Privacy Policy

Last updated: 22 October 2026

The short version. Hexagon is end-to-end encrypted. We cannot read your messages, listen to your calls or see your photos, files, voice notes, group names or shared locations — they are encrypted on your device with keys that never leave it. You sign up without a phone number or e-mail address. We keep the minimum the service needs to deliver encrypted messages, and you can delete all of it from the app at any time.

1. Who is responsible

The controller for the Hexagon service (the Hexagon apps for Android and, when available, iPhone, the website hexagon.pm and the server at api.hexagon.pm) is the operator of Hexagon Private Messenger, postal address available on request at support@hexagon.pm. Contact: support@hexagon.pm.

2. What we cannot see

The contents of everything you send are encrypted on your device with the Signal protocol (X3DH key agreement and the Double Ratchet, XChaCha20-Poly1305) before they reach our server, and can only be decrypted by the recipients' devices. This covers text messages, photos, videos, voice messages, files, shared locations (including live location), group names, your profile picture and voice and video calls (WebRTC, encrypted end-to-end; our server only relays encrypted packets when a direct connection is impossible). Your private keys are stored only on your devices, protected by your password.

3. What our server stores

Data	Why	How long
Your Hexagon ID, the display name you chose, your public keys and one-time pre-keys	So others can find you by ID and start an encrypted conversation	Until you delete your account
Your contact list (the Hexagon IDs you added and the nicknames you gave them), blocks, group memberships	To deliver messages and enforce blocks	Until you remove them or delete your account
Encrypted messages and encrypted media, with their metadata: sender, recipient, time, message type, size, expiry	To deliver messages and let your devices load history	Until you or the sender delete them, a disappearing-message timer expires, or an account involved is deleted
Delivery and read receipts, typing indicators, last-seen time	Features you can switch off per contact or globally	Receipts with their message; typing indicators are overwritten within seconds
Call records: caller, callee, audio/video, start/end time	To set up calls	Deleted about an hour after the call ends
Push token: the Firebase Cloud Messaging registration token or the UnifiedPush endpoint address of each device (up to 10 per account)	To wake the app when a message or call arrives (see section 6)	Until you turn push delivery off, the token is replaced or stops working, or you delete your account
Web app only (not publicly available at the moment): settings you chose, and if you enable passkey/biometric sign-in on the web, a device record with your browser's user-agent	To restore your preferences and recognise your trusted devices	Until you change them or delete your account
Abuse reports you file (reason, your note and, only if you tick the box, the last five messages of that chat as text)	To act on abuse	Until the report is resolved and for up to 12 months after
Records of moderation actions we take on an account (for example a suspension, or a deletion on request): which account, what we did, when, why and which staff member	Accountability for our own actions	This log cannot be altered and is kept as long as the service runs

Reports. If you report someone, your report and the messages you chose to attach are kept for moderation. Reports made against an account are kept for up to 12 months after that account is deleted, so that abuse cannot be erased by deleting the account; reports you made are deleted together with your account.

We do not collect your phone number, e-mail address, address book, advertising ID or precise location, and we do not use analytics, advertising or tracking. Your login is an internal identifier derived from your Hexagon ID, not an e-mail address.

4. Technical logs

Like every internet service, our servers see the IP address of the device connecting to them. We keep as little of it as we can:

Our reverse proxy uses your IP address only in memory, to limit abusive request rates. Its access log records the time, the site, the kind of request, the result, the size and the duration — no IP address and no URL path — and is kept for 7 days.
Its error log records errors only and can contain the IP address of the connection that caused an error; it is kept for 7 days.
The services behind the proxy only receive a shortened address (the first three parts of an IPv4 address, or the /48 network of an IPv6 address). Sign-in events of the authentication service (time, kind of event, your internal account identifier) are stored without an IP address. They are currently not deleted automatically, also not when you delete your account; we are introducing automatic deletion after 30 days and will update this policy when it is in place.
Application logs on the server are size-limited and continuously overwritten. System logs, including error messages of the call relay, are kept for up to 14 days.
The call relay (TURN) sees the IP addresses of the two call parties while relaying encrypted packets; it does not log individual calls.

Logs are used only to operate, secure and debug the service.

