Privacy policy

Developer: Hexpit, an independent app by its developer . Contact: privacy@hexpit.app . Effective: 2026-10-22. Applies to: the Hexpit Android app (package app.hexpit) and the website hexpit.app.

Summary

• The Hexpit app collects no personal data and sends none to the developer. It has no account, no analytics, no crash reporting and no ads.
• Network tools send traffic only when you run them, to the host you enter. A few tools use a fixed public service when you tap their button (listed below).
• Your options and any connection details you save stay on your device, encrypted, and are left out of backups. You can erase them with “Wipe all data”, or by uninstalling the app.
• This website sets no cookies and runs no scripts.

1. Data the app collects and shares

None. Hexpit does not collect any data and does not share any data with anyone. It has no developer-run server, so nothing from the app is sent to one. This is also the answer given in the Data safety section of the Google Play listing.

The app contains no analytics, advertising or crash-reporting library. It does not use the advertising ID. It contains no code that identifies you or your device to the developer.

2. Network use

A tool uses the network only when you run it. Then:

• Tools that connect to a host you enter (for example ping, port scan, TLS probe, HTTP headers, WebSocket client, NTP and Wake-on-LAN) send their traffic to that host. That traffic goes to the host you chose, not to the developer. The host will see your IP address and whatever the tool sends, like any other client.
• Tools that use a fixed public service do so only when you tap their button. My IP asks Cloudflare (one.one.one.one) for the public address it sees. DNS lookup uses your system resolver unless you choose a public resolver (Cloudflare, Google or Quad9, over HTTPS) or enter your own. Whois queries registry RDAP servers, using IANA’s RDAP bootstrap data (data.iana.org) to find the right one.
• Hexpit does not send what you type into a tool to any AI service. The app has no such feature.

Those services and hosts are run by other parties under their own policies. Use network tools only on systems you own or are allowed to test.

3. What is stored on your device

• Options for tools, settings, favourites and recent tools.
• Connection profiles, passwords and keys, but only if you choose to save them. They are stored encrypted using the Android Keystore.
• Files you export. These are files you chose to create, and you control them.

The app turns off Android cloud backup and device-to-device transfer for all of its data (allowBackup is off and every data domain is excluded), so this data does not leave the device that way.

4. Deleting your data

The developer holds no app data about you, so there is nothing to delete on a server. To remove what is on your device:

• Settings, “Wipe all data” deletes saved connections with their passwords and keys, remembered tool options, settings, favourites, recent tools and temporary files. Files you exported are not deleted. It cannot be undone.
• Uninstalling the app removes its data from the device.

5. Permissions

Camera and location are requested only when you tap the feature that needs them, never at launch. Camera images are used to read a code and are not recorded or stored. The compass takes one coarse location fix, used once to work out magnetic declination, and does not store or send it. The app does not use background location, SMS, call logs, contacts, broad file access, or the advertising ID, and it declares no foreground service and no VPN service. Camera, motion sensors and location hardware are optional: the app installs without them.

6. Purchases and ads

The app has no ads and no purchases today. If optional in-app tips are added later, they will be processed by Google Play. Hexpit would see only the result of the purchase and never your payment details. This policy will be updated before that ships.

7. Third parties

• Google Play distributes the app. Google handles installs and updates under its own privacy policy.
• Hosts and services you reach through tools, as described in section 2.
• Buy Me a Coffee is used on this website only, through an optional link to a page on its own site. Nothing is sent to it unless you click. The app does not link to it.
• Cloudflare hosts this website and forwards email sent to the addresses below. It processes request data under its own policy, see section 8.

8. This website

• No cookies, no analytics, no scripts and no third-party resources: every page is plain HTML and CSS served from hexpit.app.
• Cloudflare delivers the site, and in doing so processes technical request data such as your IP address and browser user agent, for delivery and security. Its retention and handling are governed by Cloudflare’s own privacy policy. I do not run any analytics on visits.
• Email sent to support@, privacy@ or security@ hexpit.app is forwarded by Cloudflare to the developer’s mailbox and kept there as long as needed to answer you and for records. To have an email thread deleted, write to privacy@hexpit.app .

9. Security

Saved secrets are encrypted at rest with the Android Keystore. Fixed public services that the app contacts itself are reached over HTTPS. Tools that handle keys, tokens and credentials are hidden from the Android recent-apps screen, and tools that generate secrets also block screenshots and screen recording. To report a vulnerability, see the security page.

10. Children

Hexpit is a tool for developers and administrators. It is not directed at children, and it is intended for people aged 18 or over.

11. Your choices and rights

Because the app sends no personal data to the developer, there is no app data held about you to access, correct or export. For emails the developer holds, you can ask to see or delete them at privacy@hexpit.app . If you think data about you is being handled unlawfully, you may contact your local data protection authority.

12. Changes to this policy

This policy changes whenever the app starts to do something it describes here as not happening, such as adding a purchase flow, an AI feature, a new permission or a third-party SDK. The date above and the log below are updated each time, and a feature that would send data off your device will be disclosed before you can use it.

Change log

• 2026-10-22: first version.

Contact