XloudID Privacy Policy

1. Our Zero-Knowledge Philosophy

XloudID is built on a zero-knowledge data architecture. This means the system is designed to verify your identity, authenticate your logins, and store your vault items without XloudOne ever seeing, storing, or having the technical ability to access the underlying sensitive data. We cannot monetize what we cannot see. Your identity remains yours.

2. Strict COPPA Compliance and Age-Appropriate Design

Protecting minors is our highest priority. We comply fully with the Children’s Online Privacy Protection Act (COPPA) as amended in 2026, as well as state-level Age-Appropriate Design Codes.

Verifiable Parental Consent (VPC): We do not rely on standard click-through agreements for minors. Parental or guardian consent must be actively established through a Verifiable Parental Consent method before a Child Account can be activated. This includes a nominal credit card authorization via Stripe, a selfie-to-ID match, or knowledge-based verification.

Privacy by Default: Minors are legally guaranteed High Privacy by Default. Precise geolocation tracking is strictly prohibited and disabled for all Child Accounts.

Parental Rights: Parents and legal guardians maintain the absolute right to review what data is being shared, approve or deny third-party app access, revoke consent entirely, and demand the immediate deletion of the child's data and vault at any time.

3. Granular Consent and the 60-Day Auto-Deletion Rule

You maintain absolute, granular control over your data flow.

Strict Opt-In Sharing: When logging into a service or authorizing a transaction, you will be presented with a clear, itemized list of exactly what data that service is requesting (e.g., "This app is requesting your email and age bracket"). You dictate exactly what access you grant.

60-Day Auto-Removal: We practice radical data minimization. Any collected data, metadata, or identity attributes that you explicitly choose not to share, or that sit dormant without being utilized in an active network transaction, will be automatically and permanently removed from our active network after 60 days.

4. Xognito, Deep Intelligence, and AI Privacy

We believe artificial intelligence should serve and protect the user, never exploit them.

Security-Focused Intelligence: We use Xognito, our proprietary AI intelligence, solely to scan metadata, server traffic patterns, and unencrypted verification images to secure your account against fraud, botnets, and illegal activity. Xognito acts strictly as a protective overwatch system.

Zero Training Data: XloudOne does not and will not store your personal data, chat logs, or vault contents on company servers to train internal AI models, nor do we sell it to third-party AI companies. Your data is not our training material. You must explicitly opt-in if you ever wish to allow your data to interact with generative AI models within the ecosystem, and you may revoke this permission instantly at any time.

5. Minimal Cookie Policy and Local Device Biometrics

Cookies: We respect your digital footprint. XloudOne employs a radically minimal cookie policy. We only utilize "strictly necessary" technical cookies and secure session tokens required to maintain your active login state. We strictly prohibit the use of third-party advertising, marketing, or cross-site tracking cookies.

Biometrics: If you choose to secure your XloudID using device-native biometrics (such as Apple FaceID or Android Fingerprint), that biometric data is processed entirely locally within your physical device's secure hardware enclave. XloudOne does not collect, transmit, or store your biometric data on our servers under any circumstances.

6. XloudPay, Withdrawals, and Financial Data

When utilizing XloudPay for ecosystem purchases or fiat withdrawals, please note that XloudOne does not process or store your credit card information, bank accounts, or financial routing data on any internal company databases. All payment processing, subscription management, and financial compliance reporting (including KYC/KYB identity verification) are securely handled, encrypted, and cleared exclusively by Stripe.

7. Regional Privacy Rights (CCPA & GDPR Compliance)

Regardless of your global jurisdiction, XloudOne provides standardized privacy rights equivalent to the California Consumer Privacy Act (CCPA) and the European Union's General Data Protection Regulation (GDPR).

You have the right to request a complete, readable export of your available data at any time.

You have the right to request complete account erasure (the "Right to be Forgotten").

We categorically state: We do not sell your personal data to data brokers.

8. Data Deletion Timelines and Breach Notification

Irreversible Deletion: Upon requesting account deletion through your dashboard, the associated encrypted data is permanently purged from our active infrastructure immediately. Because of our architecture, this action cannot be undone. Your encrypted data blobs will organically cycle out of our offline disaster-recovery backups within 30 days.

Breach Notification: In the highly unlikely event of a structural breach to the XloudOne hybrid network or developer infrastructure, we will notify all affected users within 72 hours, despite the mathematical inaccessibility of the underlying zero-knowledge vault data.