Privacy Policy

Effective date: 6 September 2026 · Last updated: 6 September 2026

This policy explains what information xorio collects, how we use it, and the choices you have. It applies to our websites and to the mobile applications we publish, including our Android apps distributed through Google Play.

1. Who we are

"xorio", "we", "us" and "our" refer to xorio, a Rust & STEM open-source collective founded by Radu Marias, based in Romania (European Union). We are the data controller for any personal data processed as described in this policy. You can reach us at hello@xorio.rs.

2. What this policy covers

• Websites: xorio.rs and xorio-website.vercel.app, and any subdomains.
• Mobile applications: every app published on Google Play (or other app stores) under the xorio developer account, unless that app ships its own, more specific privacy policy — in which case the app-specific policy takes precedence for that app.

Our open-source projects on GitHub are governed by the terms of GitHub and of the respective project licences, not by this policy.

3. Information we collect

3.1 On our websites

• No accounts, no tracking cookies. Our websites have no sign-up, no login, no advertising and no analytics trackers.
• Local preferences. The site stores your theme choice (light/dark) and a short-lived cache of public GitHub statistics in your browser's local storage. This data never leaves your device and you can clear it at any time through your browser.
• Hosting logs. Our sites are hosted by Vercel, which — like any web host — may record standard technical request data (IP address, browser type, requested page, timestamp) for security and operational purposes.
• Third-party resources. Some pages load fonts from Google Fonts, retrieve public profile statistics from the GitHub API and a streak image from an external service, and embed nothing else. When your browser fetches those resources, the respective provider receives your IP address and standard request metadata under its own privacy policy.
• What you send us. If you contact us by email, Discord, Slack or another channel, we receive what you choose to share (for example your name, email address and the content of your message).

3.2 In our mobile applications

• No accounts. Our apps do not require you to create an account or provide personal details to use them.
• Information you provide. Content you enter, create or import into an app (for example text, notes, files, photos or settings) is processed to provide the feature you are using. Unless an app clearly tells you otherwise at the point of use, this content stays on your device and is not transmitted to us.
• Device permissions. An app may request permissions such as camera, microphone, photos/media, location, notifications or network access. Each permission is requested only when needed for a specific feature, is used solely for that feature, and can be revoked at any time from your device's system settings. We do not access permissions in the background for unrelated purposes.
• Diagnostics. If an app crashes, Android and Google Play may collect anonymised crash and performance diagnostics according to your device's settings and Google's policies. We use such reports only to fix bugs and improve stability.
• Network requests. Where a feature needs the internet (for example to fetch public data or to call an AI or translation service the app is built on), the request is sent to that service and is subject to its privacy policy. We do not add identifiers to such requests beyond what the service technically requires.

We do not collect precise location history, contacts, call logs, SMS, financial information or health data, and we do not build advertising profiles.

4. How we use information

• To provide, operate and maintain our websites and apps and the features you use.
• To respond when you contact us.
• To diagnose crashes, fix bugs and improve stability and security.
• To comply with legal obligations.

We do not use your information for advertising, profiling or automated decision-making that produces legal or similarly significant effects.

5. Sharing of information

We do not sell, rent or trade personal information. We share information only:

• with service providers that host or operate our services (for example Vercel for websites, Google Play for app distribution and diagnostics), strictly to provide those services;
• with third-party services an app or page relies on for a feature, as described in section 3 — only the data needed for that feature;
• when required by law, or to protect the rights, safety and security of users, xorio or the public.

6. Data retention and deletion

• On-device data (app content, preferences, local storage) remains under your control and is removed when you clear the app's data or uninstall it, or clear your browser storage.
• Correspondence is kept only as long as needed to handle your request and for a reasonable period afterwards.
• Diagnostics are retained according to Google's retention periods.

To ask us to delete any personal data we may hold about you, email hello@xorio.rs from the address you used to contact us. We will act on valid requests within 30 days.

7. Security

We use reasonable technical and organisational measures to protect information — including transport encryption (HTTPS) for our websites and network requests, and keeping app data on your device wherever possible. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Children

Our websites and apps are not directed at children under 13 (or the higher age of digital consent in your country) and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

9. Your rights

Depending on where you live — including under the EU/UK GDPR and comparable laws such as the California CCPA — you may have the right to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. Because we hold very little personal data, most of these rights can be exercised directly by managing data on your own device; for anything else, email hello@xorio.rs. You also have the right to lodge a complaint with your local data protection authority; in Romania that is ANSPDCP.

Where we process personal data, our legal bases are performance of the service you requested, our legitimate interest in running secure and reliable services, and compliance with legal obligations.

10. International transfers

Our service providers (such as Vercel and Google) may process data on servers outside your country, including in the United States. Where required, such transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will change, and material changes will be noted on this page. The current version is always available at xorio.rs/privacy.html.

12. Contact