Privacy Policy

• Account information: your email address and sign-in method (password / passkey / Google; signing in with Google gives us your basic profile: name, email, and avatar), plus your account settings;
• Session records: sign-in time, IP address, and browser identifier, kept for account security;
• Payment information: payments are handled by Stripe; we never collect or store your card number. We keep order and payment status (amount, currency, refund records) for reconciliation;
• Usage statistics: traffic bytes aggregated per minute for quota and billing, reported as measured in the console. Minute-level detail is kept for 14 days; hourly and daily summaries are kept for billing and statistics;
• Subscription fetch records: each time your subscription link is fetched we record the time, your masked IP address (last segment redacted), the resolved client name and a User-Agent summary, and region and carrier details from the edge network. Kept for 15 days so you can audit who is fetching your subscription in the console;
• Information you submit: the contents of support tickets and emails.

• No traffic logging: we do not look at or store the content of your traffic or the destinations you visit;
• No ads and no user profiling;
• No selling or renting of personal data — ever.

We use the information above only to:

• Provide and maintain the service: issue subscription configs, meter quotas, bill and renew;
• Keep accounts secure: investigate unusual sign-ins, manage abuse and bans;
• Send necessary notices: email verification codes, expiry reminders, material service changes;
• Respond to your support requests.

The marketing site and console use only the small amount of storage needed to function: an auth-hint cookie (so the site routes you to the console when appropriate), a referral cookie (records the referral code when you sign up through a referral link; valid for 30 days, used only for reseller settlement), and browser local storage (sign-in hint and interface preferences). We run no third-party advertising or analytics trackers.

We do not share your personal information with third parties except: processors required to run the service (payments: Stripe; email delivery: Resend), which receive only the data needed to do their job; requests made through lawful process (such as a court order); and what is necessary to prevent abuse or to protect the rights of our users and us.

Connections are forwarded through the exit network we operate. We do not pass your account identity to the exit network.

Subscription fetch records are kept for 15 days and minute-level usage detail for 14 days; hourly and daily summaries are kept as needed for billing. Account and order data are kept while your account exists. After you close your account or ask for deletion, we delete or anonymize your personal information within a reasonable time, unless the law requires us to keep it.

Traffic is encrypted in transit, access credentials are stored encrypted and stop working the moment you reset them, and administrative access is permission-controlled. If a breach ever affects you, we will notify you promptly as the law requires.

You can view and correct your account information and review usage and orders in the console at any time, and you can ask us to export or delete your account and personal data. To exercise your rights, email support@xbond.net and we will respond within a reasonable time.

The service is not directed at children under 16, and we do not knowingly collect children's personal information.

Our infrastructure and the processors above operate in different countries and regions (Cloudflare's global edge network, for example), so your information may be processed outside your country or region. We take reasonable steps to make sure such transfers meet this policy and applicable law.

This policy may be updated as the service evolves. Updates are published on this page with a new 'last updated' date; for material changes we will also notify you by email.