Privacy
Policy

1. Scope and who we are

This Privacy Policy applies to the Hexe AI website, Hexe Core, Hexe Supervisor, Hexe Nodes, and related integrations that link to this policy (collectively, “Hexe”). Hexe is an open-source project building a modular, local-first AI control plane. Its source code is developed publicly in the Hexe project repositories on GitHub.

Hexe may be self-hosted or operated on infrastructure controlled by the user or system operator. In those deployments, the operator controls the host, connected providers, retention configuration, and access to locally stored data.

2. Information we collect

Information you provide

• Account identifiers, display names, email addresses, and configuration details.
• Support requests and communications you send to us.
• Instructions, rules, labels, classifications, and other settings you create in Hexe.

System and operational information

• Device and node identifiers, service status, software versions, health telemetry, diagnostic events, and security/audit records.
• Interaction data needed to perform requested functions, such as voice transcripts, commands, generated responses, notification state, and task results.
• Basic website request data processed by our hosting and security provider, such as IP address, browser type, timestamps, and security signals.

Hexe does not sell personal information and does not use personal information for targeted advertising.

3. Google user data

When you choose to connect Gmail, Hexe uses Google OAuth 2.0. Connecting a Google account is optional. The consent screen identifies the requested permissions, and Hexe does not receive your Google password.

Google data Hexe may access or store

Depending on enabled features, this may include your Gmail address and account identifier; OAuth access and refresh tokens; message IDs; sender and recipient addresses; subject lines; timestamps; labels; snippets; message bodies; HTML content; attachments or attachment metadata; mailbox counts; classifications; summaries; extracted order, invoice, shipment, security, or action-item data; and user-created rules or corrections.

4. How we use information

We use information only as needed to provide, secure, maintain, and improve user-facing Hexe functionality, including to:

• authenticate connected accounts and maintain authorized provider connections;
• fetch and display mailbox state and messages requested by the user;
• classify, summarize, search, route, and extract user-relevant information from email;
• apply user-configured labels, rules, workflows, notifications, and actions;
• send email when initiated or authorized by the user;
• detect errors, protect the system, enforce permissions, and troubleshoot incidents; and
• comply with applicable law and enforce our Terms.

We do not use Google user data for advertising, retargeting, credit decisions, lending, sale to data brokers, or creation of generalized profiles unrelated to the user-facing Hexe service.

5. Sharing, service providers, and AI processing

Hexe does not sell Google user data. Data may be disclosed only in the following limited circumstances:

• Infrastructure providers. Hosting, security, storage, and network providers process limited data to operate and protect the service.
• User-selected providers. If the operator enables an external AI or automation provider, the minimum content needed for the requested classification, summarization, extraction, or action may be sent to that provider under the operator’s configuration and direction.
• Security and support. Specific data may be accessed when reasonably necessary to investigate abuse, a security incident, or a support issue. Human access to Google user data is limited to user consent, security needs, legal requirements, or aggregated internal operations permitted by Google policy.
• Legal requirements. Information may be disclosed when required by law or valid legal process.
• Business transfer. Information may be transferred as part of a merger, acquisition, or asset sale only with any notice or consent required by law and Google policy.

External providers are not authorized by Hexe to use Google user data for advertising or to train generalized AI models. Operators should review and select provider terms appropriate to their deployment.

6. Storage and retention

Hexe is designed to keep sensitive provider data within the Email Node runtime controlled by the system operator. OAuth tokens, account records, mailbox state, rules, and fetched messages may be stored locally on that host. Access tokens are refreshed using a locally stored refresh token when long-lived access is authorized.

The current default email retention policy keeps fetched messages for up to six months. Older messages with a non-unknown local classification and at least 92% confidence may be retained for continuity, capped at the newest 10,000 such messages per connected account. Some derived records, configuration, security logs, backups, or diagnostic artifacts may remain until removed by the operator or no longer required for the stated purpose.

OAuth session state is short-lived. Data may be retained longer when required for security, legal compliance, dispute resolution, or enforcement. Self-hosted operators are responsible for backups and any retention changes they configure.

7. Security

Hexe uses measures designed to protect sensitive data, including server-side OAuth code exchange, signed and expiring OAuth state, restricted local file permissions where supported, separation of provider credentials from Core trust credentials, access controls, and token redaction in structured logs.

No system is completely secure. Operators must protect the host, runtime directory, backups, administrative credentials, and any third-party provider credentials. Debug logs and exports should be reviewed before sharing because they may contain message-derived information.

8. Your controls, revocation, and deletion

• You can revoke Hexe’s Google access from your Google Account connections.
• You can disable the Gmail provider or remove stored OAuth credentials through the Hexe operator controls where available.
• Revoking Google access stops future authorized API access but does not automatically delete information already stored in the local Hexe runtime.
• To request deletion of Google user data and associated account records controlled by Hexe, email [email protected]. Include the connected Gmail address and enough information to identify the deployment. Do not send passwords or OAuth tokens.

For a self-hosted deployment, the system operator may need to complete deletion from the runtime host and backups. We will respond to verified requests as required by applicable law, subject to data we must retain for security or legal obligations.

9. Privacy rights and additional information

Depending on your location, you may have rights to access, correct, export, restrict, object to processing of, or delete personal information. You may also have the right to withdraw consent or complain to a data-protection authority. Contact us to exercise an applicable right.

Children

Hexe is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes to this policy

We may update this policy as Hexe’s functionality or legal obligations change. We will update the effective date and provide additional notice when required. Material changes to Google user-data practices will be reflected here before those practices begin.

10. Contact