Privacy Policy
We collect the minimum data required to deliver the daily digest and operate the service. We never sell your data.
What we collect
- Email address — for the digest, magic link login, and transactional notices.
- Vertical preferences — to personalize the digest.
- Usage logs — to operate the service, debug, and detect abuse. Logs auto-expire after 90 days.
- Payment metadata — held by Stripe; we store a customer ID, never card numbers.
What we do not collect
- We do not use third-party advertising trackers.
- We do not embed Google Analytics or similar surveillance.
- We do not sell, lease, or share your email with marketers.
Right to erasure
You can request deletion of your account at any time from your
account settings (or by calling
DELETE /api/account). We perform a soft delete
immediately, NULL personally identifiable fields, and hard-purge after
30 days. After hard purge, no recovery is possible.
Right to data portability
You can download a complete export of your account data at any time
from your account settings
(GET /api/account/export). The export is a single JSON
document covering your user record, email preferences, subscriptions,
credit ledger, ad-hoc requests, and any discourses generated for you.
This endpoint is rate-limited to 3 requests per hour per user.
Retention
- Account: soft-deleted on request, hard-purged 30 days later.
- Server access logs: 90 days, then deleted.
- Email send log: 12 months, then aggregated.
- Ledgers and audits: append-only, retained for the life of the account plus statutory tax / dispute periods.
Subprocessors
- Stripe — payment processing, billing receipts.
- Resend — transactional and digest email delivery.
- OpenAI — discourse generation (no personal data is sent in prompts).
- Cloudflare Turnstile — bot mitigation on subscribe / sign-in.
Cookies
We set a single first-party session cookie (xdiscourse_session) for authenticated
users. We do not use third-party cookies, advertising trackers, or analytics tracking scripts.
Because this cookie is strictly necessary to keep you signed in, no consent banner is shown.
See Terms of Service §9.
Contact
Zero Point Studio d.o.o.
Rudeška cesta 179, 10000 Zagreb, Croatia
Privacy questions: privacy@xdiscourse.com