Privacy policy
Hex is a Discord bot. This page explains what it stores about you, why, for how long, who else sees it, and how to see or delete all of it yourself in under a minute.
The short version
- Hex counts your messages. It never stores what they say.
- It keeps things you deliberately give it: deals, RSS feeds, feedback, events.
- No ads, no tracking, no analytics on this website, and nothing is sold.
- Run
/privacyin Discord, or use the My data page, to download or delete everything.
1. Who is responsible
The controller of personal data processed by Hex is the operator of this Hex instance. You can reach them at tfourk@gmail.com, or with /feedback in any server that uses Hex.
Each Discord server that adds Hex chooses which Hex features run there. Discord itself is responsible for your Discord account.
2. What Hex stores about you
Hex only keeps data tied to your account in the places below. Every one of them is included when you download or delete your data.
| Data | What exactly | Why | Legal basis (GDPR Art. 6) | How long |
|---|---|---|---|---|
| Message statistics | For each server, channel and day: how many messages you sent and how many words, characters, lines, links, attachments, mentions and replies they contained. Your username and display name are stored with the totals. The text of your messages is never stored. | Server activity statistics and leaderboards (/stats) and the anonymous network totals on the public stats page. | Legitimate interests | Until you delete them, stop collection, or the server removes Hex. |
| Deals | Deals you post with /deals: title, price, merchant, description, links, your name and the preview image Hex draws. | Showing and searching deals in the server. | Performing the request you made | Until you or a server moderator delete the deal. |
| RSS feeds | Feeds you subscribe a channel to, with your name as the person who added it. | Posting new items to that channel. | Performing the request you made | While the feed exists. On request your name is removed and the feed keeps running for the server. |
| Feedback | Messages and files you send with /feedback, your name, and the server and channel it came from. | Answering you and improving Hex. | Legitimate interests | Until the operator deletes it or you delete it. |
| Moderation records | When a server's AutoMod rules catch a message: which rule, the action taken, your name and ID. The message text is not kept. | Letting server staff enforce their rules and escalate repeat offences. | Legitimate interests (the safety of the community) | Cases are deleted after 90 days; strikes when they expire. |
| Events | Events you create or respond to with Hex, and reminders tied to your account. | Running the event, sending reminders and showing who is attending. | Performing the request you made | Until the event is deleted, or you delete your data. |
| Linked AI accounts | If you link your own AI provider account with /aikey (or on Hex's AI accounts web page), or a server admin links one for a server: the provider, the model, a few characters of the key (a hint so you can recognise it), an encrypted copy of the API key or token, the server address for a custom provider, who linked it and when, and when it was last used and its last error. For each day: how many AI chat requests you made and which account paid for them (yours, the server's, or Hex's free allowance). The key itself is never shown or included in downloads. | Sending your (or the server's) AI chat requests to the provider that was chosen and paying for them with that account, and keeping to daily allowances. | Performing the request you made (your consent when you link an account) | Until the account is removed: by you, by a server admin for a server account, or by the operator. Daily usage counts are deleted after 90 days, or straight away when you delete your data. When you delete your data, a server account you linked stays with the server but your ID is removed from it. |
| Operational logs | Admin audit log entries (for example a moderator pardoning you) and a short in-memory buffer of recent log lines that can include your account ID. | Security, troubleshooting and accountability for admin actions. | Legitimate interests | The in-memory buffer is lost on restart; the audit log rotates by size. Your ID is replaced with [erased] when you delete your data. |
| Privacy requests | If you ask Hex to stop collecting, your numeric account ID. For each deletion, a receipt number, the time, and a one-way keyed hash of your ID (not the ID itself). | Honouring your choice and proving a deletion happened. | Legal obligation | The opt-out lasts until you reverse it. Receipts are kept to prove deletions were carried out. |
"Legitimate interests" means Hex needs the data to provide a feature the server asked for, and it has weighed that against your privacy: statistics never include message text, and you can switch them off for yourself at any time.
