Hex Pm
- The documents do not say whether your data trains AI.
- The policy rules out using your data for targeted ads.
- Data is shared only with the providers who run the service.
- The policy describes staff access for safety and legal checks.
Public packages stay forever; they can close you without notice; paid orgs auto-renew with no partial refunds.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Username, email, optional profile, GitHub login, IPs, user agents, logs, and billing details.
Read the exact line
Privacy policy
“To register you have to provide a username and an email address, and a password unless you sign up with GitHub; without them we can't create an account.”
Training
They run the registry, send mail, do security and abuse checks, and measure site use with Plausible.
Read the exact line
Privacy policy
“We process account data to operate your account and deliver the service, so the legal basis is our contract with you.”
Sharing
Your username is public; email is public unless you hide it; and sometimes a security foundation see data.
Read the exact line
Privacy policy
“Your profile is public: your username always, and your email address, which is shown by default and which you can hide in your dashboard.”
Kept
Public packages and audit logs can stay forever; private org content is kept 90 days after a subscription ends.
Read the exact line
Privacy policy
“We keep audit log entries indefinitely, because their purpose is to be a permanent record of what changed.”
Controls
You can edit your profile, hide email, see your audit log, and delete your account in the dashboard.
Read the exact line
Privacy policy
“Some of this you can do yourself in the dashboard: edit your profile and email addresses, review your audit log, and delete your account.”
Fine print
They can suspend you without notice; paid plans renew and unused time is not refunded; you can still go to court.
Read the exact line
Terms of service
“We may do so with or without cause and without notice, and we are not obliged to reinstate an account, an organization or any Content.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Hide your email and edit your public profile
Dashboard (profile settings)
Delete your account
Dashboard
Ask for access, , or a portable copy
Email support@hex.pm
Cancel a paid organization subscription
Change or cancel any time as described in Payment (Section 9); contact support@hex.pm for disputes
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can shut down your account or packages for any reason and do not have to warn you or bring it back.
Read the exact line
Terms of service
“We may do so with or without cause and without notice, and we are not obliged to reinstate an account, an organization or any Content.”
For example, they could reclaim your package name overnight and you would have no promised way to get it restored.
Deleting your account does not take your public packages or username off the internet, and some records stay.
Read the exact line
Privacy policy
“After deletion, public packages you published stay public, your username stays reserved so nobody else can take it over, and audit log entries and billing records aren't deleted with the account.”
For example, if you published a package with your real name in the metadata, it can stay downloadable after you leave.
If you cancel mid-month or mid-year, they keep the money for that period.
Read the exact line
Terms of service
“There are no credits or refunds for partial billing periods of use, including periods with an active subscription when the Services were not used.”
For example, cancelling an annual org plan after one month still costs the full year unless a special DPA exception applies.
They get a broad free license to copy and share anything you publish publicly.
Read the exact line
Terms of service
“by submitting, posting or displaying Content on or through the Services for public access, you grant us a worldwide, non-exclusive, license to use, copy, reproduce, process, adapt, modify, publish, transmit, display and distribute such Content”
For example, they can keep serving your package files and docs to the whole internet under that license.
A vulnerability report can still expose your email to the Foundation even if you hid it on Hex.
Read the exact line
Privacy policy
“The primary email address is sent even if you've hidden your email address on your public profile.”
For example, if someone reports a bug in your package, your hidden email can still be forwarded.
They promise almost nothing about uptime or that the service will work.
Read the exact line
Terms of service
“the Services are provided to you on an "AS IS" and "AS AVAILABLE" basis.”
For example, if the registry is down and your build breaks, the terms say that is your risk.
Actions like publishing or changing settings are logged forever, including IP and user agent.
Read the exact line
Privacy policy
“We keep audit log entries indefinitely, because their purpose is to be a permanent record of what changed.”
For example, a publish from years ago can still show who did it and from where.
you can still sue in court.
Read the exact line
Terms of service
“Nothing in these Terms affects any right you have to bring proceedings before a court, which are governed by Section 13.”
For example, a consumer can still take a dispute to court under Swedish law and local consumer rules.
Account deletion is available in the product, not only by emailing support.
Read the exact line
Privacy policy
“You can delete your account in the dashboard.”
For example, you can close the account yourself, though public packages still remain.
Their site analytics tool is not meant to build a lasting ad profile of you.
Read the exact line
Privacy policy
“It doesn't use cookies and doesn't track you across sites or over time, and it doesn't retain your IP address, so there's nothing about you for us to keep.”
For example, visiting docs pages should not create a cookie trail for ads.
Words to know
Legal words from the lines above, in plain English.
- legal basis
- The legal reason a company gives for using your data, such as your consent, a contract or its own interests. For example, a company may say it needs your address to deliver an order, which is a contract basis.
- worldwide license
- You let the company use your content anywhere on earth, usually for free and for as long as it likes. For example, a video you post can be shown in ads in any country without asking you again.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- as is
- You get the service in whatever state it is in, with no promise that it works or will keep working. For example, if the app deletes your photos by mistake, it is not promising to fix that or pay you back.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
How we got here · grade B · score 53/100 · 14 of 15 policy answers backed by a verified quote · 1 not stated
What does the app collect beyond what it needs to work?
They collect account details plus IPs, user agents, request logs, failed-login records, and billing info.
Does it record your voice, face or body, and what happens to that?
The documents do not describe collecting voice, face, or body data.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They say people review removals and they may read data for law, ToS, fraud, security, or support—not routine chat sampling.
Are you profiled or tracked for advertising?
They describe Plausible analytics without cookies or cross-site tracking and do not describe advertising profiles.
Do they sell or share your data, and can you opt out?
Non-public data is shared with listed subprocessors; vulnerability reports also go to a separate foundation as a recipient.
What rights do they take over what you type and what the AI makes?
You keep rights to your content; public posts get a worldwide royalty-free license so they can run and distribute the registry.
How long do they keep your data after you delete it, and can you delete it in the app?
You can delete in the dashboard, but public packages, reserved usernames, audit logs, and required billing records stay.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
There is no AI memory feature; they keep an account profile and audit log you can view, not a hidden companion memory.
Do they commit to basic security, and have they leaked data?
They say security measures are on a Security page and mention encrypted backups; no independent audit is described here.
Is there a real age gate, and are teens protected?
You may use the service only if you can form a binding contract; there is no described age check.
Will they tell you when the rules change, and is the policy specific?
Neither document shows a last-updated date; terms say they will post a notice and email, and continued use means you agree.
Can they close your account without warning, and can you get your data out first?
They may remove content and suspend users or organizations with or without cause and without notice.
If something goes wrong, who pays?
The service is AS IS; paid users’ claims in a year are capped at fees paid that period, with some legal exceptions.
Do subscriptions renew on their own, and can you get a refund?
Paid plans bill again when the next period starts; they say no credits or refunds for partial unused periods.
The privacy policy is 2,013 words at a fairly hard level (Flesch reading ease 50.3); the terms are 3,150 words at a college level.
