Privacy Policy

1. Who we are

Xaply (“Xaply”, “we”, “us”) is operated by Pratik Jadhav, an individual based in Pune, India. This policy covers xaply.in, short links on go.xaply.in, and the Xaply mobile apps.

Contact: pratikjadhav9534@gmail.com

2. Information we collect

Depending on how you use Xaply, we may process:

• Account data — name, email address, email verification status, profile image (if provided by you or an OAuth provider), and hashed passwords for email/password accounts.
• Authentication data — session tokens, OAuth account identifiers and tokens from Google or GitHub when you sign in with those providers, and session metadata such as IP address and user agent used to secure your login.
• Link data you create — destination URLs, custom slugs, titles, optional password hashes for protected links, expiry settings, click limits, and optional deep-link / store URLs.
• Click analytics — when someone opens a short link we store aggregated visit details: approximate country and city (from edge network geo), device type, OS, browser family, referrer, and timestamp. We do not store the visitor’s raw IP address or full user-agent string in analytics records.
• Billing data — if you subscribe to Pro, our payment processor (currently Dodo Payments on the web; mobile in-app purchases may use the platform store / RevenueCat when enabled) processes payment details. We store a customer reference ID and your plan status. We do not store full card numbers.
• Transactional email — verification codes, password resets, and operational notices (for example when you hit monthly visit limits) sent via our email provider (Resend).
• Cookies and similar tech — session cookies for signed-in users, and short-lived unlock cookies for password-protected links.

3. How we use information

• Provide, operate, and secure the service (short links, dashboard, apps)
• Show you analytics about your links
• Authenticate you and prevent abuse / rate-limit misuse
• Process subscriptions and communicate about billing
• Send essential account and service emails
• Improve reliability and investigate issues
• Comply with law and enforce our Terms

We do not sell your personal information.

4. Sharing and processors

We use trusted service providers that process data on our behalf:

• Cloudflare — hosting, edge redirects, storage (e.g. D1/KV), geo for analytics, and security
• Better Auth — authentication library used in our app
• Google / GitHub — optional social sign-in
• Resend — transactional email
• Dodo Payments — web subscriptions and billing portal
• Apple App Store / Google Play (and related billing partners, if used) — mobile purchases when offered

We may disclose information if required by law, to protect rights and safety, or in connection with a transfer of the service (with notice where appropriate).

5. Data retention

We keep account and link data while your account is active. Click analytics may be retained for service operation; your plan controls how far back you can browse history in the dashboard (Free: 7 days; Pro: up to 1 year). Ephemeral rate-limit and cache keys expire automatically.

After you delete your account, we remove your user record and related workspace, links, and click data from our database (cascading deletes). Payment-provider records, email logs, and short-lived cache entries may remain with those providers or expire on their own schedules.

6. Your choices

• Access / update — manage profile and password in Settings
• Delete account — see Delete your account for steps, or use Settings (Danger Zone). You can also email us at pratikjadhav9534@gmail.com
• Billing — manage or cancel Pro via the billing portal in Settings (web) or the relevant app store (mobile IAP, when available)

7. Children

Xaply is available to users of all ages. We do not knowingly collect special categories of children’s data beyond what is needed to operate the same service for everyone. A parent or guardian may contact us to request deletion of an account used by a child.

8. Security and international processing

We use industry-standard practices (HTTPS, hashed passwords, edge infrastructure). No method of transmission or storage is 100% secure. Data may be processed in locations where our providers operate, including outside India.

9. Changes

We may update this policy from time to time. The “Last updated” date at the top will change when we do. Continued use after changes means you accept the updated policy.

10. Contact

Privacy questions: pratikjadhav9534@gmail.com
Also see our Terms of Service and Contact page.