Information We Collect
Information You Provide
- Account information: email address, username, and display name when you create an account.
- Profile information: bio, location (text only, not GPS), and profile photo, if you choose to add them.
- Experience data: activity names, descriptions, categories, photos, completion notes, star ratings, and XP values you assign.
- Collection data: names and descriptions of collections you create.
- User-generated content: activities, notes, photos, and other content you create and share with friends through the app.
- Reports: if you report another user's content, we collect the report details including the reported content and reason.
- Terms acceptance: a record that you have agreed to Apple's standard Terms of Use upon registration.
Information Collected Automatically
- Device information: device type, operating system version, and app version.
- Usage data: app interactions such as screens viewed and features used, collected via Firebase Analytics.
- Push notification tokens: a device token (via Firebase Cloud Messaging) used to deliver push notifications to your device. This token is stored and associated with your account.
Information From Third Parties
- Auto-fill data: when you use the auto-fill feature, XPList fetches publicly available information from Wikipedia or the Open Graph metadata of URLs you provide. This happens on your device. We do not store the raw data fetched — only the fields you choose to save.
How We Use Your Information
We use the information we collect to:
- Create and maintain your account.
- Sync your experience list, collections, and profile across your devices.
- Enable social features: connection requests, a friends-only feed, and notifications.
- Deliver push notifications about connection requests and activity interactions.
- Process premium subscription purchases and verify your entitlement via Apple's StoreKit.
- Generate share links that let you share individual activities with anyone via a link.
- Improve the app through aggregated, anonymized usage analytics (Firebase Analytics).
- Review reports of objectionable content or abusive users, and take action (including content removal and account termination) within 24 hours of a verified report.
- Respond to support requests.
Sharing Your Information
We do not sell your personal information. We share it only in these limited circumstances.
With People You Connect With
When you connect with a friend on XPList, your activities marked as "Friends" privacy are visible in their feed. Activities marked "Private" are never shown to anyone else.
Via Share Links
If you share an activity via a share link, anyone with that link can view that activity — regardless of your privacy setting. Share links are intentional and generated only when you explicitly tap Share.
With Service Providers
We use the following third-party services that process data on our behalf:
Legal Requirements
We may disclose your information if required by law, court order, or to protect the rights and safety of our users or the public.
Data Storage and Security
Your data is stored on Supabase-managed servers. We use Row Level Security (RLS) policies to ensure that users can only access their own data or data explicitly shared with them. All data is transmitted over HTTPS/TLS.
While we take reasonable steps to protect your information, no system is completely secure. We cannot guarantee the absolute security of your data.
Your Privacy Controls
- Activity privacy: each activity can be set to "Friends" (visible in friends' feeds) or "Private" (visible only to you).
- Profile visibility: your profile is visible to users you are connected with.
- Blocking: you can block any user from within the app. Blocked users' content is immediately removed from your feed and they are unable to see your content. We are notified when a block occurs.
- Reporting: you can report any activity in your friends feed as spam, inappropriate, harassment, or other. Reports are reviewed within 24 hours. Verified violations result in content removal and potential account termination.
- Notifications: you can manage push notification permissions in your iOS Settings at any time.
- Account deletion: you may delete your account by contacting us at privacy@xplist.com. Deletion removes your profile and all associated data from our systems within 30 days, except where retention is required by law.
Premium Subscriptions
XPList offers optional premium subscriptions processed entirely by Apple through the App Store. We do not collect or store your payment card information. We receive a confirmation of your purchase from Apple's StoreKit to activate premium features. Subscription management (cancellation, upgrades) is handled through your Apple ID settings.
By registering for an account or making a purchase, you agree to Apple's Standard End User License Agreement (EULA), which governs your use of the app.
Children's Privacy
XPList is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@xplist.com and we will delete it.
Data Retention
We retain your account data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance purposes.
Anonymized, aggregated analytics data (which cannot be linked back to you) may be retained indefinitely to help us improve the app.
International Users
XPList is operated from the United States. If you are accessing XPList from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using XPList, you consent to this transfer.
Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the effective date at the top of this policy and, where appropriate, through an in-app notification. Your continued use of XPList after any changes constitutes your acceptance of the updated policy.
Contact Us
If you have questions or concerns about this Privacy Policy or your data, please contact us: