HexPlayer is a media player for Android, made by The BugHex ("we", "us"). It plays the music and videos on your device, it can play a web link you give it, and it is paid for by ads. This policy explains what stays on your phone, what leaves it, and who receives it.
The short version
- Your media never leaves your device. Your files, your library, what you play, your favourites, albums, listening history and settings all stay on your phone. HexPlayer never uploads them, and never sends them to us, to Google, or to anyone else.
- There are no accounts. The app never asks for your name, email address or phone number.
- A web link you play goes only to the server in that link. HexPlayer connects to that address and nothing else to play it. Details.
- The app shows ads from Google AdMob. To choose, count and pay for those ads, Google receives information about your device, including its advertising ID. Where the law requires it, you are asked first, and you can change your answer at any time. Details.
- Crash reports go to Firebase Crashlytics, so we can find and fix what broke. Details.
- Usage statistics go to Google Analytics for Firebase, so we know which features get used. They are not linked to your name or to any account. Details.
- Notifications from us are delivered through Firebase Cloud Messaging. Details.
- Your own songs and videos play with no connection. While you are offline no ads load, and crash reports and statistics wait on your device until you are next online.
We do not sell your personal information.
What stays on your device
What the app reads
| What | Why | Where it goes |
|---|---|---|
| Audio and video files on your device, and their metadata (title, artist, duration, file path, embedded album art) | To show you your library and play it | Read from Android's MediaStore; nothing leaves the device |
| A file another app hands to HexPlayer when you choose Open with or Share | To play the file you chose | Read only through the one-file permission the other app grants, only while playing it. It is not copied, and it is not added to your library or your listening history |
What the app changes on your device
Only what you ask for, and only after you confirm it:
- Rename a media file — changes its file name.
- Delete a media file — removes it from your device permanently.
- Hide a media file — moves it into a hidden folder (
Movies/.HexPlayer HiddenorMusic/.HexPlayer Hidden), so it no longer appears in your library or in other apps. Unhide moves it back. Hidden files stay on your device if you uninstall the app, where a file manager that shows hidden files can reach them.
On Android 11 and later, Android itself asks you to allow each of these for the specific file.
What the app stores
All of it stays in the app's private storage on your device, in a location no other app can read:
- Your favourites — which tracks you have hearted.
- Your albums — the collections you create, and which tracks are in them.
- Your listening history — how many times each track has been played and when, used for "recently played", "most played", and the totals on the profile screen.
- Your hidden files — for each file you hid, where it was and where it is now, so it can be put back.
- Your settings — which file formats, folders and short files to show, the library sort order, whether to display real album art, your video player preferences, your equalizer settings, and the original titles of songs you renamed (so the new name is the one shown).
- Links you have played — up to the 20 most recent web links, with their names, so you can play them again. Remove one with a long press, or all of them with Clear in the Library.
- Your ad privacy choices — the answer you gave in the consent form, kept on your device by Google's consent software so the app knows which ads it may show.
- Your current listening session — the queue, your position in the current track, and your shuffle, repeat and speed settings, so the app can resume where you left off.
- A cache of your library — a copy of the media metadata Android already gave it, so the app opens instantly instead of re-scanning every launch.
None of this is sent to us or to Google. Deleting the app deletes all of it.
Android Backup
If you have Android's backup-and-restore enabled, the operating system may include some of this app's data in your device backup, which is stored in your own Google account under Google's terms. The app declares which of its data may be included:
- Included: your favourites, albums, listening history, hidden-file records and settings — the things you would not want to lose when you change phones. They share one database file with the library cache, so that cache is included with them.
- Excluded: for cloud backups, your current playback session (it refers to files on your old device, so restoring it elsewhere would be meaningless) and the links you have played (a media link can contain a private access token, which does not belong in a cloud backup). A direct phone-to-phone transfer does carry both across. The media files themselves, hidden ones included, are never part of the app's backup.
You can turn Android backup off entirely in your system settings.
