Privacy Policy

Drawings and photos: never on our servers

Drawings and photos created during a session travel over a direct peer-to-peer connection (WebRTC) from the phone to the host screen. They do not pass through our servers and we never store or publish them.

The host device keeps drawings locally (in browser storage) so a session survives a refresh. That storage is yours; you can clear it from the uploads list on the host screen or by clearing browser data.

Background removal of photos happens entirely on the device itself (in the browser), not in the cloud.

Account data

An account is only needed to unlock worlds — children never need an account. When you sign in with Google we receive your name and email address from Google and store them in your profile, together with your unlocked worlds.

We do not sell or share your data with third parties for marketing purposes.

Payments

Payments are handled by Stripe. Your card or bank details never reach our servers; we only receive a payment confirmation and order reference from Stripe.

Feedback and contact

When you use the feedback form we store your message, the page you were on, your browser version and — if you tick the box — a screenshot of the page. Screenshots are stored in a private bucket accessible to administrators only.

Messages sent via the contact form (name, email address, message) are stored so we can answer your question.

Cookies and local storage

We use one cookie for your language preference and — only if you sign in — Supabase session cookies for authentication. We use no tracking or advertising cookies.

Retention

Account data is kept for as long as your account exists. Feedback and contact messages are kept for at most two years. Expired world unlocks remain in your purchase history.

Your rights (GDPR)

You have the right to access, correct and delete your data, and to object to processing. Contact us via the support page or email info@xiwebdesign.nl and we will handle your request within 30 days.

Processors

We use Vercel (hosting), Supabase (database and authentication) and Stripe (payments). Data processing agreements are in place with each of these parties and all data is transmitted encrypted.