Privacy Policy

1. Who We Are (Data Controller)

For purposes of applicable data protection law (including the EU/UK General Data Protection Regulation where it applies), the controller of your personal data in connection with the Service is the operator of XDL (“XDL”, “we”, “us”).

Privacy inquiries: [email protected]. Legal notices: [email protected]. General support: [email protected].

This Privacy Policy should be read together with our Terms of Use.

2. Scope

This Policy describes how we process personal data when you visit our websites, create or use an account, download or stream media, contact us, or otherwise interact with the Service. It does not cover third-party websites, X Corp., payment processors, or other services that have their own policies.

3. Categories of Personal Data We Collect

3.1 Data you provide

• Account and profile data — when you sign in with X OAuth: name, username/handle, profile image URL, X user identifier, and any email address associated with the OAuth profile if provided by the provider.
• Communications — messages you send us (support, legal, copyright notices), including contact details you include.
• Preferences — settings such as default quality, autoplay, ambient glow, data saver, and notification preferences.

3.2 Data generated by your use of the Service

• Download records — source URL, job identifiers, status, format/type, timestamps, approximate file size/resolution, title/author metadata returned by processing, and (if signed in) linkage to your user ID. For anonymous downloads we may store a truncated or hashed network identifier for abuse prevention and optional free-tier limits.
• Library data — favorites, watch history (including progress markers where available), collections names and item references, and related metadata.
• Usage and diagnostics — pages viewed, feature interactions, error logs, performance metrics, and referrer information.
• Security and rate-limit data — IP address, user-agent, approximate geolocation derived from IP (country/region level), request counts, and session/token identifiers.

3.3 Cookies and similar technologies

• Essential cookies / storage — session and authentication cookies (Auth.js / NextAuth), CSRF protection, and load-balancing or security cookies required to operate the Service.
• Local storage — may store UI preferences or recent search terms on your device.
• Analytics (Google Analytics 4) — we use Google Analytics (measurement ID configured for xdl.to) to understand product usage: page views, downloads started/completed, format choices, search volume, and playback. We configure IP anonymization where available and do not intentionally send full pasted X/Twitter URLs or personal profile fields (name, email) as event parameters. Google may set cookies or use similar identifiers under its own terms. You can limit analytics via browser settings, extensions, or Google's opt-out tools. We do not use third-party advertising cookies as a core product feature.

3.4 Data from third parties

• X (Twitter) OAuth — identity and profile fields authorized by you during login.
• Payment processors (e.g. Stripe) — if you purchase a subscription: customer ID, subscription status, price identifiers, and limited billing metadata. Full card numbers are handled by the processor, not stored by XDL.
• Media and catalog infrastructure — download/suggestion backends may return titles, authors, thumbnails, and stream or file URLs associated with public posts you request or browse.

3.5 Data we do not intentionally collect

We do not require government ID, precise GPS location, or payment card PAN/CVC. We do not seek special-category data (health, politics, etc.). Please do not submit such data in free-text fields. Catalog items may include user-generated content from X that we did not author; processing of that content is limited to operating discovery and download features.

4. Purposes and Legal Bases for Processing

Where the GDPR/UK GDPR applies, we rely on the following legal bases:

• Contract (Art. 6(1)(b)) — to provide the Service you request: account authentication, downloads, streaming, library, support.
• Legitimate interests (Art. 6(1)(f)) — to secure the Service, prevent abuse and fraud, rate-limit traffic, improve reliability, debug errors, and understand aggregate usage. We balance these interests against your rights.
• Legal obligation (Art. 6(1)(c)) — to comply with law, respond to lawful requests, and keep tax/accounting records where required for paid plans.
• Consent (Art. 6(1)(a)) — where we rely on consent (for example non-essential cookies if introduced, or certain marketing messages). You may withdraw consent at any time without affecting prior lawful processing.

In practical terms, we use personal data to:

• Operate, maintain, and improve the Service;
• Authenticate users and maintain sessions;
• Process download jobs and show status/progress;
• Personalize library, history, and recommendations where enabled;
• Enforce Terms, rate limits, and safety policies;
• Process payments and manage subscriptions when Pro is enabled;
• Respond to support and legal requests; and
• Establish, exercise, or defend legal claims.

