xowxow. Privacy Policy

1. Who we are

xowxow ("we", "us", "our") is a photo rating platform for university students operated at xowxow.club. This policy explains how we collect, use, and protect your personal data in accordance with Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD — Law 13,709/2018).

For questions or requests regarding your data, contact us at privacy@xowxow.club.

2. Age requirement

xowxow is exclusively for users who are 18 years of age or older. We do not knowingly collect data from minors. If you believe a minor has registered, please contact us immediately and we will delete that account.

3. Data we collect

We collect the following categories of personal data:

• Account data: email address, display name, username, birth year, city, language preference.
• Photos: images you voluntarily upload to the platform.
• Usage data: ratings you give and receive, streak counts, badges earned.
• School verification: institutional email address used to verify student status (not stored after verification).
• Payment data: subscription status managed via Stripe; we do not store full card numbers.
• Technical data: IP address, browser type, and access logs retained for up to 90 days for security purposes.

4. Legal basis and purposes

Under the LGPD we process your data on the following legal bases:

• Contract performance (Art. 7, V): to provide the rating platform, manage your account, and process subscriptions.
• Legitimate interest (Art. 7, IX): to prevent fraud, ensure platform safety, and enforce community standards.
• Consent (Art. 7, I): for sending marketing emails (you may withdraw consent at any time).
• Legal obligation (Art. 7, II): to comply with applicable Brazilian law.

5. Photos and content moderation

Photos you upload are reviewed by our automated moderation system before becoming visible to other users. By uploading a photo you grant xowxow a non-exclusive licence to display it to other logged-in users of the platform for the purpose of rating. We do not sell or licence your photos to third parties. You may delete your photos at any time from your profile.

6. Sharing of data

We share your data only with the following categories of recipients, and only to the extent necessary:

• Supabase: database and authentication infrastructure (hosted in the US; Standard Contractual Clauses apply).
• Stripe: payment processing (PCI-DSS certified).
• Resend: transactional email delivery.
• Vercel: application hosting.

We do not sell personal data to any third party.

7. International transfers

Some of our infrastructure providers are located outside Brazil. Where personal data is transferred internationally, we ensure adequate safeguards are in place (Standard Contractual Clauses or equivalent mechanisms) as required by LGPD Art. 33.

8. Data retention

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required to retain it by law (e.g., payment records for up to 5 years under Brazilian tax law). Anonymised aggregate data (e.g., total ratings) may be retained indefinitely.

9. Your rights under the LGPD

You have the right to:

• Confirm whether we process your data (Art. 18, I).
• Access your data (Art. 18, II).
• Correct incomplete, inaccurate, or outdated data (Art. 18, III).
• Request anonymisation, blocking, or deletion of unnecessary data (Art. 18, IV).
• Request portability of your data (Art. 18, V).
• Request deletion of data processed with your consent (Art. 18, VI).
• Withdraw consent at any time (Art. 18, IX).
• Lodge a complaint with the ANPD (Autoridade Nacional de Proteção de Dados).

To exercise any of these rights, email privacy@xowxow.club. We will respond within 15 days.

10. Security

We implement technical and organisational measures to protect your data, including encrypted connections (TLS), row-level security on our database, and access controls that restrict staff access to personal data. No system is completely secure; in the event of a data breach we will notify affected users and the ANPD as required by law.

11. Cookies

xowxow uses only strictly necessary cookies required for authentication (session tokens) and for remembering your language preference. We do not use advertising or tracking cookies.

12. Changes to this policy

We may update this policy from time to time. We will notify you by email or via an in-app notice at least 15 days before material changes take effect. Your continued use of the platform after that date constitutes acceptance of the updated policy.