Privacy Policy

In short

• We keep what's needed to run your account and serve your sites, and nothing for advertising.
• Your sites' visitors aren't given cookies and aren't tracked across days or across sites.
• We don't sell or rent personal data to anyone.
• You can delete your account, and with it your sites, at any time.

About you, the account holder

• Your name, email address and a one-way hash of your password (never the password itself).
• Sign-in sessions, API keys (stored as hashes) and the AI apps you've connected, with when each was last used.
• Your sites, their versions and files, and the custom domains you add.
• An activity log of what was done in your account (published, rolled back, connected an app), so you can see what your AI did.
• The network address a sign-in or sign-up comes from, used briefly to stop password guessing and abuse; it isn't stored with your account.

We use this to run HostX for you, keep it secure, and contact you about your account. We don't send marketing email.

About your sites' visitors

HostX counts visits so you can see your traffic. It does this without cookies and without storing anyone's IP address:

• Each day, a visitor is represented by a salted hash of their network address, browser, the site and the date. The salt is secret and the date changes daily, so the hash can't be turned back into an address or used to follow someone from one day, or one site, to the next.
• With each visit we record the page, the country (from the network, not GPS), the referring website's name, the kind of device (desktop, mobile, tablet or bot), the response and its size.

If you publish something on your site that collects visitors' data, such as a form posting to another service or a third-party analytics script, you're responsible for that and for telling your visitors about it.

Cookies

The dashboard sets one cookie, to keep you signed in. HostX sets no cookies on the sites it serves.

Who else handles it

HostX runs on Cloudflare, which stores the data and serves the sites on our behalf (hosting, storage, DNS and HTTPS certificates). Cloudflare processes it under its own data processing terms and may do so in countries other than yours.

When you connect an AI app, that app can do what you allowed on the Allow screen, using your account. What it does with what it sees is covered by its own privacy policy.

We may disclose information when the law requires it, or to protect people from harm.

How long it's kept

• Account details, sites and their versions: until you delete them or your account.
• Sign-in sessions: 30 days, or until you sign out.
• Uploads that were never finished: removed within a day.
• Activity log: 1 year.
• Visitor numbers: daily totals for 13 months; page, referrer, country and device breakdowns for 90 days.
• Database backups: rolling, overwritten within 30 days, so deleted data leaves them within that time.

Deleting your account

Settings → Delete account removes your sites (they stop being served straight away), their files, your custom domains and their certificates, your API keys, connected apps and sessions, and the account itself. Files that are byte-for-byte identical to ones another account published are kept for that account.

Your rights

Depending on where you live, you may have the right to see, correct, export or delete the personal data we hold about you, and to object to how it's used. Most of it is in the dashboard; for anything else, email privacy@xhost.buzz. You can also complain to your data protection authority.

HostX isn't meant for children under 16, and we don't knowingly hold their data.

Changes and contact

If this policy changes in a way that matters, we'll say so in the dashboard first. Questions: privacy@xhost.buzz. HostX is operated by [operator's legal name and address to be confirmed].