1. Who we are
Hoekedex is made and offered by the makers of Hoekedex (“we”). You can reach us at info@hoekedex.net, for privacy questions, to report abuse and for everything else.
Hoekedex is built differently from most apps. There are no accounts and there is no database. Everything you make in the app lives on your own phone. We don’t get to see it, can’t change it and can’t get it back for you either. We only process something in the relay (sections 3 to 6), when selling licence codes (section 9) and on this website (section 10).
2. What’s on your phone
On first launch your phone makes two key pairs by itself. Your ID follows from them: a random code of 26 characters that tells nobody who you are. All your data sits in a vault on your device, in the storage of the app or your browser.
| What | Where it is | Who can see it |
|---|---|---|
| Your cards: name or nickname, photo, age or birthday, star sign, stats, notes, moments | Only your phone and your own backup | Only you |
| Your profile: name, colour, star sign | Your phone; a copy goes to friends and group members | You, your friends and your group members |
| Your keys | Your phone and your backup | Only you |
| Friends, groups, group messages and challenges | Your phone and the phones of the group members | You and the friends or group members involved |
| Night Camera photos | The group members’ phones, not in backups | The group, only after developing |
| XP, missions, achievements, scores, purchases and settings | Only your phone | Only you (your friends see your XP in a group and your arcade scores) |
| Face ID or fingerprint (passkey) | Your phone’s secure chip and password manager | Only you |
Your cards can contain sensitive information, for example about your sex life. That information never leaves your phone, except in a backup you make yourself, encrypted with a password only you know.
3. What the relay sees and keeps
Phones can’t always reach each other directly. That’s why there is a small server, the relay, that passes sealed envelopes between phones.
What the relay processes
- Your ID and your public keys. When connecting, your phone proves with a signature that the ID belongs to you.
- Your IP address, as with any internet connection, also when setting up a direct connection (the STUN request from section 4).
- When you’re connected and whether the app is open.
- Which ID you send an envelope to and how big it is.
- The contents of the envelope, but they are end-to-end encrypted. The relay can’t open it.
What the relay keeps
- In principle nothing on disk. Everything sits in working memory and is gone as soon as the relay restarts. The only exception is notifications (section 6).
- Mailbox: if the recipient is offline and a message may wait (a text message, a friend request, a group update), the encrypted envelope stays in memory for up to 24 hours, at most 300 messages and 4 MB per recipient. Once delivered, it’s deleted straight away. For a shared location the mailbox only keeps the newest one.
- Online status: the relay only tells someone whether you’re online if you added them and they added you too, and only if neither of you blocked the other.
- Logs: only counts, such as how many connections are open. Never IDs, IP addresses or content.
We only use this data to deliver messages and to protect the relay against overload. Legal basis: our legitimate interest and our agreement with you to make the app work.
4. Chat, groups, game rooms and the Night Camera
Chat and snaps
Chat messages and snaps go over a direct connection between your phones (WebRTC) where possible, end-to-end encrypted. What you’ve both seen disappears when you close the chat. A snap can be viewed once.
- To set up a direct connection, your phone asks our own relay what its public address is (a STUN request). No other party is involved, and nothing else leaves your phone apart from the encrypted connection with your friend.
- With a direct connection your phones see each other’s IP address. That’s how peer-to-peer works. So only chat with people you trust.
Groups
A group lives on the members’ own phones: the group chat, the challenges and the leaderboard. Every change is signed by whoever makes it and goes encrypted to all other members, via the relay. Members who aren’t your friends also get your name, colour and what you do in that group.
Game rooms
A game room is a temporary room for a game. It only exists in the memory of the phone of whoever makes it; nothing is stored. Fellow players only see each other as a name and colour. Secret information in a game, like a word or a role, only goes to the player it’s meant for. A custom quiz stays on the maker’s phone. The room ends when the maker ends it, is away for more than 2 minutes, or after 3 hours.
