Privacy

xplatform is operated by company name to be confirmed, at registered address to be confirmed. For anything on this page, write to hello@xplatform.dev.

Two different relationships run through this service and they are worth separating before anything else. When you sign up and use the studio, we decide what is collected and why — we are the controller. When your application stores your users’ data with us, you decide that, and we act on your instructions — you are the controller and we are your processor.

• Your account: name, email address, and a password hash — or, if you sign in with Google, the identity Google returns. We never receive your Google password.
• Your projects: their names, slugs, allowed origins, which services are enabled, and their status.
• Your API keys, as SHA-256 hashes. The plaintext is shown once, at creation, and is never stored — which is also why we cannot recover a lost key, only issue a new one.
• Usage counters: bytes stored, requests served, users held. These are the figures your bill is calculated from.
• Operational records: when a scheduled job ran, whether provisioning succeeded, and the error if it did not.

We do not run advertising, we do not sell anything to anyone, and there is no third-party analytics or tracking script on this site.

If you enable the auth service, your end users’ accounts live in a Postgres database provisioned for that project alone — not a shared table with a tenant column. If you enable files, your objects are stored under a prefix belonging to that project. In both cases the contents are yours: we process them to run the service you asked for, and for nothing else.

We do not use your users’ data to train models, and we do not share it with anyone outside the processors listed below.

Running this service means using infrastructure we do not own. These are the only parties involved, what each does, and where.

Data is held in the European Union. A project’s auth database is created in Frankfurt by default; file objects are stored in Stockholm.

• A deleted project is recoverable for 30 days, then it and its database are destroyed. The same window applies to a deleted file.
• Expired sessions and used verification tokens are cleared by a scheduled job rather than left to accumulate.
• Usage counters are kept while they are needed to calculate and evidence a bill.
• Close your account and the above runs on its own; ask us and we will do it sooner.

• Every stored credential — service connection strings, signing secrets — is encrypted with AES-256-GCM under a master key held outside the database.
• API keys are stored only as SHA-256 hashes, and a publishable key cannot perform a management operation however it is used.
• Each project's auth data sits in its own database, so one customer's query cannot reach another's rows.
• Traffic is served over TLS, and the API refuses requests from origins a project has not allowed.

If you are in the EU or UK you may ask us for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Write to hello@xplatform.dev and we will answer within a month. You may also complain to your national data protection authority.

If your request concerns data one of our customers holds about you — an account in their application — they are the controller and we will pass your request to them.

The studio sets one cookie, to keep you signed in. It is httpOnly, Secure and SameSite=Lax, and there is no advertising or analytics cookie on this site — so there is nothing here to consent to.

If we change what we do with data, we will change this page and move the date at the top. If the change is significant and you have an account, we will email you rather than rely on you noticing. What we charge and how it is measured is on the pricing page.