XOtale (xotale.com) lets one partner make a private, passcode-protected gift website for the other. This policy explains what we collect, why, and what you can ask us to do with it. Questions go to support@xotale.com.
What we collect today #
The builder is in early access. Right now you can hold a link and sign in. To hold a link we keep:
- Your email address, so we can tell you when the builder opens and reach you about your link.
- The first names you type, if you type any. We use them to suggest your link.
- The link you choose, such as alex-sam.xotale.com, and when you held it.
- A hashed version of your IP address. We turn your IP into a keyed hash and store only that, never the address itself. We use it to limit how many links one person can hold and to stop automated abuse. The request counters behind those limits reset within an hour.
We don't use analytics, advertising or tracking cookies.
Your account #
You can sign in with Google or with a one-time link we email you. For your account we keep:
- Your email address. If you sign in with Google, it is the email on your Google account.
- Your name and Google account ID, if you sign in with Google. We keep the name only if Google shares it.
- The links you hold. Links you hold while signed in belong to your account, and links you held earlier with the same email move to it when you sign in.
- Your sessions. When you sign in, your browser gets a random code that keeps you signed in. We store only a hash of that code, with a keyed hash of your IP address and a hash of your browser's details. A session lasts up to 30 days, and signing out ends it.
- Sign-in links. When you ask for one, we keep your email, a hash of the link (never the link itself), the page to bring you back to, and the link and first names you were holding, if any. Each link works once, for 15 minutes.
- Sign-in attempts. To stop abuse, we count recent sign-in requests against a keyed hash of your IP address or email, never the address itself.
Cookies #
We set two cookies of our own, both for signing in. They are needed for the site to work and are not used for tracking:
- A session cookie, which keeps you signed in for up to 30 days or until you sign out.
- A sign-in cookie, which lasts 10 minutes while you sign in with Google and checks that the answer from Google matches your request.
When the builder opens #
When you can build your gift site, we will also keep what you put in it: text, photos, videos, voice notes and settings. Gift sites are private: visitors need the passcode, and we store passcode answers only as salted hashes.
Why we use it #
- To hold your link, run your account and, later, your gift site.
- To email you about your link, early access and your account, including the sign-in links you ask for. We send no newsletters or marketing beyond that, and you can ask us to stop at any time.
- To keep the service safe: limiting abuse, blocking bots and fixing problems.
Who else handles it #
We never sell your data and never share it with advertisers. We use a small number of providers to run XOtale. They handle data on our behalf, only for the purposes above:
- Cloudflare hosts the site, stores our database and media, and protects it from attacks. Its Turnstile check on our forms looks at signals from your browser to tell people from bots; it doesn't use advertising cookies.
- Resend sends our emails, including sign-in links from mail.xotale.com, so it handles your email address and the message.
- Google serves the fonts on our pages, which means your browser asks Google for them and Google sees your IP address. Google also handles Google sign-in: when you choose it, Google confirms who you are and shares your email, name and account ID with us.
We disclose information to authorities only when the law requires it.
How long we keep it #
- A held link and its email stay until the hold ends: you release it, you ask us to delete it, or we release it under our terms. Then we delete them.
- Account and gift site data stay while your account is open, and are deleted within 30 days of you closing it. Deleting your account from your account page removes it straight away.
- A session ends when you sign out or after 30 days. A sign-in link stops working once it is used or after 15 minutes.
- Backups roll over and are gone within a further 30 days.
Your choices #
Signed in, you can manage this yourself on your account page:
- See and release your links. A released link is deleted and free for anyone to hold again.
- Delete your account. This deletes your account, your sessions, your sign-in links and every link you hold, and signs you out everywhere.
You can also email support@xotale.com from the address you used and we will show you what we hold about you, correct it, or delete it. We reply within 30 days. Deleting your data releases your link.
Security #
Everything travels over HTTPS. IP addresses, session codes and sign-in links are stored only as hashes, and repeated sign-in requests are slowed down. On gift sites, passcode answers will be stored only as hashes, pages and media will be checked on the server before they are shown, and repeated wrong guesses will be slowed down.
Children #
XOtale is not for anyone under 16. We don't knowingly collect data from children. If you think a child has given us their details, email us and we will delete them.
Changes to this policy #
When we change this policy we update the date at the top. If a change affects how we use data you have already given us, we email you before it takes effect.
Contact #
XOtale, xotale.com. For anything about your data or this policy, write to support@xotale.com.