Privacy Policy

Last updated: August 13, 2026

This policy explains what information Xting (“Xting”, “we”, “us”) collects when you use the Xting mobile application and this website (together, the “Service”), how we use it, who we share it with, and the choices you have.

1. Information we collect

Account information

When you create an account we collect a user identifier, your display name, your language, the age you declare, and the gender and matching preferences you set. The age is a whole number you pick yourself before your first story; it is visible only to you and is never shown to the people you play with. If you sign in with Apple or another provider, we receive the identifier and the email address that provider releases to us — if you use Apple’s “Hide My Email”, we only ever see the relay address.

Before adult-content settings can be enabled, we store whether you confirmed that you meet the legal adult-age requirement where you live, the confirmation method, policy version, region code and time. We do not ask for or store your full date of birth for this check. This eligibility record is not sent to advertising or attribution providers.

Gameplay content

We store the stories you play: the choices you make, any free text you write, the scenes generated for you, and a running summary the game keeps in order to stay consistent from turn to turn. We also store which room you are in, whose turn it is, and your online status while a game is active.

Purchases

Purchases and subscriptions are processed by Apple. We do not receive or store your card number or billing address. We receive a purchase receipt, product identifier and subscription status from Apple through our payments provider, and we keep a record of your credit balance and the transactions that changed it.

Device and diagnostic data

We collect basic technical data needed to run and protect the Service: device model and operating system version, app version, IP address, crash reports and error logs, and a push notification token if you allow notifications. We also process campaign and event identifiers, an app-scoped analytics identifier, user agent, and attribution parameters so we can measure whether an invitation or advertisement led to an install, an activated two-player game, or a verified purchase. We access Apple’s advertising identifier (IDFA) only if you grant permission through Apple’s App Tracking Transparency prompt.

We do not collect your contacts, precise location, or health data. If you choose a profile photo, the uploaded image is decoded and re-encoded before publication so embedded EXIF metadata such as camera or location metadata is removed; the image is also subject to our safety checks.

2. How we use your information

• To create and maintain your account and match you with another player.
• To run the game: generate scenes, keep the story consistent, and deliver each turn to the right player.
• To process credits and subscriptions and to keep your balance accurate.
• To send you a notification when it is your turn or when someone invites you, if you have enabled notifications.
• To detect abuse, fraud and automated access, and to enforce our Terms of Use.
• To fix crashes, measure reliability and improve the Service.
• To measure invitations, advertising performance and verified purchases, prevent duplicate event counting, and understand which campaigns produce sustainable two-player use.
• To comply with legal obligations.

Where the GDPR applies, we rely on the performance of our contract with you to run the Service, on our legitimate interest to keep it safe and working, on your consent for push notifications and for the xAI disclosure described below, and on legal obligation where the law requires us to retain records.

3. AI processing

Scenes in Xting are written by an artificial intelligence model. We also use an AI model to prepare the text prompt for an optional scene image. For these two purposes we use xAI, a third-party provider that operates the Grok models. xAI prepares the text prompt; it does not generate the final image. The data sent may include your display name, the themes and topics selected for the room, your language, the current scene, recent turns, the running summary, and the choice or free text you submitted. In a room with two real players, the story request can include this gameplay data for both players. We do not include your email address or Xting account identifier in the model request.

Before Xting sends this data to xAI, the app identifies xAI, explains the purpose and data categories, links to this policy, and asks for your express permission. If both players are real people, both must give the current version of this permission before AI story generation starts; in a bot room, only the real player must do so. You may say no, decide later, or withdraw permission in Settings. If you do not give permission, new AI story generation cannot start. A material change to the provider, purpose or data categories requires a new permission decision.

If you choose a personal profile photo, Xting asks for a separate, versioned OpenAI permission before opening the photo picker or uploading anything. If you allow it, only the selected image after Xting removes metadata and location information is sent to OpenAI for automated safety moderation before publication; your name, email address and Xting account identifier are not included. Saying “Not now” leaves the built-in avatar catalog available and does not select or upload the photo. You can withdraw this OpenAI permission in Settings. Withdrawal stops new personal-photo reviews and uploads; it does not remove your existing profile image or built-in avatar. Removing an existing profile photo never requires OpenAI permission.

