Last updated: April 14, 2026
This Privacy Policy describes how HexStep ("the App", "we", "us", or "our") handles information when you use the HexStep mobile application. HexStep is developed by James Huh ("the Developer").
We built HexStep with a privacy-first approach. The App is designed to function primarily on your device. Cloud sync is entirely optional and requires you to sign in.
HexStep collects GPS location data (latitude, longitude, and timestamps) through Apple's Core Location services. This data is used solely to determine which hexagonal grid cells you have visited. The App collects location data while open and, with your permission, while running in the background. Tracking stops when the App is fully closed or when you revoke location permissions.
From your GPS coordinates, the App derives:
If you choose to sign in with Google for cloud sync, we collect:
If you do not sign in, no account information is collected. The App functions fully without an account.
With your permission, the App may access:
All data collected by HexStep is used exclusively for the App's core functionality:
Your data is never used for advertising, profiling, behavioral analysis, or any purpose other than showing you your own exploration data within the App.
All data generated by HexStep is stored locally on your device in a SQLite database within the App's sandboxed container, protected by:
If you sign in with Google, your hex visit data is synced to our cloud database hosted by Supabase. This enables you to access your exploration data across multiple devices. Cloud-synced data includes:
Your local device is always the source of truth. Cloud data is a secondary copy for convenience.
HexStep does not integrate any analytics, advertising, or user tracking services. The third-party services involved are:
| Service | Purpose | Data Shared |
|---|---|---|
| Apple Core Location | GPS coordinates | None (on-device) |
| Apple CLGeocoder | Reverse geocoding | Coordinates sent to Apple |
| Apple HealthKit | Step count display | None (on-device, read-only) |
| Apple MapKit | Map display and share cards | Map tile requests to Apple |
| Google Sign-In | Account authentication | OAuth token exchange |
| Supabase | Cloud database sync | Hex visit data (if signed in) |
Google Sign-In is governed by Google's Privacy Policy. Supabase's data practices are described in Supabase's Privacy Policy.
If you use cloud sync, your hex visit data is stored on Supabase servers which may be located outside your country of residence. By signing in and enabling cloud sync, you consent to this transfer.
If you prefer not to transfer data outside your country, you can use HexStep without signing in and keep all data stored locally on your device.
HexStep is not directed at children under the age of 13 (or the applicable minimum age in your jurisdiction, such as 16 in certain EU member states under GDPR, or 14 under Korea's PIPA). We do not knowingly collect personal information from children.
If you are located in the European Economic Area, you have the right to:
If you are located in the Republic of Korea, you have the right to access (열람), correct or delete (정정/삭제), and suspend processing (처리정지) of your personal information.
For the full Korean-language privacy policy, see 개인정보 처리방침.
Personal Information Manager: James Huh — hello@hexstep.app
You can delete all data stored by HexStep at any time:
Data deletion is permanent and irreversible. Deleted data cannot be recovered.
You can export all your exploration data from Settings → "Export My Data." The export is provided as a JSON file containing all hex visit records, timestamps, coordinates, and points.
We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date above.
If you have any questions about this Privacy Policy or your data, please contact us: