HexiroPrivacy Policy
Last updated: 2026-10-11
Hexiro is an app for learning to code, made for people aged 13 and up. It is operated by Ol&Yu_2013, Wroclaw, Poland ("we", "us"). We designed it to collect as little as possible, never to show ads, and never to sell or share personal information. This policy explains what we collect, why, and the choices you have.
1. Who can use the app
Hexiro is intended for users aged 13 and older. When you create a profile, the app asks your age in a neutral way. Only the result (13+ or not) is kept on the device; the age itself is never sent to us. If the answer is under 13, the temporary guest account created for that device is deleted immediately and the app cannot be used on that device. If we learn that we hold data of a child under 13, we delete it. Parents who believe this has happened can contact us at support@graphenza.com.
Because some of our users are teenagers, privacy-protective settings are the default for everyone: no public profiles, no real names in the app, no chat, no ads and no profiling for marketing.
2. What we collect
| Data | Source | Why | Legal basis (GDPR) |
|---|---|---|---|
| A random account identifier created on first launch | The device | To save your learning progress and sync it between your devices | Contract |
| Profile: a nickname chosen from generated suggestions (for example "BraveOtter42") and a cartoon avatar | You, from a fixed list | To show progress and the weekly league. Nobody can type a real name in the profile. | Contract |
| Learning activity: answers, lessons completed, XP, streaks, time spent in lessons, achievements | The app | To run the course, adapt difficulty and show your statistics | Contract |
| Code you write in bonus challenges | You | To run it in an isolated sandbox and check the result. Code is only kept as part of the lesson result that proves a challenge was solved. | Contract |
| Questions to Bit, the AI helper: the text of the exercise and your answer | You, only when you tap "Ask Bit" | To explain a mistake. We send only the exercise and your answer — no account identifier, nickname or other personal data — to Anthropic, which generates the explanation. We keep only a daily counter of requests. | Contract |
| Name on a course certificate | You, only if you request a certificate (Premium) | To print it on the certificate. The certificate page is public to anyone who has its link, so you can add it to LinkedIn or a CV. Use initials or a nickname if you prefer. | Contract |
| Email address and password (stored as a secure hash), or a Sign in with Apple / Google identifier | You, only if you create an account | To sign in on several devices, recover the account and send verification codes | Contract |
| Time zone and app language | The device | To count streak days correctly and show the right language | Contract |
| Crash reports and anonymous usage events (for example "lesson finished") | The app | To fix bugs and improve lessons. They contain a random install identifier, the app version and platform, and are not linked to an account. | Legitimate interest |
| Subscription status | Apple / Google through RevenueCat | To unlock Premium. We never receive payment card details. | Contract |
We do not collect precise location, contacts, photos, microphone or camera data, and we do not use advertising identifiers.
3. What we never do
- We do not show advertising and do not use third-party advertising or analytics SDKs.
- We do not sell or share personal information, including "sale" or "sharing" as defined by the CCPA/CPRA.
- We do not offer chat or messaging between users. The weekly league shows only generated nicknames, avatars and XP.
- We do not use personal information to train AI models or to build marketing profiles. Anthropic does not use requests sent by the AI helper to train its models.
4. Service providers
We use a small number of providers that process data only on our instructions: our cloud hosting and database provider (Heroku, operated by Salesforce, in the United States), an email delivery provider (for verification codes), RevenueCat (to confirm App Store / Google Play subscriptions), Anthropic (to generate AI helper explanations, only from the exercise and answer text), and Apple or Google if you choose to sign in with them. They are bound by data processing agreements.
5. How long we keep data
- Account and learning progress: until the account is deleted.
- Certificates: until the account is deleted or you ask us to remove a certificate.
- AI helper requests: not stored by us beyond a daily counter; Anthropic may keep them for a short period for abuse monitoring under its data processing terms.
- Guest accounts that are never used again: deleted after 13 months of inactivity.
- Crash reports: 90 days. Anonymous usage events: 90 days.
- Verification codes: expire after 15 minutes and are erased within a day.
6. Your rights and choices
You can at any time:
- download all data we hold about you (Profile → Account & data → Download my data);
- delete a profile, or delete the whole account and all related data immediately (Account & data → Delete account), or on the web at /delete-account;
- turn off the weekly league or reminders, or set your own daily time limit;
- contact us at support@graphenza.com to access, correct, delete or port your information, or to object to processing.
Depending on where you live, you have rights under laws such as the GDPR (EU), the UK GDPR and the Age Appropriate Design Code (UK), the CCPA/CPRA and other US state privacy laws, or PIPEDA and Quebec Law 25 (Canada), including the right to complain to your data protection authority. We do not discriminate against anyone for exercising these rights.
7. Security
All traffic is encrypted (HTTPS). Passwords are stored as salted Argon2 hashes. Sessions use short-lived tokens. Code from bonus challenges runs in an isolated sandbox without access to the internet or our systems. Access to our admin tools requires individual accounts with two-factor authentication and is logged.
8. International transfers
Our servers and database are located in the United States, and our other providers may also process data there. If you are in the European Economic Area, the United Kingdom or Switzerland, these transfers are protected by the European Commission's standard contractual clauses (and the UK addendum) in our providers' data processing agreements, or by the EU–US Data Privacy Framework where a provider is certified under it.
9. Changes
If we change this policy in a meaningful way, we will tell you in the app before the change takes effect.
10. Contact
Ol&Yu_2013, Wroclaw, Poland — support@graphenza.com