Hexgate (the desktop app, the website hexgate.app and the Hexgate API) is operated by:
We are the data controller for the personal data described here. Write to the address above for anything about your data.
We only collect what a feature needs. The legal basis is either the contract with you (we need it to provide Hexgate), our legitimate interest (keeping the service fair, secure and improving it), or a legal obligation (accounting).
| Data | Why we use it | Legal basis |
|---|---|---|
| Account: email, display name, password (stored only as a secure hash), or the account ID and email from Discord, Google or Microsoft if you sign in with them, app and game language | Create and secure your account, sign you in on the app and website | Contract |
| League account: Riot ID (name and tag), region, summoner level, profile icon, ranked tier and record, read from the League client on your PC | Show your stats, link games to the right League account, rank-based coaching | Contract |
| Games: for games played with Hexgate and your recent match history, the champion, queue, result, kills, deaths, assists, farm, gold, items and duration | Recommendations, the free daily game limit, refunds for remakes, your personal stats | Contract |
| Other players in your games: their Riot ID, champion, team, items and score, as shown in the League client's match summary | Show the full scoreboard in your match history; aggregated item statistics | Legitimate interest |
| Pro+ match breakdowns: the game and timeline data of the game you analyze | Create your breakdown. We keep only the computed numbers (no player names) and the result | Contract |
| Rank benchmarks: per-player numbers from ranked games (champion, role, statistics) with no names or account IDs | Compare your play with players of your rank | Legitimate interest |
| Device and security: your IP address when the app starts, the country it points to, and a one-way hash of your PC's Windows machine ID, CPU name and BIOS name | Prevent abuse of the free plan and referral rewards, protect accounts, and know which countries our players are in | Legitimate interest |
| Logs you send: the app log and a system summary (Windows version, CPU, GPU, memory, screens, and the names of known overlay or recording apps that are running) | Only when you press Send logs or an error report is sent, to fix problems | Legitimate interest |
| Payments: plan, subscription status, Stripe customer ID, and the name, country and address you enter at checkout | Process subscriptions, invoices and refunds. Your card details are handled by Stripe and never reach us | Contract, legal obligation |
| Referrals: who invited whom and the rewards given | Give referral rewards and prevent referral abuse | Contract, legitimate interest |
We do not use your account or game data for advertising, we do not sell it, and we do not make decisions about you that have legal effects based only on automated processing. Abuse protection may limit an account automatically; write to us if you think this happened by mistake.
Apart from the ads described below, the website has no ad trackers and no third-party analytics. We count visits ourselves: the page, the referring site, campaign tags in the link, your country and a rough screen size, with a visitor ID that is a hash of your IP address and the date, so it changes every day. When you click a download button we store your IP address with the click, so a download can be matched to a sign-up from the same network within 48 hours (this is how we know which pages and campaigns bring players).
Our own cookies are used only on the account pages (sign in, subscribe, manage your plan) and only to keep you signed in:
| Name | Purpose | Lasts |
|---|---|---|
| __Host-hg_session | Keeps you signed in on the website | 30 days |
| __Host-hg_in | Tells the menu that you are signed in | 30 days |
| __Host-hg_oauth, __Host-hg_switch | Protect a sign-in or account switch in progress | Up to 10 minutes |
The website also stores a few values in your browser's local storage: your language choice, the first page and campaign you arrived from, a referral code from an invite link (24 hours) and an email sign-up in progress (24 hours). You can clear them at any time in your browser settings. Pages load fonts from Google Fonts, champion images from Riot's Data Dragon and Community Dragon, and the trailer from YouTube's privacy-enhanced mode.
Website sections about games other than League of Legends may show ads served by Google AdSense. The Hexgate app, the account pages and our League of Legends pages never show ads. On pages with ads, Google and its partners use cookies and similar technologies to show ads, limit how often you see them, measure them and prevent fraud. Where the law requires it (for example in the EU, the UK and Switzerland), personalized ads and ad cookies are used only if you agree in the consent message shown on those pages, and you can change your choice there at any time. Google decides how it uses the data it collects this way; see how Google uses information from sites that use its services. You can turn off personalized ads in My Ad Center.
We send sign-in and password codes when you ask for them. We also send occasional emails about Hexgate to account holders, such as new features and offers. Every one of those has a one-click unsubscribe link, and unsubscribing stops them for good. Emails are sent through Resend.
We use these service providers. Each processes data only to provide its service to us:
| Provider | What for |
|---|---|
| Cloudflare | Hosting of the website, the API and app downloads; network security |
| Supabase | Database hosting |
| Stripe | Payments, subscriptions, invoices and the billing portal |
| Resend | Sending emails |
| OpenRouter | Runs the model behind Pro+ breakdowns. It receives game statistics only, never your name, email or account |
| Google AdSense | Ads on website pages about other games only (see section 4). Google is responsible for the data it collects through these ads |
| Discord, Google, Microsoft | Only if you choose to sign in with them |
Some of these providers are based in or process data in the United States. Those transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses. We may also disclose data when the law requires it.
Under the GDPR you can ask us to:
Email support@hexgate.app from the address on your account. We answer within one month. You can also complain to the Romanian data protection authority, ANSPDCP, or the authority in the country where you live.
Hexgate is for people who are allowed to play League of Legends, and you must be at least 13 to create an account. We do not knowingly collect data from younger children. If you think a child under 13 has an account, write to us and we will delete it.
If we change how we use your data, we update this page and the date at the top. For important changes we tell account holders by email or in the app before they apply.