Privacy policy
XPNotes only collects what the app needs to work (account, game, notes, party) and doesn't sell data or show ads. You can download everything or delete your account right in the app.
Who is responsible
The party responsible for your data (the controller under the GDPR; controlador under Brazil's LGPD) is Edcarlos Santos, Paraguay, who runs XPNotes. Contact for any privacy matter: contact@xpnotes.com.
This policy covers the app (app.xpnotes.com) and the site (xpnotes.com).
Summary
- We only collect what the app needs to work.
- We don't sell data, don't show ads and don't use tracking cookies.
- You can download all your data and delete your account right in the app, in Settings → Privacy.
- XPNotes is for people aged 18 or over.
- AI only if you use it: the text you send to the Old King's AI goes to Anthropic and is not kept by us; an AI you connect (Claude, ChatGPT) reads what you allow, under its own terms.
What data we collect
Account
- Email, display name, public tag (Name#1234), language and time zone.
- Password: your browser derives a key from it (scrypt) and the server only stores a hash of that key. Your password never reaches the server.
- Account dates (creation, last access), age confirmation (18+), acceptance of the Terms, plan, the Epic launch alert (if you turned it on) and where your sign-up came from (which page or campaign, without identifying you).
- Two-step verification, if you turn it on: the code secret, stored encrypted, and the recovery codes, stored only as hashes.
What you create in the app
- Quests, goals, history, game state (level, class, items, gold) and settings.
- Notes, folders and the files you upload to notes (images and attachments such as PDFs, documents and audio). Attachments are private: only you can open them, through a link that lasts 10 minutes.
- Goal photos.
- In a party: membership, chat messages and any message reports you make.
- A review, if you send one (with your permission to publish it).
Payments (Epic plan and gifts)
- Payments are processed by Dodo Payments, which sells on our behalf (authorized reseller). Your card or payment method details, billing address and tax details stay with Dodo Payments; we never see or store your card number.
- We keep a record of each purchase: what was bought, amount, currency, date, status (paid, refunded, disputed), the Dodo Payments purchase and subscription identifiers and, for gifts, who gave it, who received it and the message.
AI (only if you use it)
- The Old King's AI: when you ask for a suggestion, the text of the goal, note or quest (or your week's numbers, for the weekly counsel) is sent to Anthropic to generate the answer. We don't keep what you sent. We only keep numbers about the use (type of request, date, result, whether it was refused and in which category, size and cost), your acceptance of the privacy notice, the ready answer for 24 hours (so the same request is not made again) and the weekly counsel until the next week.
- An AI you connect (Claude, ChatGPT or another): the app's name, the address it returns to, the permissions and the connection dates; access keys are kept only as a hash. What that AI creates or edits in your account is marked with ✨ and goes into the usage log (no text). The "Allow the AI to edit your notes" preference is stored in your account.
Technical data
- IP address and the browser you use (user agent), tied to your session, for security and to limit sign-in attempts.
- Technical error and operation logs, kept by our hosting provider for a few days.
We don't collect precise location, contacts, card or payment-method data (Dodo Payments keeps those) or sensitive data. Please don't ask for or write other people's sensitive data in notes or chat.
Why we use it
| Use | Legal basis (GDPR / LGPD) |
|---|---|
| Create and keep your account, run the game, store notes and your party | Performance of a contract (the Terms of use) |
| Selling and delivering Epic and gifts, handling cancellations, refunds and disputes | Performance of a contract |
| Keeping the record of purchases | Legal obligation and legitimate interest (defense in disputes) |
| Security: attempt limits, anti-bot checks, abuse detection, staff audit logs | Legitimate interest and account protection |
| Account emails (confirmation, password reset, security notices) | Performance of a contract |
| One email announcing the Epic launch, only if you asked for the alert | Consent (you can turn the alert off any time) |
| Knowing how many people arrive from each page or campaign (aggregated) | Legitimate interest |
| Publishing your review | Consent (you can withdraw it any time) |
| The Old King's AI suggestions and the weekly counsel | Consent (the privacy notice; you can withdraw it in Settings → AI) |
| Letting an AI you connect read and create in your account | Consent (the connection's "Allow"; you can disconnect anytime) |
| Counting AI use and cost for limits, costs and security (numbers only) | Legitimate interest |
| Complying with the law and answering authorities | Legal obligation |
We don't build advertising profiles and don't make automated decisions that significantly affect you.
