Privacy Policy

Six Colors AB ("we", "us") is a Swedish company that operates the hex.pm, hexdocs.pm and hexorgs.pm websites, the hex.pm API and the package repository. We're the data controller for the processing described in this policy. You can reach us at support@hex.pm.

Account and package data is stored in the United States on Google Cloud Platform and Amazon AWS servers. The third party providers we use to operate the service process personal data on our behalf and are listed on the Subprocessors page.

One part of the service works differently: an organization's private packages and documentation, its membership and its audit log are controlled by that organization, and we process them on its instructions under the Data Processing Agreement. Request logs are ours; see "Logs and security" below.

Accounts

To register you have to provide a username and an email address, and a password unless you sign up with GitHub; without them we can't create an account. You can add profile information, such as a full name and social media handles, if you want to. If you choose to sign in with GitHub we receive your GitHub account identity.

Your profile is public: your username always, your email address, which is shown by default and which you can hide in your dashboard, and your full name and profile links (website, GitHub, Twitter, Bluesky, Elixir Forum, Slack, Freenode) if you add them. The public packages you own are also public. Your organization memberships and the private packages those organizations own aren't. Nothing else about your account is made public. Non-public data is shared only with the providers on the Subprocessors page and in the cases described under "Vulnerability reports" and "Disclosure" below.

We send transactional email, such as address verification and password resets, through the email provider on the Subprocessors page. For each email we send we log what kind of email it is, the time it was sent and the provider's message id, without the recipients, and keep that log for ten years. Emails about an organization, such as invitations, single sign-on and two-factor notices and data deletion notices, are also stored with their recipient addresses for 90 days after sending, so that delivery can be retried. After that we keep their subject, the time and the provider's message id, without the recipients.

We process account data to operate your account and deliver the service, so the legal basis is our contract with you. We keep it for as long as your account exists. You can delete your account in the dashboard. After deletion, public packages you published stay public, your username stays reserved so nobody else can take it over, and audit log entries and billing records aren't deleted with the account. Audit log entries keep your user id and username, and we remove your email addresses and profile handles from them when the account is deleted.

Public packages and documentation

Packages published to the public repository are public. Anyone can download the full contents of a package without an account, the metadata is shown on hex.pm, and the documentation is published on hexdocs.pm. Publishing requires an account; downloading doesn't.

Package contents and metadata may contain personal data the publisher chose to include, for example author names and email addresses. If a package contains personal data about you, it came from the publisher, not from us collecting it from you; see "Your rights" below.

We process public packages to run the registry, on the basis of our contract with the publisher. Published packages stay available indefinitely, including after the publisher deletes their account, unless removed under our policies. We keep a copy of every package and documentation tarball sent to us for publishing, including ones that failed, were reverted or were removed, to investigate malicious publishes.

Private packages

Packages published to an organization's private repository aren't public. They're available only to members of that organization, and so is their documentation. The organization is the controller of this content and we process it under the Data Processing Agreement; it's also covered by the confidentiality terms of the Terms of Service. When a subscription or a free trial ends we keep the organization's content for 90 days so the organization can retrieve it, and then delete its packages, their documentation and its policies. Its administrators are emailed when the deletion is scheduled and again a week and a day before it, and nothing is deleted if a subscription starts in the meantime. The organization, its members and its keys stay. On request we delete all of the organization's data earlier, and its access log entries and the copies in our backups are gone within 90 days of that.

Logs and security

The package repository at repo.hex.pm writes an access log for every request. Each entry contains the client IP address, the time, the request method and path, the response status, the user agent and the request size, and for a request authenticated with an API key or token, which key or token it used. The image proxy at img.hex.pm, which serves images embedded in package readmes, the documentation sites hexdocs.pm and hexorgs.pm, builds.hex.pm and the package storage at s3.hex.pm write the same log. These logs are available to our administrators and to the infrastructure providers on the Subprocessors page. We use them for security, for investigating abuse and to compute the aggregate download counts shown on hex.pm.

Entries for public packages and documentation keep the IP address and the key or token for three years, to investigate compromised releases, leaked credentials and manipulated download counts, which are often discovered long after the fact. After that we remove both and keep the rest indefinitely, because the download counts we publish for every past day are derived from them. Entries for an organization's private packages and documentation are kept in full until the organization's data is deleted, so that we can establish whether anyone accessed them without authorization, and are removed within 90 days of the deletion. hexorgs.pm entries written before we recorded which organization they were for are kept like public ones.

Requests to the hex.pm website and API are logged with the client IP address, user agent and referrer, and for a request authenticated with an API key, token or login session, which key, token or session it used. We keep these logs for ten years.

When an attempt to sign in to hex.pm, or to authenticate to its API, fails, we record the username or email address it was made with, the IP address, the user agent and why it was refused, so that we can detect attacks on accounts. We keep these records for ten years. A request to the package repository refused for its key or token is in the repository's access log described above, without the reason.

When you take an action that changes something, such as publishing a package, generating a key or changing account settings, we record it in an audit log together with the IP address and user agent of the request that performed it. You can see your own audit log in the dashboard, and organization administrators can see their organization's. We keep audit log entries indefinitely, because their purpose is to be a permanent record of what changed. Entries about public packages and other public content are kept even after the account or organization that made them is deleted, and they keep a copy of who acted. Entries about an organization's private packages and policies are part of that organization's data under the Data Processing Agreement and are deleted with them, and the organization's other entries are deleted with the organization. On request we can remove the identifying details from your entries.

