Privacy policy

Hextant · Updated September 22, 2026

Your phone converts its location to a block identifier before sending it. Hextant receives the block identifier, not the device's latitude and longitude. Blocks are approximate location information. Ordinary network connections also expose an IP address to our hosting service. We do not display individual presence or a public member list. If you turn on “Know when your block is asked”, the app also uses your location in the background, only when iOS reports that you have stopped somewhere or left, at most a few times a day: your phone works out the block and sends only the block identifier, so you can be told about questions asked there and counted in how busy the block is. You can turn this off in Hextant Settings or iOS Settings at any time.

We process your Apple account identifier, Hextant username, adult eligibility result and confirmation method, authentication credentials, app-integrity keys, account settings, optional bio, content you submit, blocks, reports, follows, waitlists, and notification token when enabled. We also keep a count of the distinct blocks you have stayed on for a few minutes, which is shown on your profile; to count them we store one-way fingerprints, not the block identifiers, times or order. The list of blocks you have visited, which only you can see, is encrypted on your devices with a key we do not hold, and we store it only in that encrypted form. We do not request your Apple name or email. App integrity verifies an app/device relationship; it does not prove physical location.

Public messages, question text, answers, and replies are readable for at most 24 hours from creation. Shorter question deadlines remain in force. Expiry is checked on reads, and cleanup runs every minute. Accepted direct messages remain until either participant ends the conversation, blocks the other, or deletes their account. Pending requests keep their original 24-hour deadline; declining does not notify the requester.

Bios and settings remain until edited or account deletion. Lifetime answer totals remain for the account without old answer text or a location history. Hourly summaries expire after 24 hours. Block memory keeps aggregate descriptions derived from approved summaries. Presence records last at most 15 minutes. To learn what is usual for each block, we keep a count of how many people were on each block in each 15-minute period, with random noise added so it cannot show whether any particular person was there; these counts contain no account or identifier and are deleted after 8 weeks. We keep similar hourly counts of how much was said on each block, and a record of which blocks were unusually busy, on the same terms. When you have turned on background presence, the block you have stopped at is held in memory, not stored, until you leave or for at most 3 hours. Visit fingerprints and your encrypted list remain until you delete your account; the daily number of new blocks counted is kept for 2 days. Presence keys rotate by epoch and are derived from a retained secret; rotation does not mean the master secret is destroyed.

Usage analytics use allowlisted event fields, never message bodies. They are unlinked from account identity after 25 hours and deleted after 30 days, measured from server receipt. Minimal moderation outcomes and administrator audit metadata are kept for 30 days. A copy of reported text is kept with its report until 30 days after the report is resolved; no other expired conversation text is archived. No advertising, advertising identifiers, or third-party analytics SDKs are used.

AI sharing is optional and off by default. Core posting works without it. If you agree, eligible future public message bodies may be sent to Anthropic to generate summaries and aggregate block memory. We exclude direct messages, account identifiers, usernames, device information, and precise timestamps from that input. Text you write may itself contain personal information. Minimum participation thresholds and screening apply after consent filtering.

Anthropic's standard API policy permits retention of inputs and outputs for up to 30 days, with longer safety, legal, and other policy exceptions. This is separate from Hextant's 24-hour public-content window. Read Anthropic's policy at https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data before opting in. Withdrawing stops future and queued eligibility; it cannot recall data already sent to the provider or remove its contribution from existing aggregate memory.

Fly.io hosts the service and database. Apple provides sign-in, age eligibility where available, app integrity, and push delivery. Anthropic receives eligible text only with optional consent. We do not sell personal information. Service providers process information needed for these functions; disclosure may also be required by law.

Encrypted recovery backups are restricted and kept for a maximum of seven days. Deleted or expired data may remain in those backups until they expire. Cleanup may be delayed during outages, but public-content reads still enforce expiry. Recovery must replay acknowledged deletions from a separate encrypted journal and purge expired records before serving restored data. Minimal deletion identifiers remain beyond the backup horizon to support that process.

Hextant is for adults. Age checking occurs before account creation. Known minors, cancellation, and declined sharing do not advance onboarding. Explicit adult confirmation is offered only when Apple's age service is unavailable. We retain only the eligibility result and confirmation method after an adult proceeds; rejected age checks do not produce Hextant analytics.

You can change notification and location permissions in iOS Settings, withdraw AI sharing in Hextant Settings, block accounts, report content, and delete your account in the app. Account deletion removes its content and ends its direct conversations; the username is retired without retaining its former account association. Contact the address below about your information or if deletion is unavailable in the app.

Published by Hextant LLC. Contact: siddharth.sumanwork@gmail.com.