xowxow. Privacy Policy

1. Who we are

xowxow ("we", "us", "our") is a photo rating platform for university students operated at xowxow.club. This policy explains how we collect, use, and protect your personal data in accordance with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD — Law 13,709/2018).

For questions or requests regarding your data, contact us at privacy@xowxow.club.

2. Age requirement

xowxow is exclusively for users who are 18 years of age or older. We do not knowingly collect data from minors. If you believe a minor has registered, please contact us immediately and we will delete that account.

3. Data we collect

We collect the following categories of personal data:

• Account data: email address, display name, username, birth year, city, language preference.
• Photos: images you voluntarily upload to the platform.
• Usage data: ratings you give and receive, streak counts, badges earned.
• School verification: the institutional email address used to verify your student status, which we keep on your profile for as long as your account exists so the verification can be re-checked. It is deleted with your account.
• Payment data: subscription status managed via Stripe; we do not store full card numbers.
• Technical data: IP address, browser type, and access logs retained for up to 90 days for security purposes.

4. Legal basis and purposes

Under the LGPD we process your data on the following legal bases:

• Contract performance (Art. 7, V): to provide the rating platform, manage your account, and process subscriptions.
• Legitimate interest (Art. 7, IX): to prevent fraud, ensure platform safety, and enforce community standards.
• Consent (Art. 7, I): for sending marketing emails (you may withdraw consent at any time).
• Legal obligation (Art. 7, II): to comply with applicable Brazilian law.

5. Photos and content moderation

Photos you upload are reviewed by our automated moderation system before becoming visible to other users. By uploading a photo you grant xowxow a non-exclusive licence to display it to other logged-in users of the platform for the purpose of rating. We do not sell or licence your photos to third parties. You may delete your photos at any time from your profile.

6. Sharing of data

We share your data only with the following categories of recipients, and only to the extent necessary:

• Supabase: database and authentication infrastructure (hosted in the US; Standard Contractual Clauses apply).
• Stripe: payment processing (PCI-DSS certified).
• Resend: transactional email delivery.
• Vercel: application hosting.

We do not sell personal data to any third party.

7. International transfers

Some of our infrastructure providers are located outside Brazil. Where personal data is transferred internationally, we ensure adequate safeguards are in place (Standard Contractual Clauses or equivalent mechanisms) as required by LGPD Art. 33.

8. Data retention and account deletion

We retain your account data for as long as your account is active. You can delete your account yourself at any time — go to My profile and tap Delete my account at the bottom of the page.

Deletion is immediate and permanent. Your login, profile, photos (including the stored image files), ratings given and received, score, streak, badges, matches, blocks, notification subscriptions and Xoxos are removed from our live systems straight away — not queued for later — and we cannot restore them. Residual copies in our providers' routine encrypted backups are overwritten automatically within 30 days, and we never restore a deleted account from them.

Three things survive a deletion, none of which identify you: a minimal deletion record (an internal account identifier, the date and how many records were removed — no name, email or photo), kept as a security record; reports you filed about other users, kept with your identity stripped so open safety cases do not disappear; and anonymised aggregate data (e.g., total ratings). We also keep records we are legally required to retain (e.g., payment records for up to 5 years under Brazilian tax law).

Full details, including how to request deletion if you can no longer sign in, are on our account deletion page.

9. Your rights under the LGPD

You have the right to:

• Confirm whether we process your data (Art. 18, I).
• Access your data (Art. 18, II).
• Correct incomplete, inaccurate, or outdated data (Art. 18, III).
• Request anonymisation, blocking, or deletion of unnecessary data (Art. 18, IV).
• Request portability of your data (Art. 18, V).
• Request deletion of data processed with your consent (Art. 18, VI).
• Withdraw consent at any time (Art. 18, IX).
• Lodge a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).

You can exercise the right to deletion yourself, straight away, from My profile in the app or via our account deletion page. For any of the other rights, email privacy@xowxow.club. We will respond within 15 days.

10. Security

We implement technical and organisational measures to protect your data, including encrypted connections (TLS), row-level security on our database, and access controls that restrict staff access to personal data. No system is completely secure; in the event of a data breach we will notify affected users and the ANPD as required by law.

11. Cookies

xowxow uses only strictly necessary cookies required for authentication (session tokens) and for remembering your language preference. We do not use advertising or tracking cookies.

12. Changes to this policy

We may update this policy from time to time. We will notify you by email or via an in-app notice at least 15 days before material changes take effect. Your continued use of the platform after that date constitutes acceptance of the updated policy.