Xcojo Privacy Policy

When you use Xcojo, you trust us with your information

This policy explains what information Xcojo (“Xcojo”, “we”) collects when you use Xcojo products — including Xcojo Account, JoinCTT, Ixchel Search, Stage, Gate, Dedun, Beher, ECO, Jolt, JoinStream, Astromark, Stocrib, HermesG, Noxlumi, AztecInstitute, Xcojo Ads, Xcojo Partners and our developer services — why we collect it, and how you can control it.

The short version: we collect what we need to run and improve our services and keep them safe; we don’t sell personal information; ads on Xcojo are contextual and never built from your personal history; and you can see, download and delete your information.

Information we collect

Things you create or give us

• Account information: your name, Xcojo handle, email or phone number, password or passkey, date of birth, country and language. Signing in with Google gives us the name, email and photo Google shares; we may ask for other details gradually, and you can always skip.
• Content: posts, messages, photos, videos, listings, reviews, AI prompts and files you upload, places you save and other things you create.
• Payments: XCJ balances and transactions, payout details you give us, and records of purchases. Card and bank details are processed by payment partners, not stored by us in full.
• Identity checks (optional): if you choose Dedun verification or apply to drive with ECO, the documents and photos you upload.

Information from your use of our services

• Device and log information: device type, operating system, browser, IP address, crash reports, and the date and time of requests.
• Activity: searches, pages and products you use, videos watched, interactions with content and ads, and settings — used to provide and improve the service. You can view and delete activity.
• Location: an approximate (city-level) location from your IP address, which we use to show local language, currency, news, places and prices. Precise location (GPS) is used only when you allow it for a feature such as directions or rides, and is never required to create an account.
• Voice and camera: only when you start a voice or Live feature; audio and video are processed to answer you and are not used to profile you.

Information from others

People can share content that includes you, partners who help you sign up may submit details you give them, and we receive information from security and fraud-prevention partners.

Why we collect information

• Provide our services: sign you in, deliver messages, process payments, show search results, run JoinCTT, route rides and deliveries.
• Maintain and improve: fix problems, measure performance and develop new features. We use aggregated or de-identified information where possible.
• Personalize: language, country, recommendations and saved preferences. You can turn personalization off.
• Measure and show contextual ads: ads are chosen from the page you’re on, your search words and your city-level location — never from your messages, history or profile. Supervised (child) accounts see no ads.
• Communicate: security alerts, receipts, changes to services and replies to your requests.
• Protect people and Xcojo: detect fraud, spam, abuse, security risks and illegal activity, including with automated systems reviewed by people.
• Meet legal obligations: comply with law, respond to lawful requests and enforce our terms.

Where the law requires a legal basis, we rely on: performing our contract with you; your consent (which you can withdraw); our legitimate interests (such as security and improving services) balanced against your rights; and legal obligations.

AI and your information

JoinCTT and other AI features process the prompts, files, voice and images you give them to respond to you. Conversations are saved to your account so you can return to them; you can turn history off, delete conversations or use Ghost chat, which isn’t saved. We may use conversations that are not deleted to improve safety and quality, using techniques that remove personal identifiers; you can opt out in JoinCTT settings. AI providers that help us run models process data on our instructions and may not use it for their own purposes.

When we share information

We do not sell your personal information or share it for cross-context behavioural advertising. We share information only:

• With your consent or at your direction (for example, when you send a payment, message someone or connect a third-party account such as Bybit).
• With other people as the product requires — your public profile and posts, your name on a payment, a driver’s first name and vehicle to a rider.
• With Xcojo Partners serving you in your country, limited to what they need (for example, a partner completing your XCJ purchase).
• With service providers who process data for us under contract (hosting, payments, email and SMS delivery, AI model hosting, maps).
• For legal reasons — to comply with law or valid legal process, protect people from harm, prevent fraud and enforce our terms. See Law enforcement & transparency.
• In a business transfer, under the same protections, with notice to you.

Your controls

• Xcojo Account: review and edit your information, country, language and connected services at accounts.xcojo.com.
• Activity and history: view and delete activity, JoinCTT history and saved items; turn history off.
• Download: export a copy of your information.
• Delete: delete content, specific products’ data, or your whole account.
• Location: device location is off unless you allow it; you can change your country manually.
• Communications: unsubscribe from non-essential emails and notifications.

Your rights

Depending on where you live, you may have the right to access, correct, delete or port your information, to object to or restrict certain processing, to withdraw consent, and not to be subject to decisions based solely on automated processing that significantly affect you. You can exercise most rights in your Xcojo Account, or contact us at privacy@xcojo.com. You also have the right to complain to your local data-protection authority. We won’t discriminate against you for exercising your rights.

How long we keep information

We keep information for as long as you keep it in your account or as long as needed for the purpose it was collected: some data until you delete it; some (such as server logs) for limited periods; some longer for legal, tax, anti-fraud or security reasons (for example, payment records). Identity-verification photos are deleted after review periods (90 days by default). When you delete your account, we start removing your data promptly and complete deletion from active and backup systems within a defined period, except where we must keep certain records by law.

Keeping your information secure

We encrypt data in transit, protect sensitive data at rest, offer passkeys and two-step verification to everyone, limit staff access on a need-to-know basis with audit logs, and continuously test our systems. No system is perfectly secure; if a breach affects you, we’ll tell you as the law requires.

Children

Children under the age required in their country may use Xcojo only with a supervised account created by a parent or guardian through Xcojo Family. We collect only what the service needs, show no ads to supervised accounts, and give parents controls. See Children & families.

International transfers

Xcojo operates internationally, so your information may be processed in countries other than your own. When we transfer information across borders we use appropriate safeguards required by law, such as standard contractual clauses.

Changes and contact

We’ll update this policy when our services or the law change. If changes are significant we’ll tell you in advance. Questions: privacy@xcojo.com · Data protection officer: dpo@xcojo.com.