Polityka prywatności

Last updated: Wersja robocza. Ten tekst zacznie obowiązywać w dniu premiery XenPips.

XenPips is a desktop pet app for Windows and Mac, the website xenpips.com and the account service behind them. This page says what we collect, why, where it goes and how to make us delete it.

Who we are

XenPips is run by ESSOTEC, LLC, Robocha str, 52, 73000 Kherson, Ukraine. We are the controller of the personal data described here. Contact for anything about your data: [email protected].

Skydex (skydex.online) is run by the same company. If you connect a Skydex account, the Skydex privacy policy covers what Skydex itself keeps.

The short version

• The app works without an account and without sending anything about you.
• It does not read your screen, your files, window titles or what you type. It asks for no screen recording or accessibility permission.
• With an account we keep your email (or the Google, Apple or Skydex identity you signed in with), your pets and the computers you linked.
• Usage statistics are anonymous and you can turn them off in the pet's menu.
• We do not sell data and do not show ads.

What the app does on your computer

To behave like a pet, the app looks at a few things locally. None of it leaves your computer:

• Where your screens, taskbar or Dock are, so the pet walks along the bottom of the screen.
• The position and size of open windows (never their titles or contents), to notice that a film, game or call went fullscreen and keep the pet quiet.
• The cursor position and the cursor's shape (arrow, pointing hand, text beam), so the pet can follow the mouse or look curious. The app does not know what the cursor points at.
• Its own settings: the pet's place on the screen, mode, language, whether it starts with your computer.

If you link a computer to your account, the app keeps a key for it in the macOS Keychain or, on Windows, in a file encrypted for your Windows user.

What we collect

Without an account.

• *Anonymous usage statistics*, at most once an hour while the pet runs: a random install id made on your computer (not tied to you or your account), the app version, Windows or Mac, the pet's mode, how many times you clicked or dragged the pet and how many minutes it was awake. We use them to know how many people actually use the app each week. Turn them off in the pet's menu (Send usage statistics); this takes effect at once.
• *Update check*: once a day the app asks our server for the latest version. The request carries the app version and nothing else about you.
• *Downloads*: the installer comes from downloads.xenpips.com, served by Cloudflare.

With an account (L1: email, Google, Apple or Skydex sign-in).

• Your email address, or the account id and email that Google, Apple or Skydex give us when you sign in with them. With Apple's "Hide my email" we get the relay address.
• Which pets live on your account, and whether you are a tester.
• *Linked computers*: the name your computer reports ("MacBook Pro", "DESKTOP-4KQ2"), when it was linked and last used. We store only a hash of each computer's key. You see the list in your account and can unlink any computer.
• *Skydex connection*, if you connect it: your Skydex account id, so your PIP can wear its colours and gear and join your flights. The app then talks to Skydex directly with a Skydex key for that computer.

Technical logs. Like any website, our servers log requests: IP address, time, page or API path, browser or app version. We use them to keep the service running and to deal with abuse.

Why we may use it (legal bases)

• To provide what you asked for: the account, your pets, linked computers, the Skydex connection (performance of a contract).
• Usage statistics and technical logs: our legitimate interest in knowing whether the app works and is used, and in keeping it secure. You can turn the statistics off.
• To answer you when you write to us (legitimate interest, or your request).
• Where the law requires it (legal obligation).

Who else handles it

We use these providers, only for the purposes above:

XenPips is hosted in Ukraine, a country outside the EU/EEA that is not covered by an EU adequacy decision; by using XenPips your data is processed there. Some of the providers above are in the United States. Where the law requires it we rely on the European Commission's standard contractual clauses or the provider's certification under the EU-US Data Privacy Framework.

How long we keep it

• Account data: while the account exists. Delete the account and we delete it within 30 days, except what the law makes us keep.
• Linked computers: until you unlink them or delete the account. An unlinked computer stays visible in your list as "unlinked" until the account is deleted.
• A computer-linking code: 10 minutes.
• Usage statistics and technical logs: about 30 days, then deleted automatically.

Your rights

You can ask us to show you the data we hold about you, correct it, delete it, limit how we use it, give it to you in a portable form, or stop using it where we rely on legitimate interest. Write to [email protected] from the email on your account; we answer within a month. Some of it you can do yourself: unlink computers and disconnect Skydex in your account, turn off statistics in the app, delete the account in its settings.

If you think we handle your data unlawfully, you can complain to the Ukrainian Parliament Commissioner for Human Rights or, if you live in the EU, to the data protection authority of your country.

Children

XenPips is not meant for children under 13, and you need to be 16 (or the age your country sets for consent to online services) to create an account on your own. Below that age a parent or guardian has to agree. If we learn that we hold a young child's account without that consent, we delete it.

Security

Computer keys and sign-in tokens are stored as hashes on our side and in the system keychain on yours. Connections use HTTPS. No system is perfectly safe; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Changes

When this policy changes, we update the date at the top and, for changes that matter, tell signed-in users on the site or in the app before they take effect.