Privacy Policy

1. What this covers

This page explains what information we collect, why we collect it, and how we handle it when you use XepopXMT.

2. Account information

When you sign up we store your email address and a securely hashed password. We never store passwords in plain text. Login sessions are handled with normal industry practices so your account stays protected.

3. Xbox account linking

If you link an Xbox account we only keep the tokens and basic auth details needed to show status and run the tools you choose. These tokens are kept for a maximum of 24 hours and are automatically removed after that. They are not permanent refresh tokens — they exist only so the tools can work while you are using them.

4. IP addresses & console tools

In some console-related features we may briefly use an IP address so the API can return NAT type information. That data is only used for the specific request and is not stored long-term for tracking.

5. Database search & public data

The database search tool shows information that was collected by automated scrapers scanning publicly available sources online. It maps connections between gamertags and network details that were already out in the open. We only process and display publicly available information.

Results are based on historical snapshots. They may not match current real-world data — IP addresses especially change often for people on dynamic connections. Accuracy is not guaranteed.

You are responsible for how you use any information you find. Always follow the laws that apply where you live.

6. How we use the information

• To run the tools and keep the service working
• To process payments (handled by Stripe — we never see full card numbers)
• To stop abuse, enforce rate limits, and keep the platform stable
• To send important account or security related messages if needed

7. Data storage & security

Data sits on secured servers with encryption in transit and at rest. We use standard protections against unauthorized access. No system is perfect, but we take reasonable steps to keep things locked down.

8. Third-party services

• Stripe — payment processing only
• Cloudflare — hosting, security, and performance
• Supabase — authentication and database

9. Data retention

Account data stays while your account is active. Xbox tokens are limited to 24 hours max. You can ask us to delete your account and related data at any time.

10. Your rights

You can request access to the data we have on you, ask us to correct it, or request deletion. Just reach out through the support options on the site.

11. Cookies

We only use the cookies needed for login and session management. No advertising or tracking cookies.

12. Kids

This service is not meant for anyone under 18. We don't knowingly collect information from children.

13. Changes

We may update this policy from time to time. The newest version will always be posted here with an updated date.

14. Contact

If you have questions about privacy, use the help / support section of the site.