What leaves your device
HexPlayer makes two kinds of connection: to the server in a web link you play, and to Google, for ads and the Firebase services below. Everything sent to Google is encrypted in transit. None of it includes your media files, the titles and artists in your library, or a record of what you play, with the one exception described under crash reports.
Playing a web link
When you play a link — one you type or paste into Play a link, or one another app hands to HexPlayer — the app connects to the server at that address, the same way a web browser would, and plays what it sends back. Like any web request, this tells that server:
- your device's IP address, which it needs in order to reply;
- the address you asked for;
- a user agent, which says the request comes from HexPlayer and names the app, Android and
media-library versions (for example
HexPlayer/1.0.1 (Linux;Android 14) AndroidXMedia3/1.10.1).
That server is run by whoever published the link, not by The BugHex, and what it does with its own logs is governed by its own privacy policy. HexPlayer sends it no identifiers, no account, nothing from your library and no cookies. We operate no server that sees any of this, and the links you play are never sent to us, to Google, or to the services below.
A link to http:// rather than https:// is not encrypted, so others on the same network could see
what you are playing, as with any unencrypted website. Many internet radio stations only offer
http://, which is why HexPlayer plays such links.
Ads (Google AdMob)
HexPlayer shows ads served by Google AdMob. To do that, Google's ads software in the app collects:
| What | Why |
|---|---|
| Your device's IP address, which can indicate your approximate location (country or city, never a precise location) | To pick ads relevant to where you are, and to detect fraud |
| Your device's advertising ID and app set ID | To limit how often you see the same ad, measure ads, and — only if you allow it — personalise them |
| How you interact with ads (views, taps, video ads watched) and when the app is launched | To count and pay for ads, and to detect fraud |
| Diagnostic information, such as how quickly ads load and how they perform on your device | To keep ads from slowing the app down |
Google uses this information under its own privacy policy, and may share it with the ad technology providers it works with. You can read how Google uses information from apps that show its ads at policies.google.com/technologies/partner-sites.
Personalised ads and consent. If you are in the European Economic Area, the United Kingdom or Switzerland — or anywhere else a law requires it — the app shows Google's consent form before it shows personalised ads. If you decline, you still see ads, but they are not personalised. You can change your answer at any time from Privacy options in the app's settings.
Your advertising ID. You can reset or delete it at any time in your phone's settings, usually under Settings → Google → Ads or Settings → Privacy → Ads. Once it is deleted, apps cannot use it to personalise ads.
Crash reports (Firebase Crashlytics)
When the app crashes, it sends a crash report to Firebase Crashlytics, a Google service. A report contains:
- the technical trace of where in the app's code the crash happened, and its error message. If the crash happened while opening a file or a link, that message can include the file's name or location, or the link's address;
- the state of the app at the time, such as its version and whether it was on screen;
- details about your device, such as its model, Android version, free memory and storage;
- random IDs created for this installation of the app, so we can tell how many devices a crash affects. They are not linked to you, your Google account or your advertising ID.
We use crash reports only to find and fix bugs. Crashlytics keeps them for 90 days, then deletes them.
Usage statistics (Google Analytics for Firebase)
The app sends Google Analytics for Firebase statistics about how it is used — for example, which screens are opened, how long a session lasts, and which features (such as the sleep timer, the equalizer or the video player) are used. They never include the names of your files or the links you play. With them, it sends:
- a random ID created for this installation of the app;
- your device model, Android version, language and the app version;
- an approximate location (country or city), worked out from your IP address;
- your device's advertising ID, where your device makes it available.
Where consent is required, Analytics follows the choice you made in the consent form. We use these statistics only to understand which parts of the app are worth improving. Google keeps the detailed data for at most 14 months, then deletes it; the totals in our reports, which say nothing about any one device, are kept longer.
