Last updated: October 12, 2026
This page says what Xclr8er ("we", "us") collects when you visit xclr8er.com or use your account at account.xclr8er.com, why, where it is kept, and for how long.
The short version
- The public website uses Google Analytics. Your account area does not use analytics or any third-party script.
- For an account we keep your e-mail address, a random account number and your display settings. We never see your password.
- We do not sell or rent personal information, and we do not use it for advertising.
- We send text messages only to phone numbers whose owners enrolled them. No mobile information is shared with third parties or affiliates for marketing or promotional purposes.
The public website (xclr8er.com)
- Google Analytics. Pages on xclr8er.com load Google Analytics (measurement ID G-HFWLKYK1TN). It sets cookies and tells Google which pages you view, your browser and device type, and your approximate location. You can block it with your browser's privacy settings or Google's opt-out add-on at tools.google.com/dlpage/gaoptout.
- Google Fonts. Pages load fonts from Google's servers, so Google receives your IP address when you visit.
- Server logs. Our hosting provider records each request: IP address, the address requested, time, browser type and country. These logs are deleted automatically after 120 days.
- Contact form. When you write to us we receive your name, e-mail address, the service you chose, your message and your IP address. The message is delivered to our e-mail inbox and to our team's private Slack workspace so we can answer it. The technical log of the request, which includes your IP address, is deleted after 30 days. The message itself stays in our inbox and Slack until we delete it; ask us and we will.
Your account (account.xclr8er.com)
- Who can have one. Accounts are by invitation. An invitation holds your e-mail address in our database until it expires or we withdraw it.
- Requesting access. If you use the "Request access" form, the address you type becomes an invitation for 14 days; that is how "Continue with Google" knows to let you in. We also keep a masked copy of it (like j***@example.com) for 30 days, for our daily summary of requests. To stop one visitor from sending many requests or sign-in codes, we keep a one-way fingerprint of your IP address that changes every day; the key that makes it is deleted after two days, after which the fingerprint cannot be linked to you. The form sends no e-mail.
- What we keep. Your e-mail address, a random account number we create for you, and your settings (language, which cards you show and in what order).
- Signing in with Google. Google tells us your e-mail address, whether Google has verified it, and an identifier for your Google account. We do not receive your name, photo, contacts or anything else from Google.
- How you sign in. With Google, with a code we e-mail you, or with a passkey (your fingerprint, face or security key). Codes are made and checked by Amazon Cognito, the sign-in service we use, and work once. For a passkey, only its public key is stored; the private part never leaves your device. We do not use passwords for your account.
- Cookies. The account area sets three cookies, all needed for signing in and none readable by scripts: one that lasts 3 minutes while you enter a code or use a passkey, one that lasts 10 minutes while you are away at Google, and a session cookie. The session ends after 12 hours without use and in any case 7 days after you sign in. We store only a one-way fingerprint of the session cookie, not the cookie itself.
- A key on your device. When you open the account area, your browser makes a signing key and keeps it in its own storage for this site; where the browser allows no such storage, it keeps the key only until the page is closed. It is made so that it cannot be copied out, not even by our own pages, and its private part never leaves your device: we receive only its public half. Each request the account area sends is signed with it, and your session is tied to it when you sign in, so a copy of your session cookie is useless on any other device. Signing out deletes it; a new one is made the next time you open the account area.
- Logs. Our hosting provider records requests to the account area as described above, deleted after 120 days. When you sign in, the address you return to carries a one-time code; it is recorded in that log, but it works once, expires within minutes and is useless on its own. Our application logs contain your random account number but not your e-mail or IP address, and are deleted after 30 days.
- E-mail. Messages about your account, such as sign-in codes, are sent for us by Amazon Cognito from verify@xclr8er.com, an address that does not receive replies. If a message to you bounces or is reported as spam, our mail provider tells us, and we see a masked form of your address.
Where it is kept, and who helps us
Account data is stored in the United States, in Amazon Web Services' us-east-1 region (Northern Virginia). The companies that process data for us are:
- Amazon Web Services: hosting, database, sign-in (Amazon Cognito) and e-mail sending.
- Google: "Continue with Google" sign-in, Google Analytics, Google Fonts, and our own e-mail inbox.
- Slack: our team's internal messages, which include contact-form messages and masked addresses from access requests and bounced mail.
- Twilio: delivers the text messages of Xclr8er Notifications to enrolled phone numbers.
We share personal information with no one else, unless the law requires it.
Keeping it safe
Every connection to our sites is encrypted; plain web addresses are redirected to encrypted ones. Each account's data is walled off from every other account's by the database's own access rules, not only by our code. Our automated chat assistant is explicitly denied access to account data.
Your choices
- Sign out everywhere. The Settings card ends every session on every device at once.
- A copy of your data. "Download my data" in Settings gives you a file with everything your account holds.
- Deleting your account. "Delete my account" in Settings deletes your account, your sign-in record and everything stored with it, at once. For your safety it asks you to have signed in within the last 10 minutes. You can also e-mail us from the address on your account and we will do it for you.
- After deletion. Database backups, including the copy kept in a second AWS region, roll off after 35 days, and logs after the periods above. Until then a deleted account can remain in them; we do not restore it from them.
Text messages
Xclr8er Notifications sends text messages (account notifications, alerts, reminders and verification codes) only to mobile numbers whose owners enrolled them; how enrollment works. We keep an enrolled number encrypted in our Amazon Web Services account and use it only to send those messages. Twilio, which delivers them for us, receives the number only to send them.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
Reply STOP to any message to stop them, or HELP for help. Message frequency varies. Message and data rates may apply. To have an enrolled number deleted, e-mail us at the address below.
Children
Our services are not meant for children under 13, and we do not knowingly collect information from them. If you think a child has given us information, tell us and we will delete it.
Changes
When this page changes, the date at the top changes with it.