Privacy Policy

Template for review by counsel.

What we collect

• Account: email, hashed password, username, display name, optional avatar.
• Content: your posts, comments, likes, follows, stories, and any files you upload.
• Verification: documents you submit are stored in a private bucket accessible only to admins.
• Technical: minimal request logs to operate the service securely.
• Safety signals: hashed IP, coarse location (country/city), device user-agent, and machine-generated moderation classifications for content you upload.

How we use it

To operate the service, deliver notifications, moderate content, and prevent abuse. We do not sell your personal data.

Automated content moderation

Every image and video you upload is scanned by automated safety systems (including third-party AI vision models) before it becomes visible on the platform. The scan looks for nudity, sexual content, graphic violence, self-harm imagery, and other illegal content. We store the classifier's verdict, confidence score, and the reason string alongside the media metadata for a limited retention window so moderators can audit decisions.

If our systems detect sexual or nude content depicting what appears to be a minor with a confidence of 40% or higher, we block the upload, remove the media, suspend the account, and refer the case to human moderators for review and, where legally required, escalation to the National Center for Missing & Exploited Children (NCMEC) and/or local law enforcement. In such cases we may retain the media, associated metadata, IP address, and account information as evidence for the period required by law, even if you request deletion.

Automated moderation is imperfect. You can appeal a decision from Settings → Account.

Your rights

You can export your data as JSON and permanently delete your account at any time from Settings → Account. This deletes your posts, comments, likes, follows, and profile.

Data retained for legal, safety, or law-enforcement reasons is excluded from deletion until the retention period ends.

Third parties

Sign-in with Google and Apple use OAuth; we receive your email and basic profile from those providers. Content-moderation classifications are produced by third-party AI providers we call from our servers — the media is transmitted to the provider for the sole purpose of classification and is not used to train their models.

Contact

privacy@x2y.social (placeholder).