Privacy Policy

Last updated: August 25, 2026

1. Overview

XCT Live ("the Service") respects your privacy. This policy explains what data we collect, how we use it, and your rights regarding that data.

2. Data We Collect

Account Information: When you register, we store your chosen username and a hashed version of your passphrase. We generate a unique API key for your account.

Email Address: If you sign up with an email address, or add one to an existing account, we store that address and whether it has been confirmed. We use it to verify the account, to let you recover access, and to send messages about your account or subscription. We do not send marketing email.

Google Sign-In: If you sign in with Google, Google sends us your Google account identifier, your email address, whether Google has verified that address, and your profile picture URL. We store those to identify your account on return visits and to show your picture. We never receive your Google password, and we have no access to your Gmail, Drive, contacts or any other Google data.

Xbox Account Data: If you link your Xbox account, we store your gamertag, Xbox User ID (XUID), avatar URL, and an encrypted Microsoft refresh token.

Collection Data: If you upload your Xbox collection export, we store your library, play history, scan history, account list, and order/purchase history.

Subscription and Billing Data: If you subscribe to XCT Pro, we store the identifiers Stripe gives us for your customer and subscription record, the plan you are on (monthly or annual), its status, the amount and currency, the date the current period ends, whether it is set to cancel, and the email address used at checkout. We never receive or store your card number, expiry date or security code — those are entered directly on Stripe's checkout pages and stay with Stripe.

CDN Sync Data: If you participate in CDN Sync, your contributed CDN package entries are stored in the shared database with your contributor username.

Server Logs: Standard web server logs may include IP addresses, request timestamps, and user agents. These are used for security monitoring and abuse prevention.

3. How We Use Your Data

• Display your collection, achievements, and purchase history in the web interface
• Maintain CDN Sync leaderboard standings
• Authenticate your sessions via API key
• Verify your email address and let you recover access to your account
• Take subscription payments and give you the Pro features you have paid for
• Monitor and prevent abuse of the Service

4. Data Sharing

We do not sell your personal data, and we do not rent it. Apart from the advertising described in section 10, we do not use third-party analytics or tracking.

We share the minimum necessary with the providers that make specific features work:

• Stripe — when you start a subscription we pass Stripe an internal reference to your account and, where we have one, your email address, so that the payment can be matched back to you. Stripe processes the payment and tells us the result. See the Stripe Privacy Policy.
• Ko-fi — if you support the Service through Ko-fi, Ko-fi tells us which membership you hold so we can grant Pro.
• Google — only if you choose to sign in with Google, and only as part of that sign-in.
• Microsoft / Xbox — only to read the Xbox data you have authorised.
• Email delivery — an email provider handles the verification and account messages we send you.

Your collection data is private to your account. CDN Sync contributions are shared with other contributors as described in the Terms. We may disclose data if required by law.

5. Data Storage & Security

Data is stored on secured servers. Xbox refresh tokens are encrypted at rest using Fernet symmetric encryption. Passphrases are hashed before storage. While we take reasonable measures, no system is perfectly secure.

6. Microsoft / Xbox Data

When you sign in with Xbox, the Service accesses your data through Microsoft's OAuth2 authorization flow. We only request the scopes necessary for the features you use. You can revoke access at any time from your Microsoft account permissions.

7. Google Sign-In

Signing in with Google is optional and only happens if you choose it. You can disconnect XCT Live from your Google account at any time from your Google account permissions. Doing so stops future Google sign-ins; it does not delete the XCT account itself, which you can delete separately.

8. Payment Data

Card details never reach our servers. Stripe is the payment processor and holds the card record; we hold only the subscription record described in section 2 so we know what you are entitled to and when it renews. You can cancel a subscription from your account settings, which stops future renewals.

9. Cookies & Local Storage

The Service uses browser localStorage to store your API key, username, gamertag, and display preferences. Stripe may set its own cookies on its checkout pages, which are governed by Stripe's privacy policy. Advertising cookies are described in section 10 below.

10. Advertising

XCT Pro subscribers see no advertising at all, and no advertising code is loaded for them. For everyone else, the Service shows advertising supplied by Google AdSense.

Google, and the advertising partners Google works with, may collect, receive and use personal data when an advert is shown on xct.live — including your IP address, device and browser information, the pages you view here, and identifiers stored in cookies or similar technologies — in order to select, deliver and measure that advertising. Google acts as an independent controller of the data it collects this way; see how Google uses information from sites that use its services.

• Third party vendors, including Google, use cookies to serve ads based on a user's prior visits to xct.live or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to users based on their visit to this site and/or other sites on the Internet.
• Users may opt out of personalised advertising by visiting Google Ads Settings. Users may also opt out of a third-party vendor's use of cookies for personalised advertising at aboutads.info.

Where the law requires it, a consent message is shown before personalised advertising cookies are set: in the European Economic Area and the UK you are asked to consent, and in the US states with such a right you are offered an opt-out. Your choice is recorded and honoured by Google's consent management platform, and you can change it at any time from the same message.

The Service does not show advertising on sign-in, checkout, billing, account or settings pages.

Affiliate and sponsor links. Some links on the Service earn XCT a commission if you buy or sign up after clicking them, at no extra cost to you. XCT.live takes part in the eBay Partner Network, Amazon Associates and the impact.com partner network. These links are marked rel="sponsored", they never change what the site shows you or how results are ranked, and the partner does not receive your identity from us. The current sponsors are listed on the Sponsors page.

11. Data Retention

Your data is retained as long as your account is active. If you request account deletion, all associated data (collection, tokens, profile) will be removed from our systems. Records of payments may be kept for as long as tax and accounting law requires, and Stripe keeps its own transaction records independently of us.

Deleting your XCT.live account

This applies to the XCT.live website and the XCT.live apps for Android and iOS, operated by Freshdex Limited.

1. Sign in at xct.live or in the app.
2. Open Settings → Privacy and choose Delete account in the danger zone.
3. Type your gamertag to confirm. Deletion happens straight away.

If you cannot sign in, email admin@xct.live from the address on your account, or use the contact page, and we will delete it for you within 30 days.

Deleted: your collection and purchase records, achievement and play data, profile and showcase settings, linked Xbox and Google sign-in tokens, messages, comments, feed posts, lists and every other record tied to your account. Kept: payment records we are required to keep for tax and accounting law (up to six years), and an anonymised placeholder row with no personal data so other records stay consistent. Stripe keeps its own transaction records independently of us.

12. Your Rights

You have the right to:

• Access your stored data through the API
• Disconnect your Xbox or Google account at any time
• Cancel a subscription at any time
• Request deletion of your account and all associated data
• Export your collection data

13. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect data from children under 13.

14. Changes

We may update this policy at any time. Material changes will be noted by updating the "Last updated" date at the top of this page.

15. Contact

For privacy-related questions or data deletion requests, write to admin@xct.live or use the contact page. Account deletion is also available in Settings while signed in.