Privacy Policy · hexly's blog

This policy explains what personal data hexly's blog (hexly.nexus) collects, why, and what you can do about it. The site is run by Kev ("I", "me"), who is the data controller. I've tried to keep it short and honest. If anything here is unclear, contact [email protected].

The short version

You can read everything on this site without an account, and I don't run analytics or ad trackers.
If you sign in with Google to comment, I store your name, email address, profile picture link and Google account ID.
Your comments, name and profile picture are public. Your email address is never shown.
I don't sell your data or share it with anyone for marketing.

What I collect

If you just read the site: nothing is stored about you. To count views without counting the same person twice, a one-way hash of your IP address and browser user agent is kept in memory for up to 6 hours, then discarded. It is never written to disk.

If you sign in with Google: Google shares your Google account ID, name, email address, whether that email is verified, and a link to your profile picture. I store these to create your account, show your name and picture next to your comments, and recognise you when you return. I also record when your account was created and when you last signed in.

If you comment: I store your comment text, any image you attach, and when you posted it. Comments and attached images are public.

Security: your IP address is held in memory for up to 15 minutes to rate-limit sign-in attempts, and server logs may briefly record IP addresses and errors for troubleshooting.

Why I use it (lawful basis)

Under UK GDPR, I rely on legitimate interests to run the blog, count views and keep it secure, and on performing the service you asked for when you create an account and comment. I don't use your data for automated decision-making or profiling.

Cookies

This site only uses cookies needed for it to work:

hexly_session: keeps you signed in. Only set if you sign in, and it lasts up to 90 days or until you sign out.
.AspNetCore.Antiforgery.*: a security cookie that protects forms against cross-site request forgery. It lasts for your browser session.
Cloudflare may set security cookies such as __cf_bm to filter out bots and attacks.
Google may set its own cookies when its sign-in button loads.

There are no advertising or analytics cookies, so there's no cookie banner.

Third parties

Some services are involved in delivering the site. They receive your IP address and browser details as part of normal web requests, under their own privacy policies:

Cloudflare handles all traffic to this site, provides HTTPS and caches images. Cloudflare privacy policy.
Google provides sign-in (its sign-in script loads on pages of this site), the map on the homepage, and YouTube videos embedded in posts, which use YouTube's privacy-enhanced mode. Google privacy policy.
cdnjs (run by Cloudflare) and jsDelivr serve the scripts for code highlighting and the image viewer.

Where it's stored and for how long

Your data is stored on a server in the United Kingdom. Cloudflare and Google may process requests in other countries under their own safeguards.

Account details are kept until you ask me to delete your account.
Comments and images are kept until you or I delete them.
Sign-in sessions expire after 90 days, or straight away when you sign out.
In-memory view and rate-limit data is discarded within 6 hours.

Your rights

Under UK GDPR you can ask me to give you a copy of your data, correct it, delete it, or restrict or object to how it's used. To do any of these, contact [email protected]. I'll respond within one month. Deleting your account also deletes your comments.

If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office.

Children

You need to be at least 13 to create an account, which is also Google's minimum age for an account.

Changes

If this policy changes, I'll update the date at the top. Significant changes will be mentioned on the blog.