3. What Hex does not store
- The text of ordinary messages. Only counts are kept.
- Voice notes and downloaded videos. They are held in a temporary folder while being processed and deleted straight after.
- Your email address, IP address, phone number or payment details. Hex never receives them from Discord.
4. Who else receives data
Hex does not sell or rent data, and does not share it for advertising. To make some features work it sends data to these services:
- Discord delivers every message and command. Discord is its own controller for your account; see Discord's privacy policy.
- Google (Gemini) receives messages you address to Hex's AI chat, and images you ask it to look at, so it can write a reply.
- The AI provider you or your server chose: when a member or a server links its own AI account, that person's AI chat messages (and images they ask about) go to that provider (OpenAI, Anthropic, Google, or the custom server address that was entered) instead, under that provider's own terms and privacy policy. Hex's owner does not control those providers.
- OpenAI receives the audio of voice notes posted where transcription is on. The audio is deleted from Hex as soon as the transcript is posted.
- Xweather receives the place name you type into weather and radar commands. Not who asked.
- Link preview services (third-party Instagram, X and Facebook preview sites) receive the public post links Hex rewrites, so Discord can show a preview. Your identity is not sent.
- Rotten Tomatoes receives the movie or show title you look up with /rt or !rt, or the rottentomatoes.com link you posted, so Hex can show the scores. Not who asked. When Rotten Tomatoes cannot be read directly, the same public link may be sent to a text-render service (the reader address in Hex's settings) and, if the owner set an OMDb key, the title to OMDb.
- Google reCAPTCHA protects the admin login page only. Public pages do not load it.
5. This website and cookies
- No analytics, advertising, tracking pixels, third-party fonts or scripts. Every file comes from this server.
- The public stats page shows totals only: no names, message text, channel names or IDs.
- The web server does not keep access logs. Your IP address is used only in memory, for a few minutes, to slow down password guessing and abuse. Failed and successful admin logins are the exception: they are written to the admin audit log with the IP address, to protect the admin panel.
- Cookies are set only when you sign in, and only because the page cannot work without them, so no consent banner is needed:
hex_privacy: keeps you signed in to the My data page for up to 20 minutes.hex_privacy_state: protects the "Sign in with Discord" step; lasts 10 minutes.hex_admin_session: for Hex administrators only.
6. Your rights
If you are in the EU, the EEA or the UK, the GDPR gives you these rights. Hex offers them to everyone.
- Access and portability: download a copy of all your data as a ZIP with a machine-readable JSON file.
- Erasure: delete your data. Moderation records are the one exception: they stay until they expire (cases after 90 days) so that a person cannot wipe a rule-break record and start over. They are included in your download, and you can object to them through the contact above.
- Objection and restriction: tell Hex to stop counting your messages. Only your account ID is kept, so the choice sticks.
- Rectification: Hex copies your name from Discord, so it corrects itself the next time you post after changing it there.
- Complaint: you can complain to your local data protection authority.
7. How to use them
- In any server with Hex (or in a direct message to Hex), run
/privacy. Only you see the reply. - Download or delete right there, or press Open privacy portal to do it on this website. The link works once and expires after 10 minutes.
- Not in a server with Hex any more? Use Sign in with Discord on the My data page, or use the contact in section 1.
Downloads and deletions happen immediately. Requests sent to the contact are answered within one month. Before acting, Hex always confirms you own the account through Discord; nobody can delete your data by knowing your ID.
8. Where data is kept
Discord and some of the services in section 4 are based in the United States. Where data leaves the EU/EEA, those providers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
9. Server owners
Server managers can switch any Hex command off with /commands, and remove their server from the public network totals with
/stats network-disable. Removing Hex from a server stops all collection there.
10. Changes
If this policy changes, the date at the top changes too. Significant changes will be announced where Hex posts its updates.