Privacy Policy

Last updated 28 August 2026 · Effective for hexum.dev

Hexum is a hosted MCP server. This policy says what personal data we handle, why, who processes it for us, and how to reach us. It matches how the product actually works — not a generic template.

1. Who we are
2. What we collect
3. MCP payloads
4. Zero Data Retention
5. Why we use it
6. Processors
7. How long we keep it
8. Browser storage
9. Security measures
10. Your rights
11. Children
12. Changes

Who we are

The controller is the operator of the Hexum service at https://hexum.dev. For privacy, billing, or security, use Contact.

What we collect

• Account. Email address. Authentication secrets are held by our auth provider. Hexum’s application database stores a profile row (id, email, plan, Stripe customer id), not your password.
• Billing. Stripe customer id, plan (none, metered, or teams), and the invoices Stripe issues. We bill tokens saved (tokens in minus tokens out) in euro at the rates on Pricing.
• Usage. Per user and per day: tokens in, tokens out, tool calls. The dashboard shows the current month. We use these figures to bill and to show you the chart.
• Keys. A name, a public prefix, and a hash of the secret (BLAKE3). The hexum_live_… secret is shown once and is not stored in plaintext.
• Teams. Organisation name, membership, role, invite email, hashed invite token, and expiry.

MCP payloads

When an agent calls Hexum, the request can include source files, prompts, paths, and architecture.hexum. We process that payload in memory to answer the call. The session is dropped after 15 minutes idle.

We do not use MCP payloads to train a Hexum model. hexum_check is deterministic and does not send your repository to a third-party model. Token counts from the call are stored as usage (numbers, not the files). This is Zero Data Retention, on Usage and on Teams. Full text: ZDR.

Zero Data Retention

ZDR applies to all plans. We do not write MCP bodies to the application database, do not keep a repo archive, and do not train on your code. Session memory is in process and discarded after 15 minutes idle. Account, key hashes, usage counters, and Stripe invoices remain as described above. Policy: Zero Data Retention.

Why we use it

• To create and sign in to your account, including password reset.
• To mint, list, and revoke keys, and to authorize POST /mcp.
• To meter tokens saved and to charge through Stripe.
• To run Teams (email invites, pooled team-key usage).
• To keep the service secure and to debug failures.

Legal bases: performance of the contract (providing Hexum), legitimate interests (security and abuse prevention), and legal obligation (tax and invoices). Creating an account or using a key is agreement to the Terms.

Processors

• Supabase — authentication and the database.
• Stripe — Checkout, Customer Portal, invoices, and usage metering.
• Microsoft Azure — hosting (currently North Europe).

We do not sell personal data. We do not run advertising cookies or third-party analytics pixels on hexum.dev. Processors may handle data outside your country; they use their own transfer tools (including standard contractual clauses where they apply).

How long we keep it

• Account and profile: until you delete the account.
• Usage counters: while needed to bill the current period, then as long as the related invoice must be kept.
• MCP session memory: 15 minutes idle, then discarded.
• Revoked key hashes: may remain so a leaked key stays dead.
• Stripe records: as Stripe and tax law require, even after you leave.

Browser storage

Strictly necessary only. Detail: Cookies. The auth library keeps a session in this browser. We cache public config in sessionStorage and, if you mint a key, the last secret there so the connect snippet can fill in. There is no advertising cookie and no cookie banner.

Security measures

TLS in transit (Azure). Stripe holds card numbers; we store a customer id. API keys are BLAKE3-hashed; the secret is shown once. Database row-level security is on; the browser role cannot read key hashes, invite token hashes, or Stripe ids. MCP payloads stay in process memory for 15 minutes idle. We do not run a customer-visible audit log or a third-party APM today; short-lived server logs may be used for abuse response.

Your rights

If you are in the EEA, UK, or another place with similar rules, you can ask to access, correct, delete, export, restrict, or object to processing (GDPR Arts. 15–21). Complain to a supervisory authority — for EU hosting that includes the Irish Data Protection Commission (dataprotection.ie), or your local authority. Delete the account from Account (that revokes keys and removes the profile we store). Cancel billing in the Stripe portal first so charges stop. Invoices we must keep for tax stay with Stripe. Refunds: Refunds.

Password reset is self-serve from the sign-in card. Changing the password while signed in is on the Account card.

Children

Hexum is not directed at children under 16. Do not create an account for one.

Changes

We will change this page when the product changes, and update the date above. Material changes will be described here. The live policy is always this URL.

Contact · Terms · Refunds · Cookies · Security · ZDR