Privacy Policy

1. Information We Collect

We aim to collect as little as possible. Depending on how you use the Service, this may include:

• Account information you provide: a username, email address, and password. Passwords are hashed (Argon2id) before storage — we never store or can recover your actual password. If you sign in with Google instead, we don't receive or store a password at all.
• If you link a Discord account: your Discord ID, username, avatar, and the email on that account, used to sync your Pro membership status to the roles in our Discord server.
• Payment information needed to process purchases — handled entirely by Stripe, our payment processor; we store a Stripe customer/subscription reference, not your full card number.
• Two-factor authentication data, if you enable it: for authenticator-app (TOTP) 2FA, an encrypted copy of your authenticator secret; for email 2FA, short-lived one-time codes; and one-time recovery codes, which are stored as one-way hashes we cannot reverse.
• IP address and basic device/browser information, used to keep sign-in and support tools secure — for example, detecting when a linked credential is being used from an unusual number of locations at once — and to enforce rate limits against abuse.
• Which product you click into from the homepage (e.g. Kahoot, Blooket, Wayground) — recorded as a running total per product, not tied to your account or identity, and only if your analytics preference (see below) is turned on. Signed-out visitors are counted the same way, with nothing to tie the click to.
• Preferences you set, such as your email and analytics opt-ins (in your account settings) and your light/dark theme choice (stored locally on your device).
• Anything you send us directly, such as support requests or bug reports via email or our Discord server.

2. How We Use Your Information

We use the information we collect to create and operate your account, authenticate you and keep sign-in secure (including two-factor authentication and abuse detection), process payments, subscriptions, refunds, and gift redemptions, sync your Discord role to your plan, send account-related messages (such as email verification, password reset, and purchase receipts) and, if you're opted in, occasional product updates, respond to support requests, prevent fraud and abuse, and understand aggregated, anonymized product usage to improve the Service.

We do not sell your personal information.

3. Cookies, Local Storage & Cross-Subdomain Sign-In

We use a session cookie to keep you signed in. Because X-Network's products live on several subdomains (for example, dedicated sites for some of our browser tools), this cookie is scoped to work across those subdomains so you don't have to sign in again on each one — each one confirms your plan by asking our servers directly rather than trusting the cookie's contents alone.

We also use browser local storage for on-device preferences, such as your light/dark theme choice, which never leaves your browser. You can clear or block cookies and local storage through your browser settings, though some features (like staying signed in) won't work as well if you do.

4. Third-Party Games, Bots & Client-Side Tools

X-Network links out to third-party games such as Kahoot, Blooket, Prodigy, Quizlet, Wayground, Gimkit, and Google Forms. When you launch one, you leave X-Network and are subject to that third party's own privacy policy and terms. We do not control and are not responsible for how those services collect or use your data.

Our own browser scripts and sites (such as KahootX, X-Gui, X-Bot, X-Client, and Token Claimer) run in your browser and interact directly with the third-party game's own servers to do things like retrieve answers or control a session. We do not receive or store the game data those interactions involve (such as room codes, questions, answers, or other players' information) on our servers unless a specific feature says otherwise.

Some tools (for example, the Wayground control tools) run as a separate application on your own device rather than through our servers, and any game or session data that application processes stays on your device — it is not sent to or stored by X-Network.

We also rely on trusted service providers (for example, hosting, email delivery, and payment processing) who handle data only as needed to provide their service to us.

5. What Our Admin Tools Can See

A small number of authorized X-Network staff can look up an individual account through an internal admin tool, to help with support requests, payment issues, and enforcing these Terms (for example, reviewing or issuing a ban). A lookup shows: username, email, whether your email is verified, your plan and Pro expiration date, whether the account is banned and when, when the account was created, and a reference id used to pull up your Stripe billing record if you have one — actual card details always stay in Stripe, never in our database or admin tool. This lookup never shows your password (we don't have it — only a one-way hash), your two-factor secret or recovery codes, or your Discord account details.

The admin dashboard also shows aggregate, non-personal statistics — total signups over time, the free/Pro split, verified/banned counts, gift redemption totals, and the per-product click counts described above. None of these numbers are broken out by individual user.

Separately, our Discord support bot can look up an account by email for staff to answer support questions: username, email, avatar, plan and Pro expiration, email verification and ban status, account creation date, whether a password is set, and — pulled live from Stripe, not stored by us — subscription status and the last few payment amounts. Like the admin tool, it never sees your password, two-factor data, or Stripe account IDs.

6. How We Share Information

Beyond the internal admin access described above, we share personal information only in limited situations:

• With service providers who help us run the Service (such as hosting, payment processing, and email delivery), under confidentiality obligations;
• When required by law, legal process, or to protect the rights, safety, and security of X-Network, our users, or the public;
• In connection with a business transfer, such as a merger or acquisition, with notice where required.

7. Data Retention

We keep your information for as long as your account is active or as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. You can ask us to delete your account and associated personal data at any time using the contact details below.

8. Security

We use reasonable technical and organizational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential.

9. Children’s Privacy

X-Network is often used in learning settings that may include minors. We do not knowingly collect more personal information from children than is necessary to provide the Service. If you are under the age of majority in your area, please use X-Network only with the involvement of a parent, guardian, or teacher. If you believe a child has provided us personal information without appropriate consent, contact us and we will take reasonable steps to delete it.

10. Your Rights & Choices

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, or to object to or limit certain processing. To exercise any of these, contact us using the details below and we will respond as required by applicable law.

You can turn off product-usage analytics and non-essential emails at any time from your account settings, unlink your Discord account, and disable two-factor authentication or regenerate its recovery codes — all directly within the Service, without needing to contact us.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect means you accept the updated Policy.

12. Contact

If you have questions about this Privacy Policy or how we handle your data, contact us at [email protected]. This address may change in the future; if it does, the current contact email will always be listed here and in our Terms of Service. You can also reach us by opening a ticket in our Discord server.