Your data, your rules.

Last updated: 27 April 2026 · Effective: 1 May 2026

This is the short version: we collect only what we need to run Xora, we never sell your data, and you can leave (with everything you've made) any time. The long version follows.

1. Information we collect

·Account info you provide: name, username, email, phone, bio, avatar.
·Content you post: photos, reels, stories, comments, likes, saves.
·Device info: device model, OS version, IP address, app version.
·Usage info: which posts you view, how long, what you tap.

2. How we use it

·To show you content you'll find interesting in feed, explore and reels.
·To keep your account safe — detecting unusual logins and abuse.
·To send you product updates and notifications you've opted into.
·To measure performance and fix bugs (aggregated, never per-person).

3. What we never do

·Sell your personal data. Not to advertisers, not to anyone.
·Read your direct messages. DMs are end-to-end encrypted on iOS and Android.
·Use the contents of your camera roll for ads. Photos stay private until you post them.
·Track you across other apps without your explicit permission.

4. Your controls

·Make your account private — only approved followers see your posts.
·Block, mute or restrict any account at any time.
·Download a copy of all your data from Settings → Account → Download data.
·Delete your account permanently with a 30-day grace period.

5. Data retention

·Posts, reels, stories: kept until you delete them.
·Direct messages: kept until either party deletes them.
·Account metadata: kept for 30 days after account deletion, then permanently erased.
·Backups: retained up to 90 days for disaster recovery.

6. Third parties

·Hosting & CDN: AWS (Mumbai region for Indian users).
·Analytics: aggregated only. We do not use third-party trackers.
·Payments: Razorpay, Stripe (for paid creator features).
·Push notifications: APNs (Apple) and FCM (Google).

7. Children

·Xora is not intended for users under the age of 13.
·Accounts found to belong to children under 13 are removed and parents are notified where possible.

8. Contact

·Questions about this policy? Reach our DPO at privacy@xora.in.
·For deletion or data-export requests, see Settings → Privacy or email privacy@xora.in.

This summary is for clarity. The legally binding version is available at privacy@xora.in.