5. How We Share Personal Data

We share personal data only as needed for the purposes above:

• Service providers (processors) — hosting, database (e.g. MongoDB), cache/session infrastructure (e.g. Redis), email delivery, error monitoring, and payment processing under contractual confidentiality and data-processing terms.
• OAuth and identity providers — X receives your authorization decision; we receive tokens/profile data as configured.
• Downstream download / media APIs — URLs and technical parameters you submit may be transmitted to our download and catalog infrastructure to fulfill your request. Those systems process content metadata necessary to return files or streams.
• Legal and safety — we may disclose data if required by law, court order, or governmental request, or if we believe disclosure is necessary to protect rights, safety, or integrity of the Service, users, or the public.
• Business transfers — in a merger, acquisition, financing, or sale of assets, personal data may be transferred subject to appropriate confidentiality measures.

We do not sell personal data and do not share it for cross-context behavioral advertising as those terms are commonly defined under US state privacy laws.

6. International Transfers

We may process and store data in the United States and other countries where we or our processors operate. If you are in the EEA, UK, or Switzerland, transfers to countries without an adequacy decision are protected by appropriate safeguards such as Standard Contractual Clauses (SCCs), plus supplementary measures where required.

7. Retention

We retain personal data only as long as necessary for the purposes above:

• Account data — for the life of the account, then deleted or anonymized within a reasonable period after deletion request (subject to legal holds).
• Download / library metadata — while your account is active or until you delete items/account; anonymous abuse logs may be retained for shorter rolling windows.
• Security / rate-limit logs — typically days to a few months, longer if needed for investigations.
• Billing records — as required by tax and accounting law (often multiple years).
• Cache entries — short TTL (minutes to days) for performance (e.g. trending, job status).

When retention ends, we delete or irreversibly anonymize data, unless longer retention is required by law.

8. Security

We implement technical and organizational measures appropriate to the risk, including TLS in transit where configured, access controls, session security, rate limiting, and least-privilege practices. No method of transmission or storage is 100% secure; you use the Service at your own residual risk. Notify us promptly of any suspected unauthorized access to your account.

9. Your Rights

9.1 GDPR / UK GDPR (EEA/UK residents)

Subject to conditions and exceptions, you may have the right to:

• Access your personal data;
• Rectify inaccurate data;
• Erase data (“right to be forgotten”);
• Restrict or object to certain processing;
• Data portability for data you provided to us;
• Withdraw consent where processing is consent-based; and
• Lodge a complaint with a supervisory authority (for example your local EU DPA or the UK ICO).

9.2 California and other US state rights

If you are a resident of California or another US state with a comprehensive privacy law (e.g. CPA, CTDPA, VCDPA), you may have rights to know/access, delete, correct, and opt out of “sale” or “sharing” of personal information, and to non-discrimination for exercising rights. We do not sell personal information. To exercise rights, contact [email protected]. We will verify requests as required by law. Authorized agents may submit requests with proof of authority.

9.3 How to exercise rights

Email [email protected] from the address associated with your account where possible, and describe your request. You may also delete certain library data in-product (favorites, collections) where available. We respond within the timelines required by applicable law (generally 30 days under GDPR, subject to extensions).

10. Children’s Privacy

The Service is not directed to children under 16 (or under 13 where COPPA applies without verifiable parental consent). We do not knowingly collect personal data from children below those ages. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.

Strict prohibition: any use of the Service involving sexual content of minors is forbidden and will be reported to authorities as required by law.

11. Automated Decision-Making

We use automated systems for rate limiting, spam/abuse detection, and recommendation ranking (e.g. trending / related clips). These systems do not produce legal or similarly significant effects about you solely by automated means within the meaning of GDPR Art. 22. You may contact us to contest an account restriction.

12. Third-Party Links and Content

The Service may link to X posts, CDN URLs, payment portals, or other third-party resources. Their privacy practices are governed by their own policies. Thumbnails and media may be served from third-party hosts (including X media domains or our download CDN partners).

13. Do Not Track

Some browsers offer “Do Not Track” signals. There is no uniform industry standard for responding; we currently do not alter behavior solely based on DNT signals. We honor legally required opt-out mechanisms when they apply.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will revise the “Last updated” date and, for material changes, provide additional notice where appropriate. Continued use after the effective date constitutes acknowledgment of the updated Policy, except where consent is required by law.

15. EEA/UK Representative and Complaints

If we appoint an EU or UK representative under GDPR Articles 27, contact details will be published here. You may always complain to your local supervisory authority. We encourage you to contact us first so we can address concerns directly.

16. Contact

• Privacy: [email protected]
• Legal / copyright: [email protected]
• Support: [email protected]