Night Camera
With the Night Camera, group members take photos for one night. They stay on the phone of whoever takes them and are only shared after developing, directly between the group’s phones, end-to-end encrypted. If a direct connection doesn’t work, the relay passes on the encrypted pieces live, without storing them or putting them in the mailbox. Photos contain no location or other metadata and are not included in backups. You can have your own photos deleted for everyone.
Note: we can’t stop screenshots. Only send and share what you’d be happy to show, and ask before you take someone’s picture.
5. Radar and Friend radar
Everyone nearby
This radar is off until you switch it on yourself, always with a timer from 15 minutes to 2 hours. After that it switches off by itself.
- Your phone turns your location into a square: Close by (about 50 metres) or Area (about 1 km). Only that square goes to the relay, and only while the app is open. Your exact location never leaves your phone.
- If you close the app, you stay visible at the last square until the timer ends. You are never tracked in the background.
- Others nearby see your name, trainer level, colour and the rarity of your rarest card, with a temporary, random code. Your real ID stays hidden until you both wave; then the relay exchanges your IDs and public keys so you become friends.
- If there are fewer than three others nearby, nobody sees anybody. People you blocked can’t see you and you can’t see them.
- The relay forgets you as soon as the timer runs out or you switch the radar off.
Friend radar
With the Friend radar you share your location with friends or a group you choose.
- Per person you choose Exactly (about 10 metres) or Roughly (about 1 km), and for how long: from an hour to two weeks, until a date, until the end of the group, or ‘always’ with a weekly reminder.
- Starting, adding someone, choosing Exactly and sharing for a long time ask for your PIN, Face ID or fingerprint.
- Your location is only sent while the app is open, end-to-end encrypted per person. The relay can’t read it and keeps at most the newest one not yet delivered. Nobody keeps a history.
- Under ‘Who sees me?’ you always see who you’re sharing with. ‘Hide me now’ stops everything with one tap; the others then only see that you’ve stopped sharing.
- The settings only live on your phone and are not included in a backup, so sharing never starts again by itself.
Legal basis for both radars: your consent, which you give by switching them on and withdraw by switching them off. Also read using the radar wisely.
6. Notifications
Notifications are off until you switch them on yourself. A notification only says that something is waiting for you (a message, a wave, a match, the radar is off), never what or from whom. The relay doesn’t know that either.
- If you switch on notifications, the relay keeps your ID, your phone’s notification address, two keys from your browser, when you last refreshed it and possibly a reminder time. Nothing else. So that notifications keep working after a restart, this may be stored in a file on the server.
- If you switch notifications off, or your phone doesn’t refresh them for 30 days, this is deleted.
- The notification goes through your phone’s service: Apple, Google or Mozilla. They only see that an encrypted notification of a fixed size was sent, not what’s in it.
- On iPhone, notifications only work when Hoekedex is on your home screen (iOS 16.4 or newer).
Legal basis: your consent.
News and specials. If you turn this notification on (it’s off by default), the relay keeps one flag with your push subscription, so it can let you know a few times a year that a Holiday Special is starting. Turn it off and the flag is gone.
Holiday Specials. To unlock a special, the app asks the relay for the date, with a request signed with your Hoekedex ID. The relay sends back a signed proof and stores nothing else.
7. What you control
- App lock: if you put a PIN on the app, your vault is encrypted (AES-GCM, with a key derived from your PIN via PBKDF2 with 600,000 rounds). By default the app locks again after 5 minutes in the background.
- Face ID or fingerprint: on top of the PIN you can open the app with Face ID, Touch ID or your fingerprint. That works with a passkey on your phone; the keys stay on your phone and nothing goes to us or the relay. Note: anyone who gets past your phone’s security, including with the passcode, can then open the app.
- Backup: a
.hoekedexfile, encrypted with a separate backup password. You choose where it goes, for example iCloud Drive, Google Drive or Files. Those services only see an encrypted file. If you lose the password, nobody can open the backup anymore, not even us. - Blocking: your phone throws away everything that person sends, and the relay passes nothing on, no longer shares your online status and doesn’t show you to each other on the radar.
