Privacy Policy

Who runs Hexis (controller)

Hexis is part of Arachnida Apps, which is the controller responsible for the data described here. For any privacy question or request, contact twc@arachnida-apps.com. Where you record information about other people, you act as the controller of that information and Hexis processes it on your behalf (see “Information about other people” below).

What we collect

• Account identity from your Arachnida Apps sign‑in: a stable account ID, your email, and (if set) your display name and avatar. We read these from the Arachnida sign‑in service and never see or store your password.
• Your results you choose to record or take on‑site (HEXACO factor and facet scores, the norm group, and test date).
• Your speculations — the bands you estimate about yourself or people you add.
• Profiles you create about other people: a nickname you choose and, optionally, a link to that person’s Arachnida account.
• Your settings & relationships: name/picture/results visibility, sharing grants, invite and guess links, and notification preferences.
• Notification & device data: in‑app notifications, and — only if you enable browser notifications — a push subscription identifying your browser/device so we can deliver them.
• Minimal technical/operational data needed to run and secure the service (e.g. server logs and abuse‑prevention counters). We do not use advertising or third‑party analytics trackers.

Why we use it & legal bases

We use your data to provide Hexis: to authenticate you, store and display your results and speculations, enforce your visibility choices, deliver notifications and email you have not turned off, and keep the service secure. Where the GDPR or similar laws apply, our legal bases are: performance of our agreement with you (running the service you asked for); our legitimate interests in operating, securing, and improving Hexis (balanced against your rights); your consent (for example, enabling browser notifications, which you can withdraw at any time); and compliance with law. Because the personality information you record can be sensitive, we rely on the fact that you have knowingly chosen to provide it and our processing is limited to delivering the service to you and the people you choose to share with. We do not use your data for automated decisions that produce legal or similarly significant effects about you.

Importing a results PDF

When you upload a results PDF, it is read on our server using on‑device optical character recognition (OCR). The raw PDF is never written to disk or retained — we keep only the scores you confirm and a one‑way fingerprint (hash) used to avoid duplicate imports. No third‑party AI service is involved in reading your PDF, and nothing is saved until you review and confirm the values.

How your data is shared

By default your name and picture are visible to your connections (people you have approved to see your results), and your results are shared only by request. You decide, per item, whether your display name, picture, and verified results are visible to no one, to people you approve, or to anyone — and these controls are independent of one another. Your permanent profile link and any invite or guess links you create honour those settings. Speculation you record is only ever visible to you. We do not sell your personal information, and we do not share it for advertising. The only exceptions are actions where we tell you, in the moment and before you confirm, that you’re about to reveal something — for example, requesting access to someone’s results shares your name with them so they know who’s asking.

Service providers (sub‑processors)

We share data only with the providers that make Hexis work, under contracts that limit their use of it:

• Arachnida Apps sign‑in / identity — authentication and your basic profile.
• Email delivery — a transactional email provider sends the notifications you have not turned off; it receives your email address and the message content (which never includes your scores).
• Browser push services — if you enable browser notifications, delivery goes through your browser vendor’s push service (e.g. Google, Mozilla, or Apple).
• Hosting & infrastructure — the servers and database that store your data.

We may also disclose data if required by law or to protect the rights, safety, or security of Hexis and its users.

Email & notifications

We send transactional notifications (for example, when someone requests your results, approves you, claims your guess, or guesses you, and when our policies change). We may also send product announcements — occasional notes about new Hexis features and updates. These are on by default once you have accepted this policy, and you can turn them off at any time. Each type — and each channel (email and browser pop‑up) — is independently toggleable in Settings → Notifications, there is a one‑click “unsubscribe from all emails” (which covers announcements too), and every email links back to these controls. Whatever you choose, the in‑app Announcements page always carries the latest updates, and in‑app notifications appear in the bell and expire automatically over time so they don’t accumulate.

International users & transfers

Hexis is operated from the United States. If you access it from outside the U.S., your data will be processed in the U.S. and other countries where our providers operate, which may have different data laws. Where required, we rely on appropriate safeguards for such transfers. By using Hexis you understand your data may be processed in these locations.

Cookies & local storage

Hexis uses a strictly necessary session cookie (set by the Arachnida sign‑in service) to keep you logged in, small browser localStorage entries to remember preferences (such as card/list view and whether we’ve already offered notifications on this device), and a service worker for offline support and push. We do not use advertising or third‑party analytics cookies, so no consent banner is required.

Recording information about other people

Hexis lets you keep private notes and band speculations about people you know, optionally linked to their Arachnida account. These are visible only to you and are not shown to the person concerned. You are responsible for handling other people’s information lawfully and respectfully. If you link a profile to someone’s account, their verified results appear only with their consent (a granted request or an invite link they opened). If a linked person deletes their Arachnida account, the link is automatically removed from your profile. A person can ask us to remove identifiable speculation held about them at the contact address above.

Your rights & choices

You can export everything Hexis holds about you at any time from Settings → Data export (machine‑readable JSON), correct or remove individual profiles, results, and speculations directly in the app, and delete your Hexis data yourself from Settings or by deleting your entire Arachnida account (which erases your Hexis data too). Depending on where you live, you may also have rights to access your data, object to or restrict processing, withdraw consent, and — for EU/UK users — lodge a complaint with your data‑protection supervisory authority. California residents: we do not sell or “share” personal information and will not discriminate against you for exercising your rights. To exercise any right, contact us at the address above.

Retention & security

We keep your data until you delete it or your Arachnida account is removed; in‑app notifications are pruned automatically after a set period. Access is scoped to your account; cross‑user visibility is enforced server‑side; and the account‑deletion signal from the Arachnida service is authenticated. We aim to collect the minimum necessary and to protect it with reasonable safeguards, but no system is perfectly secure and we cannot guarantee absolute security.

Children

Hexis is not intended for anyone under 16. Please don’t use it or provide data if you are younger.

Changes

We may update this policy; we will update the “last updated” date above and, for material changes, ask you to accept the revised policy before continuing. See also our Terms of Service.