Privacy Policy
Effective October 13, 2026 · HexoQuest v10.005
1. Who we are
HexoQuest is operated by BOREA IT, Računalniške rešitve, d.o.o., Budanje 6G, 5271 Vipava, Slovenia, registration no. 9923802000, VAT ID SI64114317 (“we”, “us”). Contact: info@hexoquest.com.
When a school or other organization uses HexoQuest for its students, the school is the controller of its students' data and we act as its processor (see For schools).
2. What data we process
Guests (no login)
We do not store data about guests on our server. Progress (stars and blocks) is saved only in your browser's local storage and never leaves your device.
Students in a class or family group
- a nickname chosen by the student (not their real name),
- a 4-digit PIN, stored only as a one-way hash,
- the class or family group they joined,
- progress in the levels (stars, blocks) and the web pages they build,
- the date they joined and were last active.
We do not collect students' names, email addresses, dates of birth, photos or location, and we remind kids not to put personal details into nicknames or their work.
Players with their own account
A nickname, a password and a recovery code (both stored only as hashes), progress and work, and the dates of creation and last activity. No email or contact details. Players with their own account can play the free levels only.
Level ratings and usage statistics
After a level, users can optionally rate difficulty and fun (1–5) and leave a comment. We also record when a level was opened or solved and with how many stars, together with a random session identifier (no IP address). For logged-in users this is linked to the account so that their teacher or parent can see it. We keep these records for 2 years and use them to improve the levels.
Duels and the public leaderboard
In a duel we store both nicknames, the answers, points and times and a random session identifier, and for logged-in players also a link to their account (to count wins on their profile). Unfinished duels are deleted after one day and finished duels after one year. A nickname a guest enters for a duel is only stored in that game.
The public leaderboard shows the nickname and number of stars of independent players who have not hidden themselves in their account settings, and of students whose teacher or parent turned the leaderboard on for their group. Guests are never listed. The leaderboard shows no other data.
The “What does your browser know” page and the flag hunt work entirely in your browser. Nothing they show is stored or sent to us.
Teachers and parents (account holders)
- name, email address, school or organization, account type (teacher or parent),
- password, stored only as a hash,
- classes or family groups you create, dates of registration and last login,
- your plan: type, number of seats, status and validity, and your Paddle customer and subscription IDs.
Payments
Payments are handled by Paddle.com Market Limited (and its affiliates), our reseller and Merchant of Record. Paddle collects your payment details, billing address and tax information as an independent controller under its own privacy policy. We never see or store your full card number. Paddle tells us the status of your subscription so we can unlock your plan. The payment page is the only page of HexoQuest that loads content from Paddle's servers.
Technical data
- Session cookie (
hq_session) to keep you logged in. Deleted when you close the browser. - Abuse protection: for login attempts we store, for at most 24 hours, a hash computed from the IP address. The IP address cannot be recovered from it.
- Server logs: our web server records the IP address, time and requested page. We keep logs for at most 30 days for security and troubleshooting.
- Anonymous visit statistics on our own server: page, day and hour, device type and referring website. To count visitors we compute a hash from the IP address, browser and a random value that changes every day; we do not store the IP address and cannot identify you. No cookies. Kept for 13 months.
We respect “Do Not Track” and “Global Privacy Control”. You can also turn statistics off here:
3. Purposes and legal bases (GDPR / UK GDPR)
| Purpose | Legal basis |
|---|---|
| Teacher and parent accounts, classes, plans and subscriptions | performance of a contract (Art. 6(1)(b)) |
| Student progress when a school uses HexoQuest | the school's legal basis as controller; we process on its instructions (Art. 28) |
| Student progress in a family group | performance of the contract with the parent (Art. 6(1)(b)) |
| Player accounts, ratings, usage statistics | legitimate interest in providing and improving the service with minimal data (Art. 6(1)(f)) |
| Security, abuse prevention, logs | legitimate interest (Art. 6(1)(f)) |
| Accounting and tax records | legal obligation (Art. 6(1)(c)) |
4. Children's privacy (including COPPA)
HexoQuest is designed for children, so we collect as little as possible. We do not ask children for any contact information, do not show ads, do not use third-party tracking and do not allow children to communicate with each other or with strangers. Accounts that are needed to unlock all content are created by adults (teachers or parents). In the United States, schools may consent on behalf of parents for the use of HexoQuest in the classroom; parents can review or delete their child's data at any time by contacting their teacher or us at info@hexoquest.com.
5. How long we keep data
- Students: until the teacher or parent deletes them, their class or the account, or automatically after 365 days of inactivity.
- Players with their own account: until they delete the account, or after 365 days of inactivity.
- Teachers and parents: until they delete their account, or after 3 years of inactivity. Records of purchases are kept as required by tax law.
- Duels: unfinished 1 day, finished 1 year. Usage statistics: 2 years. Anonymous visit statistics: 13 months. Abuse protection: 24 hours. Server logs: up to 30 days. Backups: up to 30 days.
6. Who has access
A student's progress and work are visible to the teacher or parent who created the class or family group, and to us as the operator. We do not sell data, use it for advertising or share it with third parties, except: our hosting provider [DOPOLNI: hosting provider and country, e.g. Hetzner Online GmbH, Germany] (processor), and Paddle for payments (see above). Learning data is stored in the European Union. Paddle may process payment data outside the EEA under appropriate safeguards.
7. Security
All connections use HTTPS. Passwords and PINs are stored only as hashes. The database is not accessible from the web. Login attempts are rate limited. The pages kids use load no content from other servers.
8. Your rights
You have the right to access, rectify, erase, restrict and port your data and to object to processing. Teachers and parents can export and delete their data themselves in their account settings. Students and their parents can contact the teacher or us at info@hexoquest.com. We reply within one month.
You can lodge a complaint with a supervisory authority, for example the Information Commissioner of the Republic of Slovenia (ip-rs.si), the UK ICO, or the authority in your country.
9. Changes
We will notify account holders by email about significant changes. The date of the latest change is shown at the top of this page.