Your presence is yours.

1. Who controls your information

XYH is operated by Corzohub, LLC. Corzohub, LLC is responsible for the personal information described in this policy when it determines why and how that information is processed.

Creators, businesses, and other XYH users may independently receive information from visitors through their public pages or contact features. Those users are responsible for how they use information they receive outside XYH and may have their own legal obligations.

2. Information we collect

Account and identity information

We may collect your name, email address, account identifier, sign-in method, account preferences, verification status, and Hustle Handle. If you use Google sign-in, Appwrite and Google may provide authentication information such as your name, email address, provider-specific user identifier, and authentication metadata. If you use Email OTP or Magic Link, Appwrite processes your email address, a short-lived token, related security metadata, and a security phrase used to help you verify the legitimacy of the sign-in message.

Profile and content information

We process information you choose to publish or save through XYH, including profile text, links, social destinations, images, media, contact information, styles, templates, custom domains or handles, and other creator-selected content.

Visitor and contact information

When visitors interact with a Hustle Page, we may process page views, link interactions, Hustle Code scans, approximate technical information, and information a visitor deliberately submits through a contact form. When a visitor scans a Hustle Code, XYH may process the permanent public QR identifier and associate a first-party `qr_visit` event with the owning published page. The QR identifier identifies the code-to-page mapping, not the visitor. Contact-form submissions may include a name, email address, message, or other information the visitor chooses to provide.

Safety and takedown requests

If you submit a Safety & Takedown request involving nonconsensual intimate imagery or a digital forgery, we collect the requester's name and email, whether the requester is the person depicted or an authorized representative, the name of the person depicted, URLs sufficient to locate the material, the requester's good-faith explanation, depiction classification, electronic signature, request timestamp, and related correspondence needed to evaluate and document the request. The form instructs requesters not to upload or email the intimate image or video itself unless XYH specifically requests additional information.

Billing information

Paid subscriptions are processed by Stripe. XYH receives billing status, plan, subscription identifiers, transaction state, and related account metadata needed to operate the subscription. XYH does not intentionally store complete payment-card numbers or card security codes.

Technical, usage, and optional analytics information

We may process IP-derived or hashed identifiers, browser and device information, timestamps, referral information, security events, application logs, diagnostic information, page interactions, and analytics events. If you choose Allow analytics, XYH may initialize Google Analytics 4 and PostHog to measure product usage, traffic sources, broad device/browser patterns, reliability, and feature adoption. If you choose Essential only, XYH does not initialize those optional browser analytics integrations. Creator-facing service analytics such as page views, link interactions, and validated Hustle Code scan events may operate separately from optional GA4/PostHog browser analytics so creators can receive core Insights about their published page.

Communications

If you contact us, request support, submit a safety request, report infringement, or communicate about your account, we may retain the message, contact details, attachments you deliberately provide, and related support or review history.

3. Google sign-in and passwordless email data

Google sign-in is used only to authenticate you, create or locate your XYH account, maintain a secure session, prevent abuse, and provision the XYH workspace associated with your account.

XYH does not request access to unrelated Google services such as Gmail, Google Drive, Google Calendar, device contacts, or private files as part of social sign-in. We do not use Google authentication data for advertising, data brokerage, credit decisions, or AI-model training.

Email OTP and Magic Link authentication are passwordless options. Appwrite sends a short-lived code or secure link to the email address you provide. The resulting token is exchanged only to create the authenticated XYH session. XYH does not use those one-time credentials for marketing or unrelated purposes.

We do not sell Google authentication or passwordless-email data. We disclose authentication data only as needed to operate, secure, support, or comply with law for the service described in this policy.

4. How we use information

• Provide, authenticate, secure, maintain, and improve XYH.
• Create and operate accounts, Hustle Pages, profiles, handles, drafts, publishing, templates, and creator tools.
• Process subscriptions, enforce plan entitlements, prevent payment abuse, and maintain billing records.
• Deliver transactional email, verification, password recovery, one-time sign-in codes, Magic Links, service notices, and support.
• Receive, evaluate, document, communicate about, and act on Safety & Takedown requests, infringement claims, abuse reports, and other rights or safety requests.
• Provide creator-facing analytics and, with consent where required, understand product performance and acquisition using optional browser analytics.
• Detect spam, fraud, security incidents, harmful activity, abuse, and violations of our policies.
• Protect users, XYH, Corzohub, LLC, and third-party rights.
• Comply with legal obligations and respond to valid legal process.

