Last updated: 11 June 2026
Privacy Policy
This Privacy Policy explains how XcruX ("we", "us"), based in the Czech Republic, handles information in connection with the website xcrux.team (the "Site") and the software tools and applications we operate under the XcruX brand (together with the Site, the "Services"). For any privacy question, contact stheno@xcrux.team.
Data controller
XcruX is the data controller for personal data processed via the Services. Contact: stheno@xcrux.team.
What we collect on the Site
The Site is a static brand website. We do not ask for, or collect, personal data through forms or accounts on the Site. Our hosting provider and reverse proxy may automatically process standard technical data (such as IP address, request time, user-agent and requested URL) in server logs for security and reliability.
Cookies & analytics
The Site sets no cookies and uses no advertising or third-party trackers. We use a self-hosted instance of Umami (running on our own infrastructure at umami.xcrux.team) to collect aggregated, cookieless usage statistics — pages visited, referrer, country, and browser/device type. Umami does not use cookies, does not collect precise IP addresses in stats, and does not track you across other sites; the data is never shared with or sold to third parties.
To understand how visitors use the Site, we also use Umami's session replay, which records in-page interactions (scrolling, clicks, page structure) for at most 5 minutes per session. Replay data is masked, stays on our own infrastructure, and is used solely to improve the Site. To opt out of analytics, you can use a content blocker or your browser's tracking protections — the Site works fully without these scripts.
Connected social media platforms (API data)
Some of our Services connect to third-party social media platforms — for example TikTok, Instagram, Facebook, X (Twitter), LinkedIn or YouTube — through their official APIs, after the user explicitly authorizes the connection (OAuth). When an account is connected, we receive and store:
- OAuth access and refresh tokens issued by the platform;
- basic account information (such as account ID, username/display name and avatar);
- content and metadata needed to operate the service — drafts, scheduled and published posts, and, where the platform provides it, post status and performance metrics.
We use this data solely to provide the service: authenticating the connection, scheduling and publishing content on the user's behalf, and showing the status and results of that content. We do not use platform data for advertising or profiling, we do not sell it, and we do not share it with third parties other than the platform it came from. Our use of data received from each platform complies with that platform's developer terms and policies.
Storage, retention and deletion: platform data is stored on our own self-hosted infrastructure in the European Union and is encrypted in transit. We keep it only while the account connection is active. Users can disconnect a platform account at any time inside the tool, or revoke the authorization in the platform's own security settings — either action invalidates the tokens. Upon disconnection, or upon request sent to stheno@xcrux.team, we delete the associated platform data without undue delay.
Legal basis & purpose
Where technical log data or analytics data is processed, the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in operating a secure, reliable website and understanding how it is used. Where we process platform data for a connected account, the legal basis is the performance of the requested service (Art. 6(1)(b) GDPR). Data is kept only as long as needed for those purposes and then deleted or anonymised.
Processors & third parties
We rely on infrastructure providers (our VPS host and reverse proxy) acting as processors to serve the Site. We do not sell personal data and do not share it except as required to operate the Site or to comply with the law.
Your rights
Under the GDPR you have the right to access, rectify, erase, restrict or object to processing of your personal data, and to data portability. You may also lodge a complaint with the Czech supervisory authority, the Office for Personal Data Protection (ÚOOÚ, uoou.gov.cz). To exercise any right, email stheno@xcrux.team.
Changes
We may update this policy. The "last updated" date above reflects the current version.