Privacy policy

Last updated October 14th, 2026.

At HexOS, your privacy is our priority. This Privacy Policy explains how we collect, use, and protect your personal information when you use our services. By using our services, you agree to the terms of this Privacy Policy.

Information We Collect

We may collect the following types of information:

  1. Personal Information:

    • Name, email address, phone number, billing address, and other contact details you provide when creating an account or contacting us.

  2. Usage Data:

    • Information about your use of our website or app, including IP address, browser type, device type, and browsing behavior.

  3. System State Information:

    • Only folder locations/names identified as preference folders are stored, along with preference settings, task success/failures, and other essential system state information required for functionality.

    • For Bring over, we also keep one-way hashes of a connected cloud account and its token.

  4. Payment Information:

    • When making purchases, we collect billing details necessary to process your payment. (Note: We do not store payment information directly; payments are processed by secure third-party providers.)

Information We Don’t Collect

HexOS's servers never receive, store or read the contents of your files. When you use the hosted Command Deck, the names of the files and folders you browse pass through our servers on their way to your browser; we don't keep them, except in the report of an error when a request fails.

Bring over: copying from other servers, drives and cloud accounts

Bring over copies folders you choose from another server, a PC, a drive, or a cloud account (Dropbox, Microsoft OneDrive, Google Drive, iCloud Drive or iCloud Photos) to your own HexOS server. It runs only when you start it.

Your files go straight to your server

The copy runs on your HexOS server, which reads the folders you pick and writes them to your server's storage. HexOS's own servers never receive, store or read your files.

What HexOS asks a cloud account for

HexOS asks only for read access, and only when you sign in to an account in Bring over:

Google Drive: to see and download your Google Drive files (https://www.googleapis.com/auth/drive.readonly).

Dropbox: your account's name and email address, and to view and download your files (account_info.read, files.metadata.read, files.content.read).

Microsoft OneDrive: your basic profile, to read your files, and to keep that access while the copy runs (User.Read, Files.Read, offline_access).

HexOS uses this access only to show you your folders and their sizes, to copy the folders you pick to your server, and to show which account you signed in to (its name and email address). It never changes, moves or deletes anything in your account.

Where your sign-in is kept

The access token your cloud provider issues is stored on your HexOS server, with the account's name and email address. HexOS's servers hold the secret for HexOS's own app and renew your server's access through it. They keep only one-way fingerprints (hashes) of your token and account, never the token itself or your files. When you use the hosted Command Deck, the names and sizes of your folders pass through HexOS's servers on their way to your browser; HexOS doesn't keep them, except in the report of an error when a request fails.

iCloud

Apple doesn't offer apps a way to sign in to iCloud, so your HexOS server signs in the way icloud.com does. Your Apple Account password is kept only in your server's temporary, memory-backed storage while the copy needs it, and is removed when the copy ends or your server restarts. Your server also keeps the session token Apple issues, so you don't have to enter a code each time; it stays on your server. HexOS's servers aren't involved.

How long access lasts

HexOS gives up its access when the last folder of a copy is finished or cancelled, or when you put the copy back. At Google and Dropbox, HexOS also revokes its access; at Google, it does so once no other copy is still reading the same account. Microsoft doesn't let apps revoke a personal account's permission, so HexOS deletes its token, and your Microsoft account keeps listing HexOS until you remove it. Access that nothing has used for 90 days ends on its own. You can remove HexOS at any time from your Google Account (https://myaccount.google.com/connections), your Dropbox account (https://www.dropbox.com/account/connected_apps) or your Microsoft account (https://account.live.com/consent/Manage).

What we don't do with this data

We don't sell it, share it, use it for advertising, or use it to train AI or machine learning models. No one at HexOS reads it, except with your permission, when needed for security, or to comply with the law.

Google API Services

HexOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How We Use Your Information

We use the information collected to:

  • Provide and improve our services.

  • Process transactions and manage your account.

  • Respond to your inquiries and provide support.

  • Send important updates, including service announcements and promotional materials (you can opt out at any time).

Sharing Your Information

We do not sell your personal information. However, we may share your information with:

  1. Service Providers:

    • Third-party companies that help us deliver our services, such as payment processors and email providers.

  2. Legal Authorities:

    • If required to comply with legal obligations, enforce our policies, or protect our rights.

How We Protect Your Information

We use industry-standard security measures to safeguard your data, including encryption, firewalls, and secure data storage. Despite our best efforts, no system can be completely secure. You are responsible for maintaining the confidentiality of your account credentials.

Your Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you.

  • Request corrections to inaccurate data.

  • Delete your personal data, subject to applicable legal or contractual requirements.

  • Opt out of marketing communications.

To exercise these rights, contact us at support@hexos.com.

Cookies and Tracking Technologies

Our website may use cookies to enhance user experience and analyze traffic. You can manage cookie preferences through your browser settings.

Third-Party Links

Our services may include links to third-party websites. We are not responsible for the privacy practices of these external sites.

Changes to This Policy

We may update this Privacy Policy periodically. Significant changes will be communicated through email or a notice on our website.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:
Email: support@hexos.com