Before a new paid AI scene image can be requested, Xting asks for a separate, versioned Google Gemini permission. If you allow it, the scene-image prompt, relevant room story context, and the selected character-avatar references for both players may be sent to Google's Gemini image service. Granting permission does not spend credits: you return to the scene and must choose “Open” again to make the paid request. In a room with two real players, both players must have the current Gemini permission; in a bot room only the real player must. You can say “Not now” or withdraw this permission in Settings. That stops new Gemini generation requests, but existing scene images stay viewable. Permission withdrawal does not itself delete an image or spend/refund credits. This optional purpose is separate from xAI story generation and OpenAI profile-photo moderation.

All narrative text in the Service is AI-generated and fictional. It is not a statement of fact about any real person, and it should not be relied on as advice of any kind.

4. Who we share information with

We do not sell your personal information. We disclose information to the service providers below to operate the Service and, in Meta’s case, to measure invitation and advertising performance:

• Google Firebase — authentication, databases, hosting, cloud functions and crash reporting.
• xAI — generating and translating story text and preparing text prompts for optional scene images, as described above.
• OpenAI — automated safety moderation of a profile photo you choose to upload, as described above.
• Google Gemini — generating an optional scene image you request, as described above.
• RevenueCat and Apple — processing and validating purchases and subscriptions.
• Apple Push Notification service — delivering notifications.
• Meta — app and web event measurement. Depending on your settings, this can include event identifiers, campaign parameters, IP address, user agent, an app-scoped identifier and, only with ATT permission, IDFA. Server-side measurement does not use IDFA when permission is not granted.

We may also disclose information if we are legally required to, or where it is necessary to protect the rights, safety or property of our users or of Xting. If the Service is ever transferred to another company, information may be transferred with it, subject to this policy.

The other player in your game sees the story you play together, your display name, and the scenes generated from your turns. Anything you write becomes part of that story.

5. Retention

We keep your account information for as long as your account exists. Finished stories are archived so you and the other participant can revisit your respective versions. Moderation evidence is copied only when a report or safety action requires it and is assigned a limited retention deadline based on severity. Diagnostic logs are kept for a limited operational period. Records of purchases and a one-way deletion tombstone are retained for as long as tax, accounting, fraud-prevention or legal obligations require, ordinarily no longer than seven years. When you delete your account, active games become read-only, the other participant sees an anonymous deleted-user label, and account, social, avatar and operational identifiers are deleted or pseudonymised. Financial ledgers and necessary safety evidence are retained in pseudonymous form for the periods described above.

6. Your choices and rights

You can request a portable JSON copy of your account, your own point-of-view story text, social records and purchase history from inside the app. Export links expire after 15 minutes and the export file is removed by the next daily cleanup. You can delete your account from inside the app at any time. Account deletion does not cancel an Apple subscription; subscriptions are managed in your App Store account. You can turn push notifications off in your device settings and change tracking permission in iOS Settings.

Depending on where you live, you may also have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to how we use it, to receive a copy in a portable format, and to complain to your local data protection authority. To exercise any of these rights, write to erman.canitatli@gmail.com. We answer within 30 days.

California residents may ask us not to sell or share personal information as those terms are defined by the CCPA. We do not sell personal information. Because some campaign measurement disclosures may be treated as “sharing” under California law, you may submit an opt-out request using the contact address below. We will not discriminate against you for exercising your rights.

7. International transfers

Our providers operate data centres in several countries, including the United States, so your information may be processed outside the country where you live. Where required, these transfers are covered by standard contractual clauses or another approved safeguard.

8. Security

Data is encrypted in transit and at rest by our infrastructure providers, and access to production data is restricted. Every privileged write goes through our server, never directly from the app. No system is perfectly secure, but we work to keep the risk low and will notify you and the relevant authority if a breach affects you.

9. Children

Xting is rated 17+ and is not directed at children. We do not knowingly collect information from anyone under 17. If you believe a minor has created an account, write to us and we will remove it.

10. Changes to this policy

If we change this policy we will update the date at the top of this page, and we will tell you in the app before a material change takes effect.

11. Contact

Questions about this policy or about your data: erman.canitatli@gmail.com.