- Delete everything: with ‘Delete everything’ in the app, by removing the app, or by clearing the app’s website data in your browser. Friends and group members keep what you already shared with them until they delete it themselves; you can first have your own Night Camera photos removed everywhere.
8. Games, drinks and Extreme
Games have levels from Innocent to Hot. Extreme is off until an adult switches it on in Settings, and everyone who plays confirms first. Drink mode and the chosen levels are settings on your phone; we process nothing about them. Game content, such as questions and dares, is built into the app; the Couples Pack is shipped as an encrypted package and opened on your phone.
9. Purchases
Paid extras (themes, Hoekedex Pro, the Couples Pack and the Summer Pass) come later. Until then you can’t buy anything in Hoekedex and this section doesn’t apply yet.
- App Store and Google Play: Apple and Google handle the payment under their own privacy terms. The app is only told which product you bought and stores that on your phone. We don’t get any data from your Hoekedex or any payment details from them.
- Licence codes: a code is checked on your phone with a digital signature. The app doesn’t report anything back. When you buy a code, your email address (to send the code) and your payment details are processed by the payment provider. We only keep what we’re legally required to keep for our accounts.
10. This website and the downloads
This website uses no cookies, no analytics, no trackers and no fonts or scripts from other parties. The only thing it remembers, in your own browser, is whether you dismissed the language hint. The site is delivered through Cloudflare. Like any hosting provider, Cloudflare processes technical data such as your IP address to deliver the pages and the app download and to stop attacks. We don’t switch on any visitor statistics there.
11. Data about other people
On your cards you note down information about other people. As long as it only lives on your own phone and you use it for yourself, that’s personal use. The GDPR generally doesn’t apply to that (the household exemption). We never receive this data.
If you share information or photos of someone else, for example with a screenshot or in the Night Camera, you are responsible for that. Only do it with consent. Also read the guidelines.
12. How long things are kept
| What | How long |
|---|---|
| Everything on your phone | Until you delete it |
| Envelope in the relay’s mailbox | Until delivery, 24 hours at most, only in memory |
| Online status and ‘last seen’ | Only in the relay’s memory, until it restarts |
| Everyone nearby radar | Only in memory, until the timer runs out (2 hours at most) |
| Friend radar | The newest location until delivery, only in memory |
| Game room | Only on the maker’s phone, until the game stops (3 hours at most) |
| Notification address | Until you switch notifications off, or 30 days without refresh |
| Relay logs | Only contain counts, no personal data |
| Data when buying a licence code | For as long as the legal retention period lasts |
13. Your rights
Under the GDPR you have the right to access, correct, delete, restrict, object to and port your data. Because we have no accounts and no database, almost all your data lives on your own phone. There you can view, change and delete it yourself. What the relay holds in memory for a brief moment, we can’t link to you.
For questions or requests, email info@hoekedex.net. We reply within a month. If you disagree with us, you can file a complaint with the data protection authority in your country; in the Netherlands that’s the Autoriteit Persoonsgegevens.
Hoekedex is only for people aged 18 and over.
14. Security
- Keys: ECDSA P-256 for signing and ECDH P-256 for agreeing on keys, made on your own phone.
- Messages, locations and photos between phones: AES-256-GCM with a key that only the two phones have (derived with HKDF-SHA256).
- Groups: every event is signed by whoever makes it, and every phone checks that signature.
- Night Camera: every photo is checked against the fingerprint (SHA-256) in the photographer’s signed message.
- Verification code: compare the 24-digit code in person to be sure you’re talking to the right person.
- The connection to the relay is encrypted (TLS).
No system is watertight. If you find a security problem, please report it to info@hoekedex.net.
15. Changes and contact
If anything changes in how Hoekedex handles data, we update this policy and put the new date at the top. We also show big changes in the app.
Contact: info@hoekedex.net.