Privacy Policy
Last updated: November 1, 2026
Who We Are
xReach ("we", "us") runs xreach.lol and decides how the personal data described here is used: we are its controller. xReach is for people aged 18 or over; we don't knowingly collect data from anyone younger. Questions go to the address in the Contact section below.
Information We Collect
When you sign in with X OAuth, we receive your X handle, display name, avatar URL, and a stable user identifier. We never ask X for your email address, and we don't access your direct messages. Creators allow us to read their public profile and posts (to show their stats, set their category and verify the placements they agreed to) and, when they press Publish, to publish the sponsored post they approve, or repost / quote the advertiser's X post the campaign names, and set the bio line, banner or picture that campaign includes; we never post or change anything else. When you pay as an advertiser, we store the email you pay with (to send receipts, results links, reminders and reports), your plan and its status, and for each listing or campaign its title, messages, category, follower range, creator count, prices, offers and counter-offers, amounts paid, and status. Creators' price mode and their answers to requests are stored the same way. When you accept a post as a creator, we record the post's start time, end time, and the campaign it belongs to. We also collect basic usage data: anonymous page views (PostHog, without the address's query string), our own analytics (see Analytics below) and a count of clicks on each ad's link. Clicks are only a public counter -- nobody is paid or ranked by them. Our network provider, Cloudflare, limits how often one IP address can click or send requests; we never store IP addresses. Payment data, including card numbers and billing addresses, is processed entirely by Dodo Payments and is never stored on our servers; we only store the Dodo payment identifier and the campaign status that results from the payment.
Advertiser Sign-in
Advertisers sign in after paying (a plan, a Quick try or another campaign with creator posts) with Neon Auth, the sign-in service of our database provider Neon, using a one-time email link. Only such an email gets an account: we send an email sign-in link only to it. A leaderboard listing needs no account. Neon Auth receives your email address, and xReach uses it to find your plans and campaigns. There is no password. Sign-in cookies are listed on the Cookie Policy page.
Support Chat
Only signed-in advertisers and creators can chat with the xReach team ("Chat"). We store what you write, when, and the campaign it's about if you link one. When you report a problem, raise a concern about a campaign or ask for a refund, a short note of it is added to your chat too, so support sees everything in one place. The xReach team can read your chat; advertisers and creators never see each other's chats. If a message waits unread, we email the other side a reminder (to an advertiser's sign-in email, or a creator's confirmed payout email), without the message itself.
Messages are removed from your chat 180 days after they were sent (a soft delete). They are not erased at that point: we keep a record that only the xReach team can see, for support, disputes and accounting questions. Don't send passwords or card details in a chat. To have a chat erased, ask us as described under Your Rights.
Analytics
We run our own self-hosted analytics, so the data stays with us. It sets two first-party cookies with random ids, a visitor id and a session id, and records the pages you view, where the visit came from (referrer and campaign tags) and actions such as starting a campaign or signing in. When you open a Dodo checkout we add the visitor and session ids to the payment's metadata, so a payment can be tied to the visit that led to it. For a signed-in creator, we link the visit to their creator id, X display name and payout email (once set); for a signed-in advertiser, to their email. We don't use analytics for advertising and don't share it with anyone. We also count anonymous page views with PostHog, as described above.
Location
To serve each campaign in the right place, we record an approximate location: the country only. When a creator signs in with X, we record the country their connection comes from (as reported by our network provider, Cloudflare, not GPS) and the location written on their X profile. We use it to offer creators campaigns meant for their country. When an advertiser starts a checkout, its country may appear in our short-lived operational logs if the checkout is refused (to look into fraud); it isn't stored with your campaign. We never store your IP address, city, region or coordinates, and you can ask us to delete your data as described in Your Rights below.
How We Use Information
We show creators' handle, display name and avatar on creator cards and the creators page. Leaderboard listings show the advertiser's site icon, name, link, description and category. We use campaign data to populate the live leaderboard and to compute aggregate statistics shown on the Stats page. We use usage data to show click counts and to debug errors in production. We do not use any of this data to build advertising profiles or sell it to third parties. Internally, our team uses anonymized, aggregated views of usage data to understand which features are working and where users get stuck. We keep campaign, payment and post records as long as tax and accounting law requires, then anonymise them. We will delete your X profile data on request as described in the Your Rights section below.
Automated Category Classification (AI)
We use artificial intelligence to classify and identify creator profiles, placing each account in the content categories advertisers target. The analysis covers only public information: your X display name, handle, bio, website link (and that page's public title and description), X's public account labels, and a small number of your recent public original posts. The request goes through Cloudflare's AI Gateway to the AI model it routes to (Cloudflare Workers AI or another model provider we set there), acting on our behalf, who process this public information under their own terms and privacy policies, which may include improving their services. Nothing private is used: no direct messages, email address or payment details. We keep the result and the posts it was based on, and run the analysis again only when your posts or our category list change. Results that need a closer look, including accounts X labels as automated, are reviewed by our team. You can ask us to review or correct your category from your dashboard or by email at any time.
