Privacy Policy

1. Who we are

This policy covers xprob.app, operated by the operator of Xprob (the "data controller" for the purposes of UK GDPR). For any privacy question, contact support@xprob.app.

2. What we collect

• Account data. Your email address, and either a securely hashed password (we never store the password itself — see below) or, if you sign in with Google, the identity Google confirms to us. We also store whether your account is Pro.
• Usage data. Standard, largely anonymous analytics on how the site is used (pages viewed, general traffic patterns) via Vercel Analytics — see our Cookie Policy for detail on what that does and doesn't involve.
• Payment data, for Pro subscribers. We do not handle or store your card details ourselves. Payment is processed entirely by Stripe, our payment provider — we receive only that a payment succeeded or failed, not your card number.
• Support messages. If you contact us, we keep the message and your reply email so we can respond and refer back to it if needed.

Passwords are hashed with bcrypt before storage — a one-way transformation that means even we cannot recover your actual password, only verify a login attempt against it.

3. Why we collect it

• To create and secure your account, and remember your Pro status.
• To process Pro subscription payments and renewals.
• To respond when you contact support.
• To understand overall site usage and improve the product.
• To detect abuse and keep the service available for everyone.

4. Third parties we share data with

• Stripe — processes Pro subscription payments. Stripe receives your payment details directly; we receive confirmation of payment status only. See Stripe's privacy policy.
• Google — if you choose "Continue with Google" to sign in, Google confirms your email address to us. We don't receive your Google password, and we don't access anything else in your Google account.
• Vercel — hosts the website and provides cookieless analytics.

We don't sell your data, and we don't share it with anyone else for marketing purposes.

5. Legal basis for processing

We process account and payment data under contract (it's necessary to provide the service you've signed up for), and usage data under legitimate interest (understanding and improving the product), consistent with UK GDPR.

6. International transfers

Stripe and Google both process some data outside the UK, including in the US. Where that happens, it's covered by their own standard contractual clauses and certifications for international transfers — we don't transfer your data anywhere ourselves beyond using these providers.

7. How long we keep it

We keep account data for as long as your account exists, plus a reasonable period afterward in case of billing disputes. If you ask us to delete your account (see your rights, below), we delete your personal data promptly, other than what we're legally required to retain (e.g. financial records Stripe or tax law requires).

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct it if it's inaccurate.
• Delete it ("right to erasure") — we don't yet have a self-serve delete-account button; email support@xprob.app and we'll delete your account and associated personal data.
• Object to certain processing, or ask us to restrict it.
• Complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you're unhappy with how we've handled your data.

9. Cookies

See our Cookie Policy for exactly what's set on your device and why.

10. Changes to this policy

We may update this policy as the service changes. Material changes will be reflected by updating the date at the top of this page.

11. Contact

Any question about this policy or your data: get in touch or email support@xprob.app.