Privacy notice

1. Controller

A full service address will be added together with the complete legal notice before the official public launch.

2. Website access and hosting

When you open the website, the hosting provider processes the technical connection data needed to deliver it. This may include the IP address, time and destination of the request, transferred data volume, referrer, browser, operating system and HTTP status. The data is required to serve the website, keep it stable and prevent abuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the safe and reliable operation of this service. Xivogo is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Retention periods depend on the agreed hosting settings; data is deleted when it is no longer needed for operation, security or legal evidence.

Where data is processed outside the European Economic Area, transfers rely on the mechanisms and safeguards provided for by the GDPR.

3. Story and editorial data

Xivogo stores published story content, source references, status ratings and editorial audit events in a PostgreSQL database provided by Supabase Pte. Ltd. Simply reading the public website does not create a user account or visitor profile in this database.

Editorial audit data makes changes traceable and protects content integrity. Editorial users are recorded under pseudonymous identifiers. The legal basis is Article 6(1)(f) GDPR. Records are kept for as long as this documentation is required and are then removed under the applicable deletion rules.

4. Protected editorial access

For authorised editorial users, Xivogo sets the technically necessary xivogo-editorial-session cookie. It is limited to the editorial area, works only over encrypted connections, cannot be read by browser scripts and remains valid for up to 30 days. Its validity is renewed while the editorial area is used, and the cookie is deleted immediately on logout. The legal basis is Article 6(1)(f) GDPR.

To limit automated login attempts, the device IP address is pseudonymised with a secret key. Upstash Inc. uses the resulting identifier only to enforce a 15-minute login rate limit. The service’s analytics feature is disabled.

5. Contact

If you contact us by email, we process the submitted contact details and message to handle your request. Depending on the subject, the legal basis is Article 6(1)(b) or (f) GDPR. The data is deleted once the request is complete unless a legal retention duty applies.

6. Feedback and spam protection

The feedback page lets you submit a category, message, optional reference to a Xivogo page and optional email address. We store this information in Supabase so the team can review and handle the message. The IP address is pseudonymised and is not stored in plain text. Feedback is normally deleted within twelve months unless it is still needed for follow-up or legal evidence.

The page also uses Cloudflare Turnstile from Cloudflare, Inc. Turnstile examines technical browser and device signals to detect automated submissions. Its token is checked by the server and is not saved with the feedback message. The legal basis is Article 6(1)(f) GDPR.

7. Links to external sources

Story pages may link to media outlets, clubs or other external sources. A connection to the third party is made only when you open the link. The third party’s own privacy notice then applies.

8. Data-minimised audience measurement and no advertising cookies

Xivogo counts which published stories are opened and which story is selected after the internal search is used. Search terms are not stored. Supabase stores only hourly totals per story, which are used for the seven-day “Trending now” section. These totals contain no IP addresses, device identifiers or individual browsing histories and are deleted within 30 days.

To limit repeated or automated counts, the IP address and browser identifier are pseudonymised with a secret key. Upstash uses the resulting identifier only within a short window of no more than 30 minutes; the service’s analytics feature remains disabled. No cookies are set for this measurement. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is to present current, relevant content while protecting the counts against simple manipulation.

Xivogo continues to use no advertising tracking, marketing profiles or social media plugins. Turnstile is loaded only on the feedback page to prevent abuse; its optional pre-clearance feature is not enabled.

9. Your rights

Subject to the legal requirements, you may have rights of access, correction, deletion, restriction, data portability and objection. Consent can be withdrawn for the future at any time. You may also lodge a complaint with the competent data protection authority.

Privacy requests can be sent to kontakt@xivogo.com. Xivogo does not use solely automated decision-making within the meaning of Article 22 GDPR.

10. Updates to this notice

We update this notice when our technical processing, service providers or legal requirements change.