5. Legal bases where required

Where a law such as the GDPR requires a legal basis, we process information as necessary to perform our contract with you, pursue legitimate interests such as security and product operation, comply with legal obligations, and obtain consent where consent is required. Optional Google Analytics and PostHog browser analytics are controlled by the XYH analytics consent choice. You may withdraw consent for consent-based processing, subject to lawful limits.

6. Service providers and disclosures

We may disclose information to vendors that process data for XYH under their own agreements and security obligations. Current core providers include Appwrite for authentication and application data, Stripe for payments and subscriptions, Resend for transactional and operational email, Google Analytics 4 and PostHog for optional product analytics when enabled by the user's analytics choice, and hosting/infrastructure providers used to deliver xyh.app.

If you choose Google sign-in, information also flows between Appwrite and Google to complete authentication. If you choose Email OTP or Magic Link, Appwrite processes the email address and short-lived authentication token required to complete that passwordless login. If you choose Allow analytics, browser analytics data may be processed by Google Analytics and PostHog under their respective service terms and privacy practices.

We may disclose information when reasonably necessary to comply with law, enforce agreements, investigate fraud or abuse, protect safety or rights, or complete a merger, financing, acquisition, reorganization, or sale of assets subject to appropriate protections.

7. Public information

Hustle Pages are designed to be public. Information you publish may be viewed, copied, indexed, linked, screenshotted, or shared by others. Do not publish information you do not want public. Removing information from XYH cannot guarantee removal of copies previously made or cached by third parties.

If public XYH content contains an intimate depiction of you that was shared without your consent, or an intimate digital forgery depicting you, use the Safety & Takedown process.

8. Cookies, local storage, and analytics

XYH uses storage that is necessary for authentication, security, preferences, and core functionality. Optional Google Analytics and PostHog product analytics are controlled separately and only initialize after Allow analytics is selected. First-party creator-facing service analytics, including validated Hustle Code scan attribution, are separate from those optional browser analytics. XYH's GA4 measurement ID is G-1L2DXQYJEY. See the Cookie & Analytics Policy for details and available choices.

9. Data retention

We retain account and service data for as long as reasonably necessary to provide XYH, maintain your account, comply with law, resolve disputes, enforce agreements, prevent fraud, and preserve legitimate business records. Retention periods vary by data type and purpose.

Short-lived authentication codes, Magic Link tokens, and related session tokens expire according to the authentication service's security rules and are not intended as long-term credentials.

Safety, takedown, abuse, and rights-reporting records may be retained as reasonably necessary to document the request and our response, prevent repeated harm, comply with legal obligations, establish or defend legal claims, and maintain appropriate safety records. We minimize the information requested and instruct people not to send copies of intimate media unless specifically needed.

Deleted or changed information may remain temporarily in backups, security logs, fraud-prevention records, or legally required records. Billing and tax-related records may be retained for legally required periods. Optional analytics providers may retain analytics information according to their configured settings and applicable provider terms. We minimize retention where information is no longer needed.

10. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information, including access controls, secure authentication, transport encryption where supported, environment-separated secrets, short-lived passwordless credentials, and monitoring. No internet service or storage system can guarantee absolute security.

If you believe your account or information is at risk, contact us promptly and change or revoke affected credentials where appropriate.

11. Your privacy choices and rights

Depending on where you live and which law applies, you may have rights to access, correct, delete, obtain a copy of, restrict, object to, or withdraw consent for certain processing of your personal information. You may also have rights to appeal a denied request.

XYH's current business model does not sell personal information or share personal information for cross-context behavioral advertising. The GA4 integration disables Google Signals and ad-personalization signals in the XYH site configuration. If these practices change, this policy and any legally required opt-out controls will be updated before the change applies.

To make a privacy request, contact info@corzohub.com. We may need to verify your identity before fulfilling a request and may retain limited information required to document the request.

12. International users

XYH is operated from the United States and may process information in the United States or other locations where service providers operate. Where required, we use legally recognized mechanisms or other safeguards for cross-border transfers.

13. Children

XYH is not directed to children under 13, and we do not knowingly collect personal information from children under 13. Users between 13 and the age of legal majority where they live should use XYH only with any consent required from a parent or legal guardian. If you believe a child under 13 provided personal information, contact us so we can investigate and take appropriate action.

14. Changes to this policy

We may update this Privacy Policy as XYH evolves or laws change. Material changes will be communicated by reasonable means, such as an updated effective date, an in-product notice, or an email when appropriate. Continued use after an effective change is subject to applicable law and the updated policy.

15. Contact

Privacy questions and requests: info@corzohub.com.

Operator: Corzohub, LLC, Florida, United States.