# Privacy Policy Updated November 1, 2026 At xaround, we are committed to protecting your privacy and being transparent about how we handle your information. This Privacy Policy ("Policy") explains what data we collect, how we use it, and your choices. ## Information We Collect **Account Information:** We collect your sign-in credentials (Google Sign-In or Apple Sign-In), your email address (for account verification and communication), a unique user ID assigned to your account, and any profile information you provide such as your display name, bio, and profile picture. **Content and Usage Information:** We collect the posts, replies, and other content you create, including any photos or images you attach (such as GIFs) and links you share. We also collect your app interactions, including communities and people you follow, follow requests you send, and content that you like, bookmark, repost, and hide. To keep view counts accurate, we record which posts and replies your session has viewed; these records are used only to avoid counting the same view twice, and only the aggregate count is ever shown. Search runs on our servers, but your search history is saved only on your device. We never store it, and you can clear it anytime. Direct messages are handled differently from other content and have their own section below. **Device and Technical Information:** We collect information about your device type, operating system, app version, and general location (for security and community matching). If you enable push notifications, we collect device tokens and a random identifier for each installation of the app, to deliver notifications to the right device and stop them when you sign out. We also collect crash reports and performance data to improve our services—see "Crash Reporting" below for details. **Purchases:** If you subscribe to xaround Premium, Apple or Google processes your payment. We do not receive your card details. We receive and store the subscription identifiers Apple or Google assign, the plan, its status and expiry date, and the country of purchase, so we can provide the features you paid for and handle renewals and refunds. ## How We Use Your Information We use your information to: - Provide and improve the app and its features. - Enable community discovery and interaction. - Moderate content and ensure platform safety. - Communicate important updates and respond to support requests. - Analyze usage patterns to enhance the user experience. - Rank replies in a thread. To show the most relevant replies first, we may score public replies for relevance and usefulness to the post they answer. Scoring uses the text and images of the post and the reply only (for a video, its preview image; media marked sensitive is never used), never your name, username, or account, and may be performed with the help of a third-party AI model provider under confidentiality terms. Scores are stored with the reply and are not shown to anyone. ## Anonymous Posting When you post anonymously, your username is not stored with the content. Anonymous posts cannot be linked back to your account by anyone, including our team. However, all content is still subject to moderation. ## Direct Messages Direct messages are designed to disappear. We process and store, transiently: message text and media, including voice messages (deleted on the disappearing timer you choose, at most 15 days after sending, with attachment files removed at most 21 days after upload as a hard backstop), conversation timer settings, read state, contact-request state, delivery metadata, and daily usage counters for abuse limits. We retain longer: report snapshots, including copies of reported media (90 days); the contact-request graph while your account exists; and technical records of media deletion (the storage key, size, and timestamps of an attachment, never its content), which we keep as an audit trail after the file itself is destroyed. While a message exists, its content is technically accessible to xaround systems. It is accessed only for report review and is never used for advertising, profiling, recommendations, or training. We keep no backups of message data, deliberately: nothing expired can be produced by anyone, including us. End-to-end encryption is committed and in development, and will remove even this technical access. A message preview delivered to your phone's notification centre is not stored by us and is removed when the app next runs, but your operating system may keep showing it after the message itself has been deleted. Clearing the notification removes it. Push notifications via Apple, Google, or Huawei may carry a message preview to display on your device and are not stored by xaround; message media is stored on Cloudflare R2 until deletion. Content reported to us that we are legally required to escalate (such as child sexual abuse material under 18 U.S.C. §2258A) is reported to NCMEC. Lawful requests can be answered only with what exists under the retention windows above. ## Student Verification If you choose to verify as a student, you tell us your campus and give us an email address. We send a one-time code to that address to confirm it is yours, and a member of our team then reviews the address and the campus you named before granting the Verified Student badge. We keep the address, in plain form, only to make sure each mailbox verifies one xaround account, to carry out that review, and to show you which address you verified with. The address is never shown to other users, never used for marketing, and is deleted when you delete your account, which frees it for use again. The code itself expires within ten minutes. Verification emails are sent through Resend, which processes the address only to deliver the message. ## Crash Reporting We use [Sentry](https://sentry.io/) to collect crash reports and performance data. This helps us find and fix bugs quickly. When the app crashes or encounters an error, Sentry may collect: - Technical