Information Sharing
We do not sell your personal information to anyone, and we do not share your data with advertising networks, data brokers, or social platforms beyond X itself. We share the minimum necessary data with Dodo Payments to process transactions; specifically, we send the amount, your email and a unique reference, along with the analytics visitor and session ids described above, and Dodo collects your card and billing details and any tax on its own secure checkout page. Advertiser sign-in is handled by Neon Auth. Emails (receipts, results links, reminders, sign-in links) are sent through Resend, with Cloudflare Email Sending as a fallback, and mail to our own addresses is forwarded by Cloudflare Email Routing; they receive the recipient's address and the email itself. Our database is hosted by Neon and the site runs on Cloudflare. To pay creators we share the payout email they confirmed, the amount and the campaign name with Talentir, our payout partner; the creator enters their PayPal, Venmo or bank details on Talentir's own page, and we never see or store them. When an advertiser's refund is sent as a Talentir payout (their choice, or a payment in INR made with an Indian card or UPI, which Dodo can't refund in part), we share their email, the amount and the campaign name with Talentir in the same way. We show creators' X handle, display name and avatar on creator cards (and, to advertisers picking creators, their price, engagement and reply stats). We may share aggregated, anonymized statistics with partners or in public marketing materials, but only in a form that cannot be reversed to identify you. We will disclose specific account data to law enforcement only when required to comply with a valid legal process, and we will tell you when we do unless the law forbids it. Apart from these cases, your data stays inside xReach.
Data Security
Data is stored in a managed Postgres database (Neon), reached through Cloudflare, and campaign images in Cloudflare R2 storage, with access restricted to the small team that operates xReach. We don't keep X access tokens: the sign-in permission and each one-time publishing permission are given back to X straight away. Passwords are never stored because sign-in is delegated to X OAuth for creators and to Neon Auth (an email link) for advertisers, which means we never see or touch a password. Payment data is handled exclusively by Dodo Payments under their PCI-DSS compliance, so our servers never see raw card numbers or CVVs. We use HTTPS for all traffic, including API requests, OAuth callbacks, and payment webhooks, to prevent in-transit interception. We log errors with enough context to debug issues, masking email addresses and never logging card details, passwords or access tokens; payment ids appear in logs so we can trace a payment. We do regular access reviews and remove team access when someone leaves the project. Despite these measures, no system is perfectly secure, so we will notify affected users promptly if we ever discover a breach.
Cookies
We set strictly necessary first-party cookies (post_session keeps a creator signed in and xr_c tells our pages that one is, oauth_state protects X sign-in, xmp_live shows you fresh data right after you pay or save a change, xr_home_side remembers the home page side you picked), Neon Auth's cookies that keep an advertiser signed in. Our own analytics sets two first-party cookies with random ids (a visitor id and a session id, see Analytics above). We set no advertising cookies. Your theme choice and PostHog's anonymous page-view id live in local storage, not cookies. For a leaderboard listing, one results link, for all of that email's listings, is emailed to the address that paid, valid for 24 hours. The Dodo Payments checkout and x.com set their own cookies under their own policies. The Cookie Policy lists our cookies.
Legal Bases & Transfers
Where data protection law (such as the GDPR) asks for a legal basis, we rely on: performing our contract with you (sign-in, listings, campaigns, payments, payouts and support); our legitimate interests (keeping the service secure, preventing fraud, setting creator categories from public information, and our own analytics); legal obligations (tax and accounting records); and your consent where we ask for it. Our service providers (Cloudflare, Neon, Dodo Payments, Talentir, Resend, PostHog and the AI providers above) may process data outside your country, including in the United States; where the law requires it, these transfers rely on safeguards such as the European Commission's standard contractual clauses.
Uploaded Images
Banner and profile images uploaded for a campaign are deleted after 1 day if the checkout isn't paid. For a paid campaign they are kept while it runs and for 30 days after it ends, then deleted automatically.
Your Rights
You have the right to request a copy of all personal data we hold about you, including your X handle, display name, avatar URL, campaign history, and post history. You have the right to request that we delete your X profile data, which we will do within 30 days of verifying your identity. Campaign records and post records are part of the public marketplace history and will be retained in anonymized form so the leaderboard continues to make sense. You have the right to correct inaccurate profile data by signing in with X again, which will overwrite the cached handle, display name, and avatar. You have the right to object to processing of your data for analytics purposes, which we will honor by excluding your usage events from aggregate counts. You have the right to export all of your data in a machine-readable JSON format. You can also ask us to erase your support chat messages. Advertisers can ask us to delete their sign-in and email; payment, plan and campaign records we must keep for accounting stay, without personal details where possible. To exercise any of these rights, send an email to the address listed in the Contact section below with the subject line "Data Request" and we will respond within 30 days. You also have the right to complain to the data protection authority where you live or work.
Contact
If you have any questions about this Privacy Policy or want to exercise any of the rights described above, you can reach us by email at privacy@xreach.lol. We aim to respond to all privacy-related inquiries within 30 days, and we will acknowledge receipt of your email within 5 business days. If you believe we have mishandled your data, please tell us in your email so we can investigate and, where appropriate, notify other affected users. If you are a regulator or law enforcement officer with a legal process, please include the relevant case number and the specific data you are requesting. If you are a security researcher who has found a vulnerability, please do not file a public issue; email us privately so we can patch before disclosure. We do not currently have a dedicated Data Protection Officer because we are a small operation, but the founding team reviews every privacy inquiry directly. This contact section will be updated if our address or processes change.