Privacy Policy

Last updated: July 10, 2026

This policy explains how Hoxyd ("we", "us") processes personal data when you use www.hoxyd.com, in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act (Loi Informatique et Libertés). Our approach is simple: we collect the minimum needed to run the service, and whenever possible your data never leaves your device.

1. Data controller

The data controller is Louis Michaux, publisher of Hoxyd (see the Legal Notice).
Privacy contact: privacy@hoxyd.com.

2. What we collect, why, and on what legal basis

• Account data — email address, name, and a securely hashed password (or your Google account identifiers if you sign in with Google). Purpose: creating and securing your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Subscription & billing data — subscription status, billing history and payment method, handled by Stripe. We never see or store your full card number. Purpose: billing and account access. Legal basis: performance of a contract and legal obligations (accounting, tax).
• Transactional emails — email verification, password reset, billing notices. Legal basis: performance of a contract. We do not send marketing emails without your consent.
• Aggregated usage statistics — via Vercel Web Analytics, which is cookieless and does not track you across sites; data is anonymous and aggregated (pages viewed, country-level origin). Legal basis: legitimate interest in improving the service (Art. 6(1)(f)).
• Technical logs — standard server logs (IP address, timestamps) kept briefly by our hosting provider for security and abuse prevention. Legal basis: legitimate interest.

3. What stays on your device

Most Hoxyd tools run entirely in your browser. The files you compress, convert or edit, the passwords and keys you generate, and your drafts (link-in-bio pages, favorites, recent tools, preferences) are processed and stored locally on your device — they are not uploaded to or stored on our servers. Link-in-bio pages you publish are encoded in the link itself. For web tools (e.g. SEO audit), the URL you submit is fetched by our server to run the analysis but the result is not stored.

4. Processors and recipients

We share data only with the processors strictly necessary to run Hoxyd:

• Supabase (authentication & account database) — privacy policy.
• Stripe Payments Europe, Ltd. (payments & subscriptions) — privacy policy.
• Vercel Inc. (website hosting & anonymous analytics) — privacy policy.
• Upstash (storage of subscription status and short links) — privacy policy.
• LWS (domain & email services, France).

We do not sell personal data, and we do not share it with advertisers.

5. International transfers

Some processors (Vercel, Upstash, Supabase depending on region) may process data in the United States. These transfers are covered by the European Commission's adequacy decision for the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCCs), together with additional safeguards provided by each processor.

6. Retention

• Account data — kept while your account is active, deleted upon your request (see § 7).
• Billing records — kept for the duration required by French tax and accounting law.
• Subscription status & short links — kept while the associated account or link is active.
• Technical logs — retained briefly by our providers (typically less than 12 months).
• Local data — stored in your own browser; you can erase it anytime from Settings → Account → "Clear all my data", or via your browser.

7. Your rights (GDPR)

You have the right to access, rectify, erase and receive a copy (portability) of your personal data, as well as the right to restrict or object to certain processing and to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email privacy@hoxyd.com from the address linked to your account. We respond within one month at the latest. Account deletion removes your personal data from our systems, except what we must keep to meet legal obligations (e.g. invoices).

If you believe your rights have not been respected, you can lodge a complaint with the French supervisory authority, the CNIL (cnil.fr, 3 Place de Fontenoy, 75007 Paris), or with the supervisory authority of your country of residence.

8. Cookies

Hoxyd only uses storage that is strictly necessary to run the service (keeping you signed in, remembering your language). Our analytics are cookieless. Because we set no advertising or cross-site tracking cookies, no consent banner is required. Details in the Cookie Policy.

9. Security

Data in transit is encrypted (HTTPS/TLS). Passwords are hashed by our authentication provider and are never visible to us. Payment data is handled exclusively by Stripe, a PCI-DSS Level 1 certified processor. See our Security page for how to report a vulnerability.

10. Children

Hoxyd is not directed at children under 15. We do not knowingly collect personal data from children; if you believe a child has provided us data, contact us and we will delete it.

11. Changes

We may update this policy as the service evolves. Material changes will be announced on this page with a new "last updated" date. Continued use of the service after an update constitutes acceptance of the revised policy.

Contact

Questions about privacy? Reach us at privacy@hoxyd.com.