This Privacy Policy describes how HeliDev88 ("we", "our", or "us") collects, uses, and protects your information when you use the HexForge mobile application (the "App").

1. Information We Collect

1.1 Account Information

When you register an account, we collect:

• Username – your chosen display name
• Email address – used for account identification and communications
• Password – stored securely as a hashed value (never in plain text)

1.2 Google Sign-In (Optional)

If you choose to sign in with Google, we receive:

• Your Google account ID (used only to link your account)
• Your email address

We do not receive access to your Google contacts, Drive, or any other Google services.

1.3 Two-Factor Authentication (Optional)

If you enable 2FA, we store a TOTP secret key on our server, used solely to verify one-time codes from your authenticator app. You can disable 2FA at any time from your Profile screen.

1.4 Game & Score Data

We store game state (tile configurations, town resources, turn history), Skirmish and Arena game state, and your score history. This is necessary for the app to function and is linked to your account.

1.5 Authentication Tokens

After login, a JWT access token and refresh token are stored locally on your device using encrypted AsyncStorage. These are not shared with third parties.

1.6 Push Notification Token (Optional)

If you grant notification permission, we collect an Expo push token — a device identifier used solely to deliver in-app notifications such as game alerts or friend requests. This token is stored on our server linked to your account. You can revoke notification permission at any time through your device settings.

1.7 Social & Friends Data

If you use the Friends feature:

• Your username may be visible to other users who search for you or send a friend request
• If your profile is set to public, your bio and avatar (if set) are visible to other HexForge users
• Friend connections (accepted requests) are stored on our server

You control your profile visibility from the Profile screen.

2. How We Use Your Information

We use your information exclusively to:

• Create and manage your account
• Save and restore your game progress
• Display leaderboards and high scores
• Verify your identity when logging in (including 2FA)
• Deliver push notifications you have opted in to receive
• Enable social features (friends, public profiles) if you choose to use them
• Process in-app purchases via Google Play
• Maintain and improve the App

3. Data Storage & Security

Your data is stored on secure servers hosted by Railway (railway.app). We apply the following measures:

• Passwords are hashed using Django's built-in PBKDF2 algorithm
• All communication is encrypted via HTTPS
• JWT tokens have limited lifetimes and are refreshed automatically

4. Data Retention

We retain your account and game data for as long as your account is active. You may request deletion at any time by contacting us (see Section 9).

5. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Right of access – request a copy of the data we hold
• Right to rectification – request correction of inaccurate data
• Right to erasure – "right to be forgotten"
• Right to restriction – limit how we process your data
• Right to data portability – receive your data in a machine-readable format
• Right to object – object to our processing of your personal data

Contact us at helidev88@gmail.com. We will respond within 30 days.

6. Push Notifications

HexForge may send you push notifications (e.g. when a friend sends you a request, or when it is your turn in a game) via Expo Push Notifications (Expo Inc.). Your push token may be transmitted through Expo's infrastructure. Expo's privacy policy is available at expo.dev/privacy.

You can opt out of notifications at any time through your device's notification settings. This does not affect your ability to use the App.

7. In-App Purchases

HexForge offers a one-time optional in-app purchase — "Support HexForge" — which permanently removes future advertisements. This purchase is processed entirely by Google Play (Google LLC).

We do not receive or store your payment card details. Google's privacy policy applies to payment processing: policies.google.com/privacy.

8. Children's Privacy

HexForge is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

9. Contact Us

If you have any questions about this Privacy Policy:

• Email: helidev88@gmail.com
• Website: foxdemon696.github.io/Hexagod

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top. Continued use of the App after changes constitutes acceptance of the updated policy.

HexForge is developed and maintained by HeliDev88.