This describes what the software actually does. Each claim below corresponds to a specific decision in the database, not to an intention.
A username and a password. x.it never asks for an email address, a phone number or a real name, and has no field to store them in. You can read the entire app without an account at all.
| username | Chosen by you, public, and permanent — it cannot be changed after you claim it. |
| password | Stored only as a hash, by our authentication provider. Nobody at x.it can read it. |
| bio | Optional, public, yours to edit. |
| country | A two-letter country code. Not a city, not coordinates, not an address. |
| join date | The date only. Deliberately not the time — a precise timestamp would order every account and reconstruct the signup sequence. |
| your content | Posts, replies, votes, reports and blocks. |
| reading history | x.it does not record which posts you have read. The table that would have held it was dropped from the database rather than left in place unused. |
| advertising ID | Not collected. No advertising is served in the app today. |
| contacts | Never requested. There is no contacts permission in the app. |
| location | No location permission is requested. Country is derived from your device's region setting. |
| photos or files | x.it is text only. The app contains no upload path of any kind. |
Reading is open to everyone. Posting requires proof that you are 18 or older, and there are two ways to give it.
Your device answers a single question — whether you are above 18 — and nothing else. x.it never sees a birthdate.
A third-party identity vendor examines your ID. The document never reaches x.it. The vendor keeps the images; we receive a reference number and a one-way hash. A hash cannot be turned back into a document, a name or a face — it exists so that a banned person cannot immediately return under a new account.
That hash lives in a separate database with separate credentials that the app is physically unable to reach. Breaching the app's database yields no identities at all.
Any staff look-up of an identity record requires two people and records a reason. That log is append-only and cannot be edited or deleted, by anyone, including us — enforced by the database rather than by policy. It means every look-up that has ever happened is still visible.
Deletion removes your account, your username and your identity record.
Your posts and replies remain, with no author attached. This is deliberate: deleting a person's account should not silently rewrite conversations other people are still reading. If you want a specific post gone, delete the post before deleting the account.
If your account was banned, the one-way hash is kept so the ban continues to mean something. Nothing else about you is retained.
| Supabase | Database and authentication hosting. Like any web service, its infrastructure logs connection metadata such as IP addresses for security and abuse prevention. |
| Persona | Identity verification, only if you choose the document check. They hold the document; we do not. |
| Apple | App distribution, and the optional on-device age range answer. |
x.it does not sell your data and has no advertising or analytics SDK in the app.
x.it is for adults. Accounts that have not proved they are 18 or older cannot post, reply or comment.
If what the software does changes, this page changes with it, in the same release. A privacy policy that lags the product is worse than none.