We delete a session or token within a day of its expiry or revocation, and an API key 90 days after it expires or is revoked, and keep a record of who held it, what it could access, when it was created, used and revoked, and the IP address and user agent of its last use. The same record is kept for the keys, tokens and sessions of a deleted account. We keep these records indefinitely, to investigate account takeovers and malicious publishes.

Sign up, password reset, email verification and the package report form are protected by hCaptcha, which receives your IP address and browser data to tell people from bots. Application errors are reported to the error tracking provider on the Subprocessors page and can include the request data that was in scope when the error happened; they're deleted on that provider's retention schedule.

The legal basis for all of this is our legitimate interest in securing the service, preventing abuse and knowing how the service is used. The measures we use to protect this data are described on the Security page.

Analytics

The websites use Plausible Analytics to measure aggregate usage, such as which pages are visited and where visitors arrive from. Plausible receives the page URL, the referrer and your IP address. It doesn't use cookies and doesn't track you across sites or over time, and it doesn't retain your IP address, so there's nothing about you for us to keep. The legal basis is our legitimate interest in understanding how the websites are used.

Cookies

We use a session cookie to keep you logged in on hex.pm; it expires after 30 days. hexorgs.pm sets its own session cookie to authenticate you as an organization member when you read private documentation. The session cookie is also set before you log in, on any page with a form, because it carries the token that protects those forms from cross-site request forgery.

Resources loaded by your browser

Some pages load resources directly from third parties, so your browser contacts them and they see your IP address: Google Fonts on every page, Gravatar wherever a profile picture is shown, Stripe on billing pages, and hCaptcha on sign up, password reset, email verification and the package report form. Gravatar also receives a hash of the email address the picture is derived from.

Billing

Organizations with a paid subscription provide billing details such as the billing name, address and VAT number. Payments are processed by Stripe. We also record the IP address the payment details were entered from and the country it resolves to, because the VAT rate depends on the country you give us and we have to be able to show it was the right one. The legal bases are our contract with the organization, for charging for the service, and legal obligation, because Swedish accounting and tax law requires us to keep billing, payment and tax records. We keep those records for as long as that law requires.

Vulnerability reports

When someone submits a vulnerability report for a package, we send the report to the Erlang Ecosystem Foundation CNA, which triages vulnerabilities in the ecosystem and contacts the people involved. The submission contains the report's summary and description, the name, username and primary email address of the reporter, and the same three fields for each of the package's owners. For a package owned by an organization it also includes its administrators, or all its members if no administrator has a verified email address. The Foundation can also ask us, by username or email address, for the name, username and primary email address of a hex.pm user it invites to work on a vulnerability case, and we provide them. In both cases the primary email address is sent even if you've hidden your email address on your public profile. When you delete your account and we have sent the Foundation your details, we send it your username and primary email address so it knows the account was deleted.

The Foundation decides for itself how it uses this data, so it's a separate controller and a recipient of the data rather than a provider acting on our behalf. The legal basis for the disclosure is our legitimate interest, shared with the ecosystem, in coordinated handling of security vulnerabilities.

Communication

Emails to @hex.pm addresses are stored, including the sender's address and the contents. They're available internally and to the mail provider on the Subprocessors page. We keep correspondence for as long as it's needed to handle the matter and to keep a record of it, on the basis of our legitimate interest in running support and documenting what was agreed.

Disclosure

We may disclose personal data when required by law, for example to comply with a subpoena, or when your actions violate the Terms of Service. This doesn't apply to an organization's private content, where disclosure is governed by the Data Processing Agreement and the confidentiality terms of the Terms of Service.

International transfers

The service runs on infrastructure located in the United States, so operating it involves transferring personal data there.

Six Colors is the exporter for those transfers and is responsible for the transfer mechanism. For each provider in the United States we rely on either the European Commission's adequacy decision for the EU-US Data Privacy Framework, where that provider is certified, or the Standard Contractual Clauses adopted by the European Commission, together with the UK Addendum and the Swiss amendments where those apply. For a copy of the clauses, contact support@hex.pm. Backups of the package repository are encrypted with a key only we hold before they're written to Google Cloud Storage, so Google can't read them.

Your rights

You can ask us for access to the personal data we hold about you, and for rectification, erasure, restriction of processing, or a copy of the data you provided in a portable format. You can object to any processing we base on legitimate interests. Where processing is based on consent, you can withdraw it at any time without affecting what was done before. Some of this you can do yourself in the dashboard: edit your profile and email addresses, review your audit log, and delete your account. For everything else, email support@hex.pm.

Erasure has limits: published public packages stay public, a deleted account's username stays reserved, audit log entries about public content are kept as a permanent record, and we keep records the law requires us to keep, such as accounting records. Data we delete stays in our backups for up to 90 days after the deletion, and until it's gone it isn't restored or used for any other purpose.

For personal data inside an organization's private packages, direct your request to that organization; it's the controller, and we forward requests we receive to it.

If you believe we're processing your personal data unlawfully you can lodge a complaint with a supervisory authority. Our supervisory authority is the Swedish one, Integritetsskyddsmyndigheten (IMY), but you can also complain to the authority where you live or work.

Questions

Any questions about this Privacy Policy should be addressed to support@hex.pm.

Changes

We may change this Privacy Policy from time to time. The detailed history of changes can be found in the git repository history for this document.

Credit and License

Parts of this policy document were originally based on npm's Privacy Policy which in turn is partly based on the WordPress.org privacy policy.

This document may be reused under a Creative Commons Attribution-ShareAlike License.