Privacy Policy — XDLogin

1. On your device

Your profiles live on the device you create them on: their cookies, site storage, cache, fingerprint settings and proxy credentials. On desktop, each profile is a browser data folder of its own. On Android, profiles sit in the app’s private storage, which the app excludes from Android backups and phone-to-phone transfers. XDLogin doesn’t encrypt these files itself, so they are as safe as the device they are on. We never see what you browse.

2. What the apps send to us

The desktop and Android apps talk to our server, api.xdlogin.com (hosted on Vercel), for these things only:

Your account. Your email address and password when you sign up or sign in. We store the password only as a bcrypt hash. A sign-in from the app also stores a device ID and the app’s name and version. On desktop 3.5.8 and later, the device ID is a random ID the app makes once per install, the same one encrypted sync uses. Desktop 3.5.7 and earlier use a one-way hash of the computer’s name, network adapter address and CPU count; 3.5.8 sends that old hash with its profile count until the server has received it once, so the count stored under it can be retired, and never after that. On a phone, the device ID is a one-way hash of the Android ID.
Your plan. The apps ask which plan your account has, so they know how many profiles you may keep.
Your profile count (desktop only). How many profiles each device holds: one number per device, with no names, settings or content.
Referrals. If you sign up with someone’s referral code, we store that link between the two accounts. To stop people referring themselves, we compare keyed one-way hashes of IP addresses, never the addresses themselves, and the device IDs above, between the two accounts. We keep the hash of the address you signed up from, and of the address an account last loaded its own referral code from. The account that referred you sees only counts, never who you are.
Encrypted sync (Pro and above, off until you turn it on). Your profiles, encrypted on your device with a key made from your sync passphrase before they leave it. We store the encrypted data, a random ID for each device and timestamps, and we can’t decrypt it.
Teams. If you create or join a team, we store its name, its members and their roles.

Two other services see requests from the apps. The desktop app checks GitHub Releases for updates, so GitHub sees those requests. When you test a proxy, the app asks ipinfo.io (desktop) or ipapi.co (Android) for the proxy’s address and location, through that proxy. From desktop 3.5.8, a profile whose timezone is set to match its proxy asks ipinfo.io the same way when it launches.

3. Payments

Paid plans are bought through Dodo Payments for cards, which is the merchant of record, or NOWPayments for crypto. You pay on their checkout pages, and we never see your card details. We send them your account email and an internal account ID so the payment reaches the right account. We keep the payment and subscription notices they send back (plan, amount, status and the customer details they include, such as your email) as billing records.

4. Email

Email from us goes through Resend: password-reset links, a welcome email when you create an account, and a confirmation when you use the contact form. Resend receives the address and the message in order to deliver it.

5. The contact form

A message sent through the contact form is stored in our support inbox with your email address, the topic, your name if you give one, and the message, and a copy is emailed to our support address. The form doesn’t record your IP address or browser.

6. This website

xdlogin.com is served by Cloudflare, which handles every request to it. Visits are counted in two ways:

Our own analytics. For page views, clicks on download links, sign-ups and checkout starts, we record the page, the referring site’s domain, your country (as Cloudflare reports it), your browser and operating-system family, and a hash of your IP address and browser that changes every day, so one day’s visit can’t be linked to the next. With a click on a download link we also record where that visit started: the ?ref= or campaign code in the link you arrived by, or the referring site’s domain. Your browser keeps that one value in session storage until you close the tab. We don’t store your IP address and we set no cookies. The page-view beacon records nothing if your browser sends Do Not Track or Global Privacy Control.
Cloudflare Web Analytics. Cloudflare adds its own beacon script, loaded from static.cloudflareinsights.com, to every page. It sets no cookies; what Cloudflare collects is covered by Cloudflare’s privacy policy.

Fonts are served from this site, and there are no advertising or third-party tracking cookies. If you sign in on the website, your session is kept in your browser’s local storage until you sign out.

7. The browser check

The check at xdlogin.com/check reads your browser’s fingerprint in the browser itself, and none of it is sent to us. To compare your browser with your connection, the page asks our server what that connection looks like from outside: your IP address and, as Cloudflare reports them, the country, region, city and timezone it maps to and the network it belongs to. The server sends that answer straight back to your browser and doesn’t store or log it. The WebRTC test contacts Cloudflare’s public STUN server, stun.cloudflare.com, which sees your IP address like any server you connect to. The result stays on the page unless you copy it, and the copied summary leaves out your IP address. The visit itself is counted like any other page view, as section 6 describes.

8. Deleting your data

You can export or delete your profiles in the app at any time. To delete your account and what we hold for it (sessions, plan, sync data and team memberships), email privacy@xdlogin.com from the account’s address. Payment records we need for accounting are kept. Contact-form messages are stored apart from accounts; ask if you want yours deleted as well.