Privacy

What we collect

To create your account: your email address and the handle you chose. That is the entire identity we ask for — no phone number, no real-name requirement, no date-of-birth beyond confirming you are 13 or older.

When you use XO: the things you choose to post — yaps, stories, quiks, messages, and the audience you assigned each one. If you turn on notifications, a push token for your device. We also see the country a request comes from, which we use to run the service lawfully and decide which markets to open next.

What we never collect: no advertising identifiers, no location trails, no contact-list uploads, no browsing profile, no analytics dossier of who you are. Nothing in the app watches you.

This website, separately: xo.sa uses Google Analytics to count visitors and see which pages get read — page views, rough location by country, browser and referrer. It runs with every advertising signal switched off (no ad storage, no ad personalisation, no Google Signals), so it measures traffic and never builds an advertising profile. It is the marketing site only: the XO app itself sends nothing to Google Analytics, and the two are never joined. Block it with any content blocker and the site works exactly the same.

How your data is locked

Everything travels encrypted, and everything rests encrypted. Your personal identifiers are sealed with keys tied to your account alone, held apart from the content systems — the parts of XO that rank and serve feeds cannot read who you are.

What you share stays inside XO. A post is shown to the audience you chose for it — public, followers, friends, or only you — and to no one else. Your relationships are never revealed to anyone outside them: who you follow, who follows you, and who you talk to is yours.

What we never do

We never sell your data. We never rent it, broker it, or trade it. XO carries no advertising, so nobody pays us to learn about you — the business model is people who love the product supporting it, and that model needs nothing from your privacy.

We never show your numbers to others. Follower counts, like counts, viewer lists — your activity is not a scoreboard for strangers.

Deletion is real

Delete your account in the app — Settings, then Account — and the keys that seal your identity are destroyed. Destroyed keys make your data unreadable everywhere it ever lived, including inside backups, not merely hidden from view. Residual copies age out within 30 days.

You can also export what is yours first: your data is downloadable from the first release, not a feature we add when someone complains.

The waitlist

Joining the waitlist on this site stores your email, the handle you asked for, the country the request came from, and — if you named friends — their emails, used once to bring you in together. We email you about your invite and nothing else. Write to hello@namla.sa to be removed.

Your rights

Ask for a copy of what we hold, ask us to correct it, or ask us to delete it — in the app, or by writing to hello@namla.sa from your account email. We aim to answer within seven days.

If you are in Saudi Arabia, the Personal Data Protection Law gives you these rights; equivalent laws apply elsewhere and we honour the strongest of them for everyone rather than tiering rights by geography.

Children

XO is for people aged 13 and over, and nothing in XO treats a minor's data as an asset. During the closed beta, accounts are limited to people aged 18 and over, and account creation enforces it. If you believe someone under age has an account or gave us their email, write to hello@namla.sa and we will remove it.

Changes

If this policy ever changes in a way that affects data we already hold, we tell you before the change takes effect — not after. The page changes first, then the feature ships.