details about the error, including the layout of the screen that was open (never a screenshot, and never what you typed). - Device and app information (model, OS version, app version). - A random identifier to help us spot patterns (not your email or name). We do not collect your IP address or other personally identifiable information through Sentry. Crash data is processed in the United States and retained for 90 days. ## Product Analytics We use [PostHog](https://posthog.com/), hosted in the United States, to understand how xaround is used so we can improve it. When you use the app we record which features you use and when, for example that you opened a post, searched, sent a message, or completed onboarding, together with your app version, device type and operating system. These records are tied to your account's internal identifier only, never to your email address, name or username. We never record what you write, search for, or send; the identity of anyone you message; or which post, reply or conversation an action concerned. We record no event at all for anything you post anonymously, so nothing in our analytics can connect an anonymous post to your account. We do not record your screen or your taps. You can turn analytics off at any time in Settings under Preferences, with the Share Usage Analytics switch. The setting applies to your account on every device. When you delete your account we delete your analytics records as well. ## Information Sharing We do **not** sell your personal information. We share information only: - With your explicit consent. - To comply with legal obligations. - To protect user safety or prevent abuse. - With trusted service providers who help operate xaround (under strict confidentiality), including Sentry for crash reporting, PostHog for product analytics, Resend for sending verification emails, Apple and Google for subscription billing, and Anthropic for ranking replies. - When you share a link to a public post, profile, community or hashtag, that content may be shown on xaround.app to anyone who opens the link, including people without an account, and fetched by the messaging or social service used to display a preview. Private accounts, anonymous posts and deleted content are never shown this way. ## Data Retention - **Account information:** Kept until you delete your account. - **Posts and replies:** When you delete your account, posts and replies on your profile are deleted, while your posts and replies in communities are anonymized: your name is removed and they can no longer be linked to you. - **Anonymous posts:** Retained for community integrity but cannot be linked to you. - **Follows and follow requests:** Kept until you unfollow, or the request is accepted, declined, or withdrawn. Removed when your account is deleted. - **Direct messages:** Deleted on the disappearing timer, at most 15 days after sending, with no backups kept. Reported-conversation snapshots are retained for 90 days. See "Direct Messages" above. - **Blocked users:** The blocking relationship is retained until you unblock the user. This data is used to filter content and prevent follows. Blocked users are not notified. - **Notifications:** Notifications you have read are deleted 180 days after their last activity. Unread ones are kept until you read them, and all are deleted with your account. - **Technical data:** Retained up to two years to improve the app. - **Crash reports:** Retained for 90 days, then automatically deleted. - **Product-usage events:** Retained for 12 months, and deleted when you delete your account. - **Student verification email:** Kept while your account exists, deleted with it. See "Student Verification" above. ## Your Rights and Choices You may: - Access and update your account information at any time. - Make your account private and approve who follows you. - Delete your posts and account, in the app or by email. See [Delete Your Account](https://xaround.app/delete-account) for the steps and what is kept. - Control app permissions through your device settings. - Turn product analytics off in Settings under Preferences. - Request information about your data by contacting us. ## Security All data transmitted between your device and our servers is encrypted using industry-standard TLS (HTTPS). We use appropriate technical and organizational safeguards to protect your information from unauthorized access, alteration, disclosure, or destruction. However, no method of data transmission is 100% secure. ## Children's Privacy xaround is not intended for users below the minimum age for their region: 18 years old in Brazil, North America, Europe, Germany, Russia, and the rest of the world, and 19 years old in South Korea. See our [User Agreement](https://xaround.app/user-agreement) for the complete regional age requirements. We do not knowingly collect personal information from users below these age thresholds. If such information is discovered, we will promptly delete it. ## International Users xaround is operated by [S Rank Sdn. Bhd.](https://www.dnb.com/business-directory/company-profiles.s_rank_sdn_bhd.1bb54e1635037d318106faa1fd7d98e3.html) from Malaysia. Your data is stored on servers located in Singapore and the Asia-Pacific region. By using xaround, you consent to the transfer and processing of your information in these locations, where data protection laws may differ from your country. ## Changes to This Policy This Policy may be updated periodically. Please check this page regularly to stay informed of any changes. By using xaround, you agree to the terms in this Policy, as well as the [User Agreement](https://xaround.app/user-agreement) and [Community Guidelines](https://xaround.app/community-guidelines). Contact [fikri@sranksoftware.com](mailto:fikri@sranksoftware.com) for inquiries. --- This is the Markdown version of [xaround Privacy Policy](https://xaround.app/privacy-policy). Facts about xaround and every page in Markdown: [llms.txt](https://xaround.app/llms.txt)