Privacy Policy

Most of HexKey works without signing in. Vercel Web Analytics counts page views, referrers and device types, and Vercel Speed Insights measures how fast pages load. Neither uses cookies.

To count the ascension tour, we save an anonymous event when you start, progress, finish or dismiss it, along with your browser’s user agent and the page that sent you here. There is no identifier, so events can’t be linked to you or to each other. Your browser keeps a small flag in localStorage so each step is counted once.

Local storage also keeps a copy of game data so pages load faster, plus small display settings. Those stay in your browser.

To understand a question, we send what you typed to TypeSafe (typesafe.ai), together with the page you’re on and what’s open in the side panel. We don’t send your account, email or Riot ID. If you ask about your own games, we read your match data on our server to answer.

We log each question (up to 200 characters), how we read it, what we showed, what you picked, and any “Not what I meant” note. The log has no account, IP address or browser details.

To stop abuse, Ask has usage limits. Signed in, we keep a counter with your latest question on your account. Signed out, the counter is keyed by a code made from your IP address and the date. The code can’t be turned back into your IP, changes every day, and is deleted after about a day.

Signing in (via Supabase, with an email link or a password) creates a profile with your email and a display name, and sets a session cookie. We also save your settings so they follow you between devices, and when you last used HexKey, so we can count active users.

If you link a Riot account, we store your Riot ID, region and the PUUID Riot gives us for it, so we can show your matches and stats.

Things you choose to save are stored on your account:

• Game reviews: placement, rating, comp and your notes for a game.
• Feedback: your message, an email if you give one, the page, your browser’s user agent, screen size, language, app version and your account if you’re signed in. Feedback also works signed out.

All HexKey email goes through Resend. There are two kinds. Account email goes out only when something needs you: a sign-in link or password reset when you ask for one, and one reminder if you haven’t confirmed your email a few days after signing up.

News email comes in four types, each with its own switch on the email preferences page:

• Patch notes: each TFT patch’s changes, about every two weeks.
• Set launches: a new set on the PBE and the day it goes live.
• HexKey updates: new HexKey features, a few times a year.
• Your week (HexKey Pro): on Mondays, a recap of your ranked games of the week before, only after a week you played ranked.

You only get a type you opted in to: ticking the newsletter box, confirming your email, or switching it on. Opting in to HexKey News covers patch notes and set launches (the patch page’s signed-in button covers patch notes only); HexKey updates and Your week are off until you turn them on. Having an account does not subscribe you. We save your choices with your email address. Every news email links to your preferences without signing in, and has an unsubscribe link and a one-click unsubscribe your mail app can use.

If your account has a linked Riot ID, patch notes emails also show what the patch means for your games, read from the same stored ranked games as the patch page. Your week is read from the same stored games and the same game reviews as your profile. Nothing extra is collected for either.

You can also get HexKey News without an account by typing your email on the site. We save the address and where you signed up, and send one email with a confirmation link. You only get news after you click it; if you don’t, we email that address nothing else. To stop abuse, sign-ups are limited per visitor with a code made from your IP address and the date (it can’t be turned back into your IP and is deleted after about a day), and per email address.

Profiles, ranks and match history come from Riot’s official API, called from our server. When anyone looks up a player, we store that player’s public account and match data to build profiles, leaderboards and stats. This includes players who don’t use HexKey. We don’t sell this data.

When you click a download on hexkey.app/download, we save the platform, the app version, the page you were on, the page that sent you there, your browser’s user agent, and whether you came from the overlay’s update prompt. It isn’t tied to your account. The installers are served from our file storage on Cloudflare R2.

The overlay has no account and no usage analytics. It reads lobby and match information from the League client running on your computer, and makes these network requests:

• Game data (champions, items, comps) from our storage on Supabase.
• The latest app version and the current TFT set from our file storage on Cloudflare R2.
• Icons and profile pictures from MetaTFT, Community Dragon and hexkey.app.
• In a lobby, the other players’ Riot IDs to tft.dakgg.io, the public stats API behind lolchess.gg, to show their recent games.
• When you update from inside the overlay, your platform, the old and new version, and whether the update worked.

If you leave your email during setup, we save it with your answers (TFT experience and rank), your platform and, once the overlay sees your League client, your Riot ID. We only send news to that address if you also opted in to HexKey News with a HexKey account, and every news email has an unsubscribe link.

Apart from that email, none of these requests carry an identifier from us, but like any web request they show your IP address to the server that receives them.

HexKey Desktop is in limited testing and not publicly available yet. It loads this web app, so everything above applies to it too. It also reads your game client on your computer:

• In a lobby, it sends the players’ Riot IDs, ranks and recent placements to our server, which looks them up to show lobby info. We cache Riot IDs but don’t save the lobby. A counter on your account limits how often this runs.
• Live game state (boards, health, gold) is shown on your screen and isn’t sent to us. On Windows it comes through Overwolf, which has its own privacy policy.
• Game recordings are saved only on your computer and never uploaded. The recordings page asks our server for details of your own matches.
• Updates download from our file storage on Cloudflare R2.

Supabase (database and sign-in), Vercel (hosting and analytics), TypeSafe (Ask HexKey), Resend (email), Stripe (HexKey Pro payments), Riot Games (game data) and Cloudflare (downloads and updates). The overlay also loads images from MetaTFT and Community Dragon and lobby stats from tft.dakgg.io. We don’t sell your data.

Delete your account in Settings. That removes your profile, Riot link, settings, game reviews, Ask counter and news list subscription. Feedback you sent stays, without your account attached. Deleting also cancels any HexKey Pro subscription and removes the record of the reviews you opened; Stripe keeps the payment records the law requires. Unlinking your Riot account in Settings removes the link but not public match data.

For anything else, email contact@hexkey.app. Clearing your browser storage removes the tour flags described above.