Privacy policy

1. What Xavoo is and what data it uses

Xavoo connects people who are nearby so they can meet and talk. The type of relationship they choose to maintain is solely the users' responsibility.

• Profile: name, age, gender, description, work, interests, and photo. Each user decides what to show.
• Account and installation: email address and a random installation identifier. The original value is encrypted using Android Keystore, and Firebase receives only its SHA-256 hash linked to the account. Passwords are managed by Firebase and are not stored by the app.
• Google: if this sign-in method is used, Xavoo receives the name, email, and public photo needed to identify the user and complete the profile.
• Proximity: Bluetooth Low Energy is used to detect nearby devices and estimate an approximate distance.
• Verified encounters: if both people accept while nearby, Xavoo stores the approximate day and a technical confirmation identifier, never the location, Bluetooth address, or exact time.
• Personal QR: when one is generated, Firebase temporarily stores the public token, a random value, its expiry, the name, and the identifiers needed to confirm its owner. The QR does not contain an email address or UID.
• QR scanner: camera access is requested only when the scanner is opened. Images are processed on the phone to detect the code; Xavoo does not store or upload camera photos or video. Firebase receives the scanned token and random value to verify the invitation.

2. What we do not do

• We do not access GPS location or create a location history.
• We do not use the IMEI, MAC address, serial number, or phone number to identify an installation.
• We do not read contacts, files, or photos other than the selected profile image.
• We do not sell personal data or display advertising.

3. Where data is stored

Profile data, contacts, conversations, preferences, confirmed encounter badges, and the encrypted installation identifier are stored on the phone. Firebase stores the data required for authentication, presence, messaging, profile recovery, connections, history, verified encounters, temporary QR invitations, and the link between the installation hash and the account.

Communications use HTTPS/TLS. Messages currently do not use end-to-end encryption. Firebase Analytics and Crashlytics may collect technical usage and crash data, but not conversation content.

4. Use and disclosure

Other users receive only the information the account holder chose to show while nearby or connected. Technical providers process information only to provide authentication, database, analytics, and crash-reporting services.

5. Control and deletion

You can edit or hide information, hide an encounter badge, use invisible mode, limit the detection range, block contacts, delete conversations, renew a QR code to invalidate the previous one, sign out, and delete your account in the app.

Signing out does not release the installation; it allows you to sign back into the same account. Settings offers a controlled account-change request after reauthentication; Firebase records it and enforces a 24-hour security waiting period that can be cancelled. Successfully deleting the account also removes and releases its installation links.

You can also request help at app-xavoo@gmail.com. See the account deletion procedure.

6. Minimum age

Xavoo is intended exclusively for people aged 18 or older.

7. Changes and product transfer

If this policy changes, the app will request acceptance again. If ownership of Xavoo changes through a sale, assignment, or merger, data may be transferred to the new controller, who must follow this policy or an equivalent one and communicate the change.