5. Where the data is

All our servers are in the European Union, on infrastructure rented from Hostinger: the main server (database, messages, media, website) is in Paris, France; a second call relay (TURN) and the off-site backup copy (section 7) are on a separate server in Germany. We operate these servers ourselves. We do not sell, rent or share your data with anyone. The push services, Google Play and, if you switch maps on, OpenStreetMap receive the limited data described in section 6 under their own terms. We would disclose the limited data in section 3 only where the law requires it; we cannot disclose message contents because we do not have them.

6. Apps and third-party services

Website. hexagon.pm loads no scripts, cookies, third-party code or fonts; everything is served from hexagon.pm.
No trackers. The Android app contains no advertising or analytics SDKs. Calls use the open-source WebRTC library.
QR codes. QR-code scanning uses the open-source ZXing library and runs entirely on your device; camera images never leave it.
Push notifications. To wake the app when something arrives, our server sends a content-free signal through a push service: Firebase Cloud Messaging (Google), or the UnifiedPush distributor you chose. The signal contains no message text, no sender and no name — only "new message" or "incoming call" with an internal call ID. The push service learns the push token and when a wake-up is sent. Notifications themselves are generated on your device after it has fetched and decrypted the message. You can turn push delivery off in Settings → Notifications; the token is then removed from our server.
Maps for shared locations (off by default). A location you receive is shown as coordinates and distance, with no request to any map server. If you switch on Map Tiles for Locations in Settings → Privacy (the setting says what it does before you turn it on), your device loads map images directly from the OpenStreetMap Foundation's tile servers (tile.openstreetmap.org). The OpenStreetMap Foundation then receives your device's IP address and which map area is displayed — which is around the shared location — along with ordinary request data such as the app's user-agent. It processes this under its own privacy policy (osmfoundation.org/wiki/Privacy_Policy); the Foundation is based in the United Kingdom and serves map images through a worldwide content-delivery network. The same applies when you tap Open in OpenStreetMap: your browser or map app then opens openstreetmap.org at that location. Our server is not involved, and the location itself stays end-to-end encrypted.
Google Play. If you get Hexagon from Google Play, Google processes your purchase and the download under Google's terms; we receive only the order information Google provides to app sellers, which we use for accounting and refunds.
Licence keys (direct download). A licence key bought with Bitcoin on pay.hexagon.pm contains no personal data (only a licence number, the product and an issue date) and is checked on your phone without contacting us. Our self-hosted payment server keeps the payment record (amount, time, the Bitcoin or Lightning payment); we ask for no name, e-mail address or account. Licence keys are not linked to your Hexagon ID.

7. Backups

Our server data is backed up every day (since 22 October 2026). Each backup is encrypted on the server to keys that are kept offline by the operator, so the server itself cannot read its own backups. Copies on the server are deleted after 4 days at the latest. An additional copy is stored off-site on a separate server (section 5) in append-only mode: the main server can add backups but cannot change or delete them. Off-site copies are rotated to keep up to 14 daily, 8 weekly and 6 monthly backups, so data you deleted can remain in an encrypted backup for up to about six months before it is gone from all of them. Backups are used only to restore the service after a failure.

Your own encrypted backup files (.hxg) are created on your device and protected by a password only you know; they are not stored on our servers.

8. Your rights

Under the GDPR you have the right to access, correct, delete and port your data, to restrict or object to its processing, and to complain to a supervisory authority. Most of these you can exercise directly in the app: change your display name in Settings → Profile, export an encrypted backup and delete your account in Settings → Backup & Delete (see how deletion works). For anything else write to support@hexagon.pm.

The legal basis for processing is the performance of our contract with you (providing the messenger and, if you buy a licence, the sale, Art. 6(1)(b) GDPR), our legal obligations (for example accounting records of sales, Art. 6(1)(c) GDPR), your consent where you switch on optional features such as maps (Art. 6(1)(a) GDPR — switch them off at any time), and our legitimate interest in operating a secure service (logs, backups and abuse handling, Art. 6(1)(f) GDPR).

9. Children

Hexagon is not directed at children under 16 and you must be at least 16 to use it. Our standards against child sexual abuse and exploitation are described on the child safety page.

10. Changes

If we change this policy we will update the date above and, for material changes, tell you in the app before they take effect.