How Hexile handles your data.

• No ads, trackers or analytics scripts. Nothing on these pages loads from another site.
• The web server keeps logs of requests (address, time, page, browser) to keep things running and stop abuse. They're rotated daily and deleted after two weeks.
• Sign-in attempts are logged with their address, and repeated failures get that address blocked for a while. A signed-in session remembers the address and browser it started from, so it can be listed and ended.
• Cookies only for things you choose. If you sign in, a session cookie keeps you signed in until you sign out or for at most 30 days, and a second one lives for five minutes between your password and your code. If you change a setting (the theme, animations, or Fyr's look), one preferences cookie holds just those choices, so every hexile.no page looks and moves the way you picked. Without signing in or changing a setting, there are no cookies at all.
• Some things stay in your browser. Fyr keeps your nights there (your moves, solves, best boards, and which bottle notes you've read), and the start page remembers which news tab you had open. None of it is sent to the server; clearing this site's data in your browser wipes it.
• Things fetched on your behalf, like weather from MET Norway, headlines from NRK and site icons, are fetched by the server, so your browser never contacts those sites just by opening a page here.
• The public tools show you your own address and headers. They aren't stored. Tett's DNS check also sees which resolver looked up its test names; that's kept in memory for a minute, then forgotten.
• The contact form keeps what you send (message, email address, and name if you give it) for up to 90 days, then deletes it. Your network address is only used to limit how often messages can be sent.
• Mail sent to hxl.no and hexile.no addresses is delivered here, checked for spam on the way in, and kept until it's deleted. The mail server's logs (who to whom, when, how big; never the contents) are kept for two weeks.

Who's responsible

Hexile is run by one person, in Norway, who is responsible for the personal data it handles (the "controller", in the words of the GDPR). Questions, requests and complaints go to show the address, or through the contact form.

What, why, and for how long

• Web server logs (address, time, page, browser): to keep the site running and stop abuse, a legitimate interest. Kept for 14 days.
• Sign-in protection and sessions: failed sign-ins are logged with their address, and repeated failures block that address for a while; a session remembers the address and browser it started from. For security, a legitimate interest. Blocks lift by themselves; a session lasts until you sign out, or at most 30 days.
• Cookies: a session cookie when you sign in, a five-minute one between password and code, and a preferences cookie when you change a setting. Each exists only because you did something that needs it, so there's no cookie banner. Post, the webmail, sets its own sign-in cookie once you've signed in to it.
• The contact form: your message, email address and name if you give it, to answer you, a legitimate interest. Kept for up to 90 days.
• Mail to hxl.no and hexile.no addresses: delivered to a mailbox here and kept until it's deleted there. On the way in it's checked for spam; the mail server logs sender, recipient, time and size (not the contents) for up to two weeks, to deliver mail and keep spam out, a legitimate interest.
• What account holders store (Hugin's chats, documents given to Prospekt, files): kept for the account holder until they delete it. A shared link (a Files link or a Prospekt report) makes that one item public until the link is removed.
• Backups: the server is backed up nightly, encrypted. Deleted data leaves the backups as old ones are pruned.

Where it lives, and who else sees it

The site runs on a server rented in the EU. The language models run on hardware in Norway, reached over a private network, and the backups are kept in Norway. Nothing is sold, shared or handed to anyone else, and nothing leaves the EEA. The only data that goes elsewhere is what has to: mail sent from here goes to the recipients' mail servers, and Domeneshop runs the domain names.

Your rights

You can ask what's stored about you, and have it corrected or deleted. You can also ask for processing to be restricted, or object to it. Write to show the address; you'll get an answer within a month. If you think something here is wrong, you can complain to Datatilsynet, the Norwegian Data Protection Authority.

Changes

Last updated 23 October 2026. If this changes in a way that matters, it'll say so here. The terms cover the rest.