Notifications (Firebase Cloud Messaging)
If we send notifications, such as news about an update, they are delivered through Firebase Cloud Messaging, a Google service. To reach your device, it uses a random ID and a delivery token created for this installation of the app, along with the app's version. It does not see your media, your library or the links you play. You can turn notifications off at any time in Settings → Apps → HexPlayer → Notifications.
Google keeps the installation ID until we ask for it to be deleted, and then removes it from its systems within 180 days. To have yours deleted, email us at the address below.
Permissions
HexPlayer, and the Google libraries built into it, use these permissions:
READ_MEDIA_AUDIOandREAD_MEDIA_VIDEO(Android 13 and later), orREAD_EXTERNAL_STORAGE(Android 12 and earlier) — to find and play your media files. Without these the app has no library to show.WRITE_EXTERNAL_STORAGE(Android 10 and earlier only) — requested only at the moment you ask to rename, delete or hide a file, never at launch. On Android 11 and later the app has no such permission: Android shows its own confirmation for each file instead.POST_NOTIFICATIONS(Android 13 and later) — optional. Used to show the playback notification with its play/pause and skip controls, and notifications from us. Deny it and notifications simply do not appear; everything else works normally.FOREGROUND_SERVICEandFOREGROUND_SERVICE_MEDIA_PLAYBACK— so playback continues when the app is not on screen. These are not runtime permissions and involve no data.WAKE_LOCK— so audio is not interrupted while the screen is off, so Wi-Fi stays awake while a web link plays, and so a notification can be delivered. No data is involved.INTERNET— to play a web link you choose, to load ads, and to send the crash reports and statistics described above.ACCESS_NETWORK_STATE— to tell whether your device is online, so a link that can't be reached can say "you're offline" rather than "server not found", and so ads and reports wait for a connection. It reveals nothing about the networks you use.AD_ID, and Android's ad services permissions (ACCESS_ADSERVICES_AD_ID,ACCESS_ADSERVICES_ATTRIBUTIONandACCESS_ADSERVICES_TOPICS) — let Google's ads software read your advertising ID, and use Android's own privacy-preserving advertising features where your phone has them. You can turn those features off in your phone's privacy settings.com.google.android.c2dm.permission.RECEIVE— lets Firebase Cloud Messaging deliver notifications from us.
The app does not request location, contacts, camera, microphone, phone state, or access to any files other than media.
Children
HexPlayer is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has used the app and want information about them deleted, contact us at the address below.
Your choices and rights
- Personalised ads: change your answer from Privacy options in the app's settings, or delete your advertising ID in your phone's settings.
- Notifications: turn them off in Settings → Apps → HexPlayer → Notifications.
- Nothing sent at all: your own songs and videos play with no internet connection. While you are offline, no ads load and nothing is sent.
- Deleting your data: uninstalling the app deletes everything stored on your device. The information sent to Google is not linked to your name or any account, so we cannot look it up by who you are. Crash reports are deleted after 90 days and detailed usage statistics after 14 months. If you want it deleted sooner, email us and we will delete whatever we can identify.
If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, delete or restrict the use of your personal information, to object to its use, and to complain to your local data protection authority. We rely on your consent for personalised ads and usage statistics, and on our legitimate interest in keeping a free app working and paid for — non-personalised ads, crash reports and notifications — for the rest.
Some US state laws, such as California's, may treat using an advertising ID for personalised ads as "sharing" personal information. You can opt out of that in the app's privacy options or by deleting your advertising ID.
Changes to this policy
If a future version of HexPlayer collects anything not described here, this policy will be updated before that version is published, and the "Last updated" date above will change.
Contact
Questions about this policy, or a request about your data: support@thebughex.com
The BugHex, Dubai, United Arab Emirates.
You don't have to take the permissions list on trust. Android shows everything an app is allowed to do: open Settings → Apps → HexPlayer → Permissions, then All permissions from the menu (the name varies by phone). And you can see for yourself that your library needs no connection: turn on airplane mode and everything but playing a web link and loading ads keeps working.