Privacy notice

1. Controller

2. Website access and hosting

When you open the website, the hosting provider processes the technical connection data needed to deliver it. This may include the IP address, time and destination of the request, transferred data volume, referrer, browser, operating system and HTTP status. The data is required to serve the website, keep it stable and prevent abuse.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the safe and reliable operation of this service. Xivogo is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Retention periods depend on the agreed hosting settings; data is deleted when it is no longer needed for operation, security or legal evidence.

Where data is processed outside the European Economic Area, transfers rely on the mechanisms and safeguards provided for by the GDPR.

3. Story and editorial data

Xivogo stores published story content, source references, status ratings and editorial audit events in a PostgreSQL database provided by Supabase Pte. Ltd. Simply reading the public website does not create a user account or visitor profile in this database.

Editorial audit data makes changes traceable and protects content integrity. Editorial users are recorded under pseudonymous identifiers. The legal basis is Article 6(1)(f) GDPR. Records are kept for as long as this documentation is required and are then removed under the applicable deletion rules.

4. Protected editorial access

For authorised editorial users, Xivogo sets the technically necessary xivogo-editorial-session cookie. It is limited to the editorial area, works only over encrypted connections, cannot be read by browser scripts and remains valid for up to 30 days. Its validity is renewed while the editorial area is used, and the cookie is deleted immediately on logout. The legal basis is Article 6(1)(f) GDPR.

To limit automated login attempts, the device IP address is pseudonymised with a secret key. Upstash Inc. uses the resulting identifier only to enforce a 15-minute login rate limit. The service’s analytics feature is disabled.

5. Contact

If you contact us by email, we process the submitted contact details and message to handle your request. Depending on the subject, the legal basis is Article 6(1)(b) or (f) GDPR. The data is deleted once the request is complete unless a legal retention duty applies.

5a. Optional Xivogo user account

Readers may voluntarily create an account using an email address and password. Authentication is provided by Supabase Auth. Xivogo does not receive or store the password in plain text. Technically necessary session cookies that browser scripts cannot read keep the account signed in on the device and are deleted on sign-out.

When a password is created or changed, Xivogo checks on the server whether it appears in known data breaches. The password is converted to a SHA-1 hash only on Xivogo's server, and only its first five characters are sent to the Pwned Passwords service operated by Superlative Enterprises Pty Ltd. The password, complete hash and email address are not transmitted; Xivogo compares the returned hash suffixes locally and only after form submission. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is protecting accounts from passwords known to be compromised.

To protect accounts from automated attacks, the IP address is pseudonymised with a secret key during sign-in, registration, password reset and account deletion. Upstash Inc. processes only the resulting action-specific identifier to limit attempts. The time windows are no longer than one hour and the service's analytics feature is disabled. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is protecting user accounts and technical systems from automated abuse.

The legal basis is Article 6(1)(b) GDPR where processing is required to provide the voluntarily selected account functions. The account can be permanently deleted in ‘Account & security’ after explicit confirmation. This deletes the authentication record and linked account data: favourite club, followed clubs, saved stories and matches, notifications, push subscriptions, and the community profile with posts and reactions. Deletion cannot be undone. Data needed for legal obligations or to address specific abuse is retained only to the extent and for the period required.

Device notifications are enabled only after explicit permission on the individual device. Xivogo stores a device-specific push endpoint and its technical keys in Supabase. Delivery uses the push service of the browser or operating system in use, for example Apple, Google, Microsoft or Mozilla. Permission is optional and can be withdrawn at any time in Xivogo or in the browser settings. The legal basis is Article 6(1)(a) GDPR.

6. Feedback and spam protection

The feedback page lets you submit a category, message, optional reference to a Xivogo page and optional email address. We store this information in Supabase so the team can review and handle the message. The IP address is pseudonymised and is not stored in plain text. Feedback is normally deleted within twelve months unless it is still needed for follow-up or legal evidence.

The page also uses Cloudflare Turnstile from Cloudflare, Inc. Turnstile examines technical browser and device signals to detect automated submissions. Its token is checked by the server and is not saved with the feedback message. The legal basis is Article 6(1)(f) GDPR.

7. Community profile and posts

People who voluntarily use the community choose a public community name and avatar. Published comments, replies, quotes and reactions are linked to that community profile. The account email address is not shown to other community users.

Reports are stored with their reason, reporting account and review status so the moderation team can investigate spam, abuse, discrimination, threats and other rule violations. Moderators can hide posts and suspend accounts from the community. Community features rely on Article 6(1)(b) GDPR; abuse prevention and moderation rely on Article 6(1)(f) GDPR.

Posts and reactions are normally retained for as long as the account or relevant post exists. Self-service account deletion also deletes the community profile and its associated posts and reactions. Withdrawn or moderated content and reports may exceptionally be retained for the period needed to investigate specific rule violations, protect the community or comply with legal obligations. Requests for access, correction or further deletion can be sent to the privacy address below.

8. Links to external sources

Story pages may link to media outlets, clubs or other external sources. A connection to the third party is made only when you open the link. The third party’s own privacy notice then applies.

9. Data-minimised audience measurement and no advertising cookies

Xivogo counts which published stories are opened and which story is selected after the internal search is used. Search terms are not stored. Supabase stores only hourly totals per story, which are used for the seven-day “Trending now” section. These totals contain no IP addresses, device identifiers or individual browsing histories and are deleted within 30 days.

To limit repeated or automated counts, the IP address and browser identifier are pseudonymised with a secret key. Upstash uses the resulting identifier only within a short window of no more than 30 minutes; the service’s analytics feature remains disabled. No cookies are set for this measurement. The legal basis is Article 6(1)(f) GDPR. The legitimate interest is to present current, relevant content while protecting the counts against simple manipulation.

Xivogo continues to use no advertising tracking, marketing profiles or social media plugins. Turnstile is loaded only on the feedback page to prevent abuse; its optional pre-clearance feature is not enabled.

10. Your rights

Subject to the legal requirements, you may have rights of access, correction, deletion, restriction, data portability and objection. Consent can be withdrawn for the future at any time. You may also lodge a complaint with the competent data protection authority.

Privacy requests can be sent to contact@xivogo.com. Xivogo does not use solely automated decision-making within the meaning of Article 22 GDPR.

11. Updates to this notice

We update this notice when our technical processing, service providers or legal requirements change.