Hexamaze – Privacy Policy

Hexamaze (“the Application”, “we”, “our”) is a web-based educational game focused on networking and binary/hexadecimal training. This Privacy Policy explains how Hexamaze accesses, uses, stores, and protects the personal data obtained through Google Sign-In (OAuth 2.0) and the YouTube Data API v3.

By using Hexamaze, you agree to this Privacy Policy.

1. Data We Access From Google

Hexamaze uses the following Google API scopes. No other scopes are requested or used.

Google Sign-In (openid / profile) : we read your first name and profile picture (avatar) for leaderboard display.
YouTube Data API v3 — read-only scope (https://www.googleapis.com/auth/youtube.readonly) : we perform a single, read-only subscription check to determine whether you are subscribed to the YouTube channel julienCode. This check is used solely to align your in-game exercise progression with the corresponding free video courses published on that channel. We have only read access — we never write, modify, delete, publish, or upload any data on your YouTube account.

We do not access your videos, playlists, watch history, comments, likes, subscribers list, or any other YouTube account data beyond the single subscription status check described above.

We do not access your email address, Google Drive content, contacts, calendars, or any other Google service outside the two scopes listed above.

2. Why We Collect This Data

We only collect the data strictly necessary to provide the following features:

Data	Purpose
First name	Display your name in the in-game leaderboard (Top 10)
Profile picture (avatar)	Display your avatar in the in-game leaderboard (Top 10)
YouTube subscription status — julienCode channel (read-only, never stored)	Automatically align in-game exercise progression with the free video courses published on the julienCode YouTube channel (e.g., unlock modules whose content is already covered in published lessons)

Your data is never sold, never shared with advertisers, and is only used for visual identification of players inside the Hexamaze game.

3. How Your Data Is Used

Your Google data is used solely to:

Identify your profile inside Hexamaze.
Display your name and avatar in the Top 10 leaderboard.
Prevent duplicate entries in ranking systems.
Check — in read-only mode — whether you are subscribed to the julienCode YouTube channel, in order to automatically configure your exercise progression according to the courses available on that channel. This check is performed at sign-in time only; the result is used for the current session and is never stored on our servers.

No Google data is processed for analytics, used for advertising, or combined with any third-party data source.

4. How Your Data Is Stored

Your data may be stored on our server in order to maintain ranking history. Stored data includes:

First name
Profile picture URL

YouTube subscription status is never stored. The subscription check is performed transiently at sign-in time only — the result is used in-session to configure the exercise progression and is never written to our database or retained after your session ends.

We do not store any Google tokens longer than necessary for authentication. All data is stored securely in our server environment hosted in Europe.

5. Data Retention

Your data is kept only as long as your account exists in Hexamaze or until you request its deletion.

If you do not log in for 12 months, your profile and ranking data may be automatically removed.

6. Data Deletion

You may request full deletion of your Hexamaze profile and all associated data at any time.

To delete your data, please contact us at:

Email: contact@tspro.fr

Once deletion is completed, your data cannot be recovered.

7. Revoking Google Access

At any time, you can revoke Hexamaze’s access to your Google account using your Google Account settings:

https://myaccount.google.com/permissions

After revocation, Hexamaze will no longer receive any Google data, and you will be disconnected from Google-based sign-in. If you also want your existing ranking data to be removed, please contact us for deletion as described above.

8. Data Sharing

We do not share, sell, or transfer your data to:

Advertisers
Analytics companies
External partners or platforms

Your data is used exclusively inside Hexamaze to provide the game’s features.

9. Children’s Privacy

Hexamaze is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected such data, we will delete it immediately.

10. Security Measures

We apply industry-standard protections to safeguard your data, including:

Use of HTTPS
Restricted server access
Secure token handling with limited lifetime

However, no online service can guarantee absolute security.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When changes are made, the “Last updated” date at the top of this page will be modified accordingly.

12. Contact

For any questions about this Privacy Policy, or to request data deletion, you can contact us at:

Email: contact@tspro.fr
Website: https://hexamaze.tspro.fr

13. YouTube Data API — Complete Disclosure (Required by Google)

In compliance with the Google API Services User Data Policy and its Limited Use requirements, the following table provides a complete disclosure of our use of the YouTube Data API v3.

Item	Details
API used	YouTube Data API v3
OAuth 2.0 scope	`https://www.googleapis.com/auth/youtube.readonly`
Access type	Read-only. Hexamaze never writes, modifies, deletes, publishes, or uploads any data to YouTube on your behalf.
Endpoint called	Subscriptions list — filtered by `forChannelId` of the julienCode channel, to check whether the authenticated user is subscribed to that channel only.
Purpose	To synchronize in-game exercise progression with the free networking courses published on the julienCode YouTube channel. Subscribers can have their learning path automatically aligned with the course content already published.
Data stored	None. The subscription status is checked transiently at sign-in and is never written to our database.
Data retained after session	None. No YouTube data persists beyond the active login session.
Data shared with third parties	Never. YouTube subscription data is never sold, rented, shared with advertisers or analytics partners, or used for any purpose other than the in-session progression alignment described above.
Other YouTube data accessed	None. Videos, playlists, watch history, comments, likes, channel statistics, and all other YouTube resources are never requested or accessed.

Hexamaze's use of information received from Google APIs adheres to the Limited Use Policy: data obtained via Google APIs is used only to provide or improve user-facing features visible within Hexamaze, and is not used for serving ads, tracking users across third-party sites, or any purpose unrelated to the functionality described in this policy.