PRIVACY POLICY
Last updated: July 9, 2026
WHO WE ARE
XUVO is a retro broadcast streaming service operated by Xyrena ("XUVO", "we"). Privacy questions: accounts@xuvo.com.
WHAT WE COLLECT
Account data you give us: email address, password (stored only as a secure hash), display name, avatar choice, language, and your newsletter choices. Service data we generate: which devices are signed in (platform, device name, sign-in times) and the country derived from your IP to pick your default language. That's it — no ad tracking, no selling data, no third-party analytics on this site.
HOW WE USE IT
To run your account and the service (signing you in, syncing your devices, sending account emails like confirmations and password resets), and — only if you opted in — to send the XUVO newsletter and/or share your email with our parent brand Xyrena for its news list. You can withdraw either consent anytime on your Account page.
WHO PROCESSES IT
We use these processors to run XUVO: Supabase (account database, US), Vercel (website hosting), Postmark (account email), Bunny (video delivery), Sanity (content), Upstash (abuse protection), and Shopify (only if you opted into Xyrena news). Each receives only what it needs.
COOKIES
We use only essential cookies: your session (so you stay signed in) and your language/country preference. No advertising or analytics cookies — which is why there's no cookie banner.
YOUR RIGHTS (GDPR / CCPA & US STATE LAWS)
Access/portability: download everything we store about you from your Account page ("Download my data") — instant, self-serve. Deletion ("right to be forgotten"): press "Delete account" on your Account page — it permanently erases your account, profile, and device history, no email or waiting required. Correction: edit your profile anytime. Opt-out: newsletter toggles on your Account page. We never sell or share personal information for cross-context advertising (CCPA), and we don't discriminate for exercising rights. If you prefer, email accounts@xuvo.com and we'll do it for you.
RETENTION & SECURITY
Account data lives while your account exists and is erased on deletion (provider backups purge on their standard cycles, typically within 30 days). Passwords are hashed, connections are encrypted (TLS), database access is locked per-user (row-level security), and sign-in endpoints are rate-limited.
CHILDREN
XUVO is not directed at children under 13 and we don't knowingly collect their data.
CHANGES
If this policy changes materially we'll note it here and, for significant changes, email account holders.
