Privacy Policy
Updated on June 1, 2026
1. Data Controller
HiXP (contact: clashroyale@hixp.gg) is the data controller for personal data collected via the hixp.gg website.
2. Data Collected
- User account — email, username, password (hashed, never stored in plain text).
- Game data — the Clash Royale tag you provide; statistics and decks retrieved via the public RoyaleAPI.
3. Purposes and Legal Basis
| Purpose | Legal basis |
|---|---|
| Account and session management | Contract performance |
| Providing Clash Royale statistics (via RoyaleAPI) | Contract performance |
| Service improvement | Legitimate interest |
4. Retention Period
Account data is retained for 3 years after the last login, or until the account is deleted.
5. Hosting and Recipients
Your data is hosted with Supabase (authentication and database, EU region) and Vercel (hosting, EU/US edge nodes). No data is sold or shared with third parties for commercial purposes.
6. Your Rights (GDPR)
You have the right to access, rectify, erase, port, and restrict your data. To exercise these rights: clashroyale@hixp.gg.
In the event of a dispute, you may also contact the CNIL (French data protection authority).
7. Cookies
A cookie is a small text file placed in your browser when you visit a website. It helps maintain your session, remember preferences, or measure usage of the service.
Session cookies
Essential for authentication to work. They cannot be disabled without losing access to your account.
- sb-auth-token (Supabase) — maintains your login session. Duration: session.
- sb-refresh-token (Supabase) — automatic session renewal. Duration: 60 days.
Audience measurement
HiXP may use Vercel Analytics to measure traffic anonymously. No personal identifier is collected, no third-party cookie is set. Data is aggregated and never sold.
Advertising cookies
HiXP does not use any advertising or cross-site tracking cookies.
You can configure your browser to refuse or delete cookies: Chrome, Firefox, Safari.