Privacy Policy

When you create an account, we collect:

• Username and email address
• Password (stored securely using industry-standard hashing)
• Profile information you choose to provide (bio, avatar)
• Account role preference (creator or player)

We automatically collect certain information when you use XScapeKit:

• Stories you create, publish, or play
• Choices made during story playthrough
• Session duration and completion status
• Device type, browser, and operating system
• A first-party device identifier — a random ID we generate and store in your browser to count unique visitors and remember on-device choices. It is not device fingerprinting and is not used for advertising.
• IP address, stored only as a one-way keyed hash (we cannot recover the original address) for measurement and abuse prevention, plus approximate location

When you use our messaging features, we collect:

• Message content between creators and players
• Timestamps of messages sent and received
• Thread subjects and status (open, closed, reported)
• Paid messaging transactions and payment history

Message Privacy: Messages are stored to enable the messaging feature and may be reviewed for policy violations, abuse prevention, and responding to reports. Messages are not shared with third parties except as required by law or to prevent harm.

Retention: Messages are retained while your account is active. When a thread is closed, messages remain accessible to both parties unless the account is deleted.

For XO currency and payments, we collect:

• Transaction history (XO purchases, subscriptions, payouts)
• Creator earnings and subscriber relationships
• Billing information (processed by Stripe, not stored by us)
• Payout preferences and tax information (for creators)

Payment Processing: We use Stripe to process payments. Your payment card details are handled directly by Stripe and are never stored on our servers. See Stripe's Privacy Policy for details.

XScapeKit uses two kinds of measurement. First-party functional telemetry — which content is played and how far people get — is pseudonymous, always on, and never shared or used for advertising; we rely on it to operate and improve the platform (legitimate interest). Third-party analytics below run only after you accept analytics cookies in the cookie banner:

• Provide and maintain the XScapeKit platform
• Enable story creation, publishing, and playback
• Save your progress in stories
• Display creator profiles and statistics
• Improve our features based on usage patterns
• Send important account notifications
• Detect and prevent fraud or abuse

We do not sell your personal information. We may share data with:

• Analytics providers (Google Analytics, Amplitude) as described above
• Service providers who help operate our platform
• Law enforcement when required by law

Certain information is publicly visible on XScapeKit:

• Your username and profile (if you're a creator or have published stories)
• Published stories and their play counts
• Creator statistics (story count, total plays)

We retain your account data for as long as your account is active. You can request deletion of your account and associated data at any time by contacting us.

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data
• Export your data
• Opt out of analytics tracking
• Withdraw analytics/marketing consent at any time via Manage cookie preferences

We use cookies and similar browser storage to:

• Keep you signed in
• Remember your preferences (e.g., theme)
• Store the first-party device identifier described above
• Collect analytics data — only after you consent via the cookie banner

You can change your analytics and marketing choices at any time with the "Manage cookie preferences" button below, and control all cookies through your browser settings.

When you accept our terms, adjust cookie preferences, or confirm your age for mature-rated content, we keep a record of that choice: which document version you responded to, your decision, and when. Records are tied to your account — or, for visitors, to the first-party device identifier or hashed IP described above.

Mature-content confirmations are re-asked periodically. You can withdraw analytics and marketing consent at any time via "Manage cookie preferences"; records of withdrawal are kept the same way.

We implement industry-standard security measures to protect your data, including encrypted connections (HTTPS), secure password storage, and regular security audits.

XScapeKit is not intended for children under 13. We do not knowingly collect information from children under 13. If you believe we have collected such information, please contact us.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date.

If you have questions about this Privacy Policy or your data, please contact us at info@xscapekit.com