Privacy policy
English translation for convenience. The German version (Datenschutzerklärung) is the legally binding one.
As of: October 2026
Controller
Stefan Mendel
Laimburggasse 31/8
8010 Graz, Austria
Email: admin@hexquiz.com
No data protection officer has been appointed; the conditions of Art. 37 GDPR are not met.
Principle
This website is purely informational. It sets no cookies, stores nothing in your browser's local storage (localStorage, sessionStorage) and loads no content from third parties. Fonts, images and program code are served exclusively from our own server. There is no web analytics, no audience measurement and no tracking. Consent is therefore not required, and no cookie banner is shown to you.
Visiting the website
When you open the site, your IP address is transmitted to the server as a technical necessity — without it no connection can be made and the page cannot be delivered.
The web server keeps no access log. IP addresses, pages visited, referring pages and browser identifiers are not stored. Only the server's own operational messages are recorded, such as start-ups and certificate renewals; these contain no visitor data.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the technical operation and security of the website.
Hosting
Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany.
Server location: Nuremberg data centre, Germany. Processing takes place exclusively within
the European Union.
Hetzner is a processor within the meaning of Art. 28 GDPR; a data processing agreement has been concluded. In operating its infrastructure, Hetzner may process connection data for security and defence purposes; details are in Hetzner's privacy policy.
Domain and DNS
The domain is managed through Cloudflare, Inc., which also provides the DNS records. It is operated in "DNS only" mode: Cloudflare does not act as a proxy, this website's traffic does not pass through Cloudflare, and Cloudflare therefore receives neither page views nor visitors' IP addresses. Cloudflare only answers DNS queries, which usually come from your internet provider's name servers rather than directly from your device.
Contact by email
If you write to admin@hexquiz.com, we process your email address and the content of your message in order to answer your enquiry.
The email service is operated through Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Processing by Google LLC in the USA cannot be ruled out; Google bases such transfers on Standard Contractual Clauses and the EU-US Data Privacy Framework.
Legal basis: Art. 6(1)(b) GDPR where the enquiry serves to prepare or perform a contract,
otherwise Art. 6(1)(f) GDPR.
Retention: for as long as is necessary to handle your enquiry, and beyond that within the
scope of statutory retention obligations.
HexQuiz app: game history and feedback
The HexQuiz app sends data to our server (api.hexquiz.com, also hosted by Hetzner in Nuremberg) so that we can improve the questions and the game. There is no user account, no sign-in and no email address asked for. The following is processed:
- Player ID: a random identifier (HQ-XXXX-…) that the app creates on your device when it first starts, plus a secret key that lets only your device send data under that ID; the server stores only a check value (hash) of the key. The ID is shown in the player settings. It identifies the installation, not a person, and contains no device or advertising identifier.
- Player name: the name you enter in the player settings. It does not have to be your real name. It is visible only to the operator, not to other players.
- Game history: for every completed round the time, game mode, difficulty, language and chosen subject area, and for each question the question, your answer, the time taken, the points scored and the hints used.
- Feedback you choose to give in the app: ratings, ticked statements and your comments, together with the technical details needed to put them in context, such as app version, platform, screen size, language, some game settings, an identifier of the play session and the number of rounds played and trophies won.
The data is sent encrypted (HTTPS). Your IP address is necessarily transmitted, but it is not stored; it is held briefly in memory only to limit the number of requests per address (protection against abuse).
Purpose: we analyse the data to find out which questions and question types are too hard, too easy or wrong, and to handle your feedback. For this the operator can view the game history and feedback of individual player IDs. The data is not sold, not passed on to third parties and not used for advertising.
Legal basis: Art. 6(1)(f) GDPR — legitimate interest in improving the game and its
content.
Retention: until you ask for deletion. Feedback you withdraw in the app is also deleted on
the server at the next sync. Database backups are kept for at most 14 days.
For access, deletion or objection, please write to admin@hexquiz.com and include your player ID — without it we cannot find your data.
Mailing list and beta test
On the beta test page you can sign up for the HexQuiz mailing list and say that you would like to test the app before release. The following is processed:
- Name and email address;
- for the beta test, the platform you choose (iOS, Android or both);
- for Android, the email address of your Google account — Google Play invites testers only by their Google account;
- the language of the page you signed up on, the times of sign-up and confirmation, and the version of the consent text you ticked — as proof of your consent.
The details are sent encrypted to our server (api.hexquiz.com, Hetzner, Nuremberg) and stored there. Your IP address is not stored; it is held briefly in memory only to limit the number of requests per address.
Confirmation (double opt-in): after you send the form you receive an email with a confirmation link. Only once you confirm are you on the list. A sign-up that is not confirmed within seven days is deleted.
Purpose: we email you HexQuiz news and, if you signed up for it, the invite to the beta test. For the invite itself we enter your email address with Apple (TestFlight, Apple Distribution International Ltd., Cork, Ireland) or your Google account's address with Google (Google Play Console, Google Ireland Limited, Dublin, Ireland) — the app can only be tested before release through these services. Apple's or Google's privacy terms also apply there.
Sending: the emails are sent through Brevo (Sendinblue SAS, Paris, France), which acts as a processor within the meaning of Art. 28 GDPR. For this Brevo receives your email address and the content of the email in question; the sign-up list itself is kept on our server only. Brevo counts how often the emails are opened and links in them are clicked anonymously only: these figures are not tied to any individual recipient, and we do not analyse them. For this, links in the emails pass briefly through a Brevo server that forwards you to the actual page; when you open an email or click a link, Brevo therefore technically receives your IP address.
Legal basis: Art. 6(1)(a) GDPR — your consent. You can withdraw it at any time with effect
for the future: with the unsubscribe link in every email, or by writing to
admin@hexquiz.com. Your sign-up is then
deleted.
Retention: until you unsubscribe. Database backups are kept for at most 14 days.
No automated decision-making
No automated decision-making, including profiling, takes place.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). To exercise them, contact admin@hexquiz.com.
If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority:
Österreichische Datenschutzbehörde (Austrian Data Protection Authority)
Barichgasse 40–42, 1030 Vienna
Email: dsb@dsb.gv.at
www.dsb.gv.at
Future changes
This policy describes the current state of the website and the app. If user accounts (such as signing in with Apple or Google), multiplayer features or advertising are added, it will be updated beforehand.