Privacy Policy

Who can use Xpot

Xpot is for people 18 and over who already know each other. Only friends who have both accepted each other can drop to each other.

Your account

• When you sign in with Google, Xpot gets an account ID, your name and your email address. Google also offers your profile picture; Xpot never uses it. Xpot uses your name only to fill in your display name, which you can change.
• When you sign in with your email, Xpot keeps your email address, and your password only in a scrambled form that can’t be turned back into the password. When Xpot blocks an email address from signing up again (see below), it keeps only a scrambled form of that address.
• Xpot uses your email address only to sign you in and to send you account emails, such as the link to confirm your email or to reset your password. It never shows your email address to anyone and never sends you anything else. The same email address through Google or email is one Xpot account.
• Xpot stores your @username, your display name, that you passed the 18+ check and when, which version of the Terms you accepted and when, and your sign-in session, so your account works on one phone at a time. Xpot also stores the last day you used the app (only the day, never a time or place), to count how many people use Xpot.
• If you allow notifications, Xpot stores your phone’s push token to send them.

Your date of birth

Xpot asks for your date of birth only to check that you are 18 or over. It is never stored. The server keeps only the fact that you passed the check and when.

If you are under 18

Xpot does not create an account for anyone under 18, and deletes the sign-in record at once. It keeps only a flag on the Google account ID, if there is one, and on a scrambled form of the email address, without the date of birth. The flag blocks new sign-ups with either, through Google or email, for 12 months.

Friends

Xpot stores your friends, the friend requests you send and receive, and the people you decline or block. A friend request expires after 30 days. A QR code for adding a friend works for 5 minutes.

Your profile photo

• A profile photo is optional. Your phone crops it and saves it again before it is uploaded, which leaves its location and camera details behind.
• Your friends see it, and so does anyone who finds you by your exact username or your code, or who shares a friend request or a thread with you. Someone you block, or who blocks you, never sees it, and a locked drop never shows it.
• If your photo is reported, a copy is kept encrypted for the review, like other reported content, and the Xpot team may remove it.
• Changing or removing your photo deletes the old one from storage. Deleting your account deletes it too, and your data export includes it.

Drops and messages

• When you leave a drop, Xpot stores what it holds (a photo, a text or a voice message), your optional hint, who it is for, and its place: an exact point, a radius and a place name.
• The exact point is deleted once the drop has ended: when everyone it is for has opened it and the sender can see that, when it is cancelled, or when its time is up. Only the place name stays. If nobody opened it, its text and hint are deleted then too.
• Photos are view-once. A photo is deleted from storage once everyone it is for has viewed it, or when the drop ends. A photo reported while it is being viewed is kept for review (see Reports).
• Once a drop is opened, its texts, voice messages and replies stay on the server until a person in a one-to-one thread deletes it. When someone deletes their account, their own messages and drops are deleted and show as “Deleted message”; for a drop someone already opened, only its place name stays. The rest of the thread stays for the others.

Your location

• Your phone uses your location to show you on the map and to alert you when you are near a drop.
• When you open a drop, your phone sends its location so the server can check that you are inside the drop’s place. Then the server discards it.
• The one exception: to spot faked locations, the server keeps the point and time of your latest open for at most 24 hours. Your next open replaces it.
• Xpot never keeps a history of where you have been.

Screenshots and screen recording

Xpot blocks screenshots and screen recording of messages where the phone allows it. When it spots a screenshot or a recording of a message, the sender is notified, and a view-once photo is deleted at once. Phones do not always let Xpot block or spot them.

Reports

Only reported content is kept for review. It is kept encrypted until a person on the Xpot team has reviewed it, and never longer than 90 days. The Xpot team can see the reported content and who sent it, but never who reported it. The record of a report (its reason, what kind of thing was reported, who was reported and the decision) is kept for 12 months without the content.

Warnings and closed accounts

If something you sent breaks the community rules, the Xpot team may send you a warning or close your account. A closed account’s Google account ID, if it has one, and a scrambled form of its email address are flagged for 12 months, without anything else, so neither can sign up again, through Google or email. If you delete your account while a report about you is open, a scrambled form of your Google account ID and email address is kept with that report until it is reviewed, and never longer than 90 days.

Server logs

Xpot’s hosting provider keeps a log of each request your phone makes to the server, with your IP address and a rough location worked out from it, for about 7 days. These logs never contain your GPS location.

Backups

The database is backed up, and backups are kept for about 7 days. Something deleted from Xpot can stay in a backup until that backup runs out.

Where your data is kept

Xpot runs on Supabase in the EU, in Frankfurt, Germany.

Notifications are delivered by Apple and Google. A notification about a new drop never says who left it or what it says.

The Xpot team reads reports on a private website protected by Cloudflare, which checks the team’s email addresses before anyone can open it.

Deleting your account and getting your data

You can do both in the app, in Settings:

• Deleting your account removes your profile, friends, requests, your locked drops, drops waiting for you and your messages at once. Others see “Deleted message” in their place. Reported content is kept for at most 90 days and server logs for about 7 days, and your @username stays reserved for 30 days.
• An export holds your profile, your friends, every message and voice note you sent or opened, and a list of your drops with their place, date and status, never their exact location. It is ready in the app within 24 hours, and you can download it in the app for 7 days.

Contact

Write to info@xpot.eu.