Terms and privacy
Last changed 11 September 2026
The short version
xyp is a place to read feeds and talk to people you know. It's run by one person, not a company. There's no advertising, nothing is sold to anyone, and nothing you read or write is used to train anything.
What's kept about you
Your email address and the name you chose. A passkey's public key, or a PIN stored as a hash — never the PIN itself. The chats you're in, what you've written, and any files or clips you've sent.
What you read: which cards you've passed, which ones you opened, and when. That's what draws the ring and the reading grid in your own settings. It's yours — nobody else sees it, and it isn't used to decide what you're shown.
Failed sign-in attempts are kept with the address and IP they came from, for a quarter of an hour, so that guessing at someone's account can be slowed down. If you signed up without an invitation, the IP you did it from is kept for a day for the same reason — to stop one machine making a hundred accounts — and then deleted.
What isn't
There's no tracking, no analytics, no advertising identifiers, and no cookies beyond the one that keeps you signed in. Nothing follows you to other sites. Your reading is never shown to anyone else, aggregated, sold, or published.
Who else touches it
A few services do things xyp can't do alone. Each sees only what it needs:
- Resend sends email — so it handles your address and the text of any notice sent to you.
- Pusher carries live messages and push notifications — so it sees that a message happened, and the name of the chat, but never its contents.
- Cloudflare stores clips and serves the site.
- GoDaddy hosts the server the rest of it runs on.
- Google Fonts provides the typeface.
Your rights
Under UK data protection law you can ask what's held about you, ask for it to be corrected, or ask for it to be deleted. Write to ping@xyp.app and you'll get an answer within a month.
Deleting your account removes your messages, your reading history, your credentials and your address. Messages you sent into shared chats are replaced with a note that something was deleted, so other people's conversations still make sense.
How long things are kept
Your account and its contents stay until you delete them. A deleted chat sits in a bin for thirty days and is then gone for good. Invites expire after 14 days. Sign-in attempts are forgotten after fifteen minutes. Backups are kept for a fortnight.
The rules
Don't use xyp to break the law, to harass anyone, or to post material you have no right to post. Don't try to reach parts of it that aren't yours. Feeds you add are fetched politely and at a sensible rate; don't point xyp at anything it isn't welcome to read.
You keep the rights to what you write. Posting it here doesn't give anyone else a claim on it.
What's not promised
xyp is run by one person on modest hosting. It may be unavailable, it may lose data, and features may change or disappear. Keep anything you'd be sorry to lose somewhere else as well. There's no warranty and no liability beyond what the law requires.
Children
xyp isn't for under-13s, and accounts believed to belong to one will be removed.
Changes
If any of this changes in a way that matters, you'll be told in the app before it takes effect rather than quietly.
Getting in touch
ping@xyp.app