Privacy Policy

Last updated 27 August 2026 · Effective for hexum.dev

Hexum is a hosted MCP server. This policy says what personal data we handle, why, who processes it for us, and how to reach us. It matches how the product actually works — not a generic template.

1. Who we are
2. What we collect
3. MCP payloads
4. Why we use it
5. Processors
6. How long we keep it
7. Browser storage
8. Your rights
9. Children
10. Changes

Who we are

The controller is the operator of the Hexum service at https://hexum.dev. For privacy, billing, or security, use Contact.

What we collect

• Account. Email address. Authentication secrets are held by our auth provider. Hexum’s application database stores a profile row (id, email, plan, Stripe customer id), not your password.
• Billing. Stripe customer id, plan (none, metered, or teams), and the invoices Stripe issues. We bill tokens saved (tokens in minus tokens out) in euro at the rates on Pricing.
• Usage. Per user and per day: tokens in, tokens out, tool calls. The dashboard shows the current month. We use these figures to bill and to show you the chart.
• Keys. A name, a public prefix, and a hash of the secret (BLAKE3). The hexum_live_… secret is shown once and is not stored in plaintext.
• Teams. Organisation name, membership, role, join code, invite email, hashed invite token, and expiry.

MCP payloads

When an agent calls Hexum, the request can include source files, prompts, paths, and architecture.hexum. We process that payload in memory to answer the call. The session is dropped after 15 minutes idle.

We do not use MCP payloads to train a Hexum model. hexum_check is deterministic and does not send your repository to a third-party model. Token counts from the call are stored as usage (numbers, not the files).

Why we use it

• To create and sign in to your account, including password reset.
• To mint, list, and revoke keys, and to authorize POST /mcp.
• To meter tokens saved and to charge through Stripe.
• To run Teams (invites, join codes, pooled usage).
• To keep the service secure and to debug failures.

Legal bases: performance of the contract (providing Hexum), legitimate interests (security and abuse prevention), and legal obligation (tax and invoices). Creating an account or using a key is agreement to the Terms.

Processors

• Supabase — authentication and the database.
• Stripe — Checkout, Customer Portal, invoices, and usage metering.
• Microsoft Azure — hosting (currently North Europe).

We do not sell personal data. We do not run advertising cookies or third-party analytics pixels on hexum.dev. Processors may handle data outside your country; they use their own transfer tools (including standard contractual clauses where they apply).

How long we keep it

• Account and profile: until you delete the account.
• Usage counters: while needed to bill the current period, then as long as the related invoice must be kept.
• MCP session memory: 15 minutes idle, then discarded.
• Revoked key hashes: may remain so a leaked key stays dead.
• Stripe records: as Stripe and tax law require, even after you leave.

Browser storage

Strictly necessary only. The auth library keeps a session in the browser. We cache public config in sessionStorage and, if you mint a key, the last secret there so the connect snippet can fill in — that secret is gone when the tab session ends. There is no tracking cookie and no cookie banner, because we do not use optional cookies.

Your rights

If you are in the EEA, UK, or another place with similar rules, you can ask to access, correct, delete, export, restrict, or object to processing, and you can complain to a supervisory authority. Delete the account from Account (that revokes keys and removes the profile we store). Cancel billing in the Stripe portal first so charges stop. We may keep invoices and security logs the law requires.

Password reset is self-serve from the sign-in card. Changing the password while signed in is on the Account card.

Children

Hexum is not directed at children under 16. Do not create an account for one.

Changes

We will change this page when the product changes, and update the date above. Material changes will be described here. The live policy is always this URL.

Contact · Terms · Security