. Access to the systems is limited to us. No online service is perfectly secure; if a data breach affecting you occurs, we will notify you and the authority as the law requires.

10. Your rights under the GDPR

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to receive your data in a portable format, and to withdraw consent where processing is based on consent. We do not make decisions about you by automated means that have legal effects. Write to info@hexswan.com: we will reply within one month (this period may be extended by up to two further months for complex requests, and we will tell you if so). There is normally no charge. We may ask you to confirm your identity.

Deleting your account: write to info@hexswan.com and we will delete your account and its data, normally within 30 days. A self-service button is planned. Games you took part in remain for other players until they expire, with your name shown as “Deleted player”.

You may also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) or with the authority of your country of residence.

11. Changes to this policy

If our processing changes in a material way (for example a new feature or provider), we will update this page and the date above before the change takes effect, and we will tell account holders by email when the change affects them.

Contact: info@hexswan.com