Who we share it with
Only with the services that make XPNotes work, each with the minimum it needs:
- Cloudflare (hosting, database, image and attachment storage, bot protection with Turnstile and, on the site, cookie-free visit measurement).
- Resend (sending account emails).
- Dodo Payments (payments for the Epic plan and gifts): receives your email, your account's internal identifier and what you're buying; Dodo Payments handles payment data under its own privacy policy, at dodopayments.com.
- Anthropic (the Old King's AI): receives the text of each request you make to the Old King and returns the suggestion. Under Anthropic's commercial terms, this content is not used to train its models; it handles the data under its own policy, at anthropic.com.
- The AI you connect (for example, Claude or ChatGPT): what it reads from your quests, goals and notes goes to that service, chosen by you, and follows its terms and policy. You can disconnect anytime in Settings → AI.
Your party members see your name, level, class, appearance, attributes, skills, medals, whether you completed the day and the week, and your chat messages; goal titles and photos only appear if you allow it in settings. Your party never sees your quests, schedule, gold, inventory, email or time zone.
We don't sell or rent data to anyone. We may disclose data to an authority when the law requires it.
International transfers
The providers above process data in several countries, including the United States. We use providers that offer contractual data protection safeguards recognized under the GDPR and the LGPD.
How long we keep it
| Data | Period |
|---|---|
| Account, game, notes, photos, images and attachments | As long as the account exists. Deleting the account erases all of it. |
| Sessions (IP and browser) | Up to 30 days after that session was last used |
| Rate-limit counters by IP and email | Up to about 25 hours |
| Unconfirmed sign-up | 24 hours |
| Password reset link | 30 minutes |
| "Remember this device" for two-step verification | 30 days |
| Party chat messages | The 200 most recent in each party |
| Security and staff action logs | 400 days |
| Records of purchases, subscriptions and gifts | For as long as the law requires and to resolve refunds and disputes; when you delete your account, they're no longer linked to you |
| Payment notifications received from Dodo Payments | 400 days |
| AI usage log (numbers only, no text) | 90 days |
| The Old King's ready answer | 24 hours |
| Weekly counsel | Until the next week's counsel |
| Connection with an external AI | Until you disconnect (access keys last 1 hour and are renewed for up to 30 days) |
| Hosting technical logs | A few days |
When you delete your account, an active Epic subscription is canceled with Dodo Payments before anything else, so nothing more is charged.
When you delete your account, your party chat messages stay for the other members without your name ("Deleted account"), and security logs keep only the internal identifier, with no email or name, until the period above ends.
Cookies and browser storage
No tracking cookies and no consent banner. We only use what's necessary:
| Name | Where | Purpose | Duration |
|---|---|---|---|
gl_refresh | App | Keeps you logged in (essential) | 30 days |
xp_mfa_trust | App | "Remember this device" for two-step verification, if you choose it | 30 days |
xp_session_hint | App and site | Contains only "1": the site swaps "Log in" for "Open the app" | Same as the session |
The app and the site also keep your language, theme, a copy of the game state and note drafts in your own browser, so things open faster and you don't lose what you wrote. This doesn't leave your device except through the app's normal operation.
Your rights
At any time you can:
- Download your data: Settings → Privacy → "Download my data" (a file with your account, game and history).
- Correct your name, language, time zone and other details in Settings.
- Delete your account: Settings → Privacy → "Delete my account". Deletion is permanent.
- Withdraw consent for your review, in Settings.
- Disconnect an AI or withdraw consent for the Old King's AI: Settings → AI. "Download my data" also includes connected apps and AI usage per month (no text).
- Ask for access, objection, restriction, portability or any other right under the GDPR (Articles 15 to 22) or the LGPD (Article 18) at contact@xpnotes.com. We reply within 15 days.
If you think we didn't resolve it, you can complain to the data protection authority in your country.
Security
A password that never reaches the server, optional two-step verification, always-encrypted connections, secrets stored encrypted, limits on repeated attempts and logging of staff actions. No system is perfect: if something happens to your data, we'll notify you and the authorities as the law requires.
Minimum age
XPNotes is for people aged 18 or over. If we learn that an account belongs to a minor, it will be deleted.
Changes to this policy
When this policy changes in a meaningful way, we'll let you know in the app before the change takes effect. The date and version are at the top of this page.