Privacy Policy

1. Who handles your data

Rex Michael Ayo in the Philippines operates Xeroya at nexora.rexdesigner.com and is responsible for its personal-data processing. Xeroya is part of the Rexdesigner product family. This notice covers the development and testing service, including testers, and does not automatically cover every other Rexdesigner product.

Contact [email protected] for privacy questions or requests, or [email protected] for general assistance. Xeroya is for adults aged 18 and over.

2. Information we process

We record your adult-eligibility confirmation, Terms agreement and Privacy Policy acknowledgment, with the presented wording, document versions and time, to manage eligibility, evidence your agreement and resolve related disputes. The age confirmation is a self-declaration; this step does not collect your birth date or identity document. You may contact us to withdraw consent to processing the age confirmation; if eligibility cannot be established, account access may need to end, subject to lawful retention. Account and profile information includes your email, username, display name, password hash or external sign-in identifiers, profile images, bio, time zone, settings and account-recovery information.

Social and community information includes posts, comments, reactions, follows, memberships, game identities, uploaded media, contest entries and votes. Messaging includes content, attachments, participants, delivery information and relevant reports. Music features may record uploads, likes, playlists and listening history.

Companion and game information includes pet state, game progress, earned Coins, virtual-item activity, planner tasks, reminders, prompts, responses, saved memories and permissions. When you connect an external service, we process information necessary for the permissions and actions you enable.

Technical and support information includes session identifiers, IP addresses and request information in server/security logs, browser or device information available during requests, error records, correspondence and moderation records. We obtain information directly from you, through your interactions, from other users’ reports and from services you connect. Optional profile information need not be supplied to create a basic account.

3. Why we use information

We use information to provide requested account and community features, deliver messages and uploads, operate companions and games, process your settings, provide support, prevent abuse, protect accounts and meet legal obligations.

Where applicable, ordinary personal information is processed because it is necessary for the requested service contract, a legal obligation, or a legitimate interest such as security and abuse prevention, subject to your rights and the applicable legal conditions. Where consent is required, it must relate to the particular purpose and may be withdrawn. Sensitive personal information requires a separately applicable lawful condition; ordinary contract or legitimate-interest language is not a substitute.

Do not include unnecessary health, financial, identity-document or other sensitive information in posts, messages or AI prompts. Acknowledging this notice is not agreement to unrelated marketing or optional AI training.

4. Visibility and access

Public profiles and content can be viewed, copied or shared by others. Community visibility and membership affect who can access community material. Message recipients can retain or forward content. Authorized moderators can view a selected reported message; reports and relevant evidence may be retained for safety or disputes.

The operator and authorized service providers may access information where necessary for operations, support, security or legal duties. Private does not mean inaccessible to the service operator, and Xeroya does not represent messages as end-to-end encrypted. Please consider your audience before sharing.

5. AI conversations, memories and actions

When the AI companion is enabled, Xeroya uses OpenAI to generate responses. Requests can include up to 16 recent chat messages and structured context such as your display name, username, time zone, pet state and permission settings. Depending on controls and the feature, context can also include memories, tasks, events, notifications and community or integration summaries. Results of companion tool actions may be sent in follow-up requests.

Turning off hub-context access does not stop all transmission: basic identity, pet information and certain integration-status or action-history fields may still be included. Memory and planner settings control particular capabilities; they are not a general guarantee that no information reaches an AI provider.

Conversation history and saved memories are stored by Xeroya. Available companion controls let you clear local chat history and remove memories. Clearing those records does not itself delete provider-side records or backup copies. Provider processing also depends on the service terms and account arrangements applicable to the integration. We do not promise zero provider retention. Contact us before sharing information whose retention is important to you.

The current companion preferences enable memory, hub context and planner actions by default, while community and external actions default off. Review those settings. With authorization, tools can create or change planner items and connected calendar events. AI output may be wrong; review consequential actions. Acceptance of the Terms does not grant a general license to train models on your content.

6. Providers and connected services

Cloud infrastructure supports the service and its stored information. Integrations available when configured include OpenAI for companion responses, Mailbux for transactional email, Google, Discord and Apple for sign-in, and GIFSnap for GIF search. Using third-party media can disclose request information to its host. Availability of an integration does not mean every user connects it.

Google sign-in requests basic identity, email and profile information; Discord sign-in requests identity and email; Apple sign-in requests name and email. Google Calendar connection requests calendar-reading and event-management permissions. It can read events and, when authorized, create, update or delete them. Relevant communities may connect RosterScan or TulayBot for community tools and synchronization with external services.

We disclose information as needed for requested features, contracted services, lawful requests, rights protection and a lawful business transfer with applicable safeguards. Providers may have their own responsibilities and privacy notices. Shared ownership of Rexdesigner products does not itself authorize unrestricted sharing of your information between them.

7. Cookies and choices

Xeroya uses a sign-in cookie called community_hub_session, with a 14-day expiry, to maintain your session. Signing out clears that browser session cookie. Browser controls can block or delete cookies, but doing so may prevent sign-in or other functions. Cookie expiry does not necessarily delete server records.

Account and feature settings control available notification preferences, connected accounts and companion permissions. Necessary security and account messages may still be sent. Any optional marketing, advertising or nonessential tracking introduced must have the notices and choices required by applicable law; this notice does not provide blanket consent to those activities.

8. Retention and deletion requests

We retain information for the purposes for which it is needed: operating an active account and its content, managing reports and security, resolving disputes, and complying with legal obligations. Different records can require different periods. Notification cleanup is designed to remove notifications older than 90 days; this is not a retention limit for all other information.

Request account closure, access, correction, export or deletion by emailing [email protected]. We may verify your identity proportionately and explain any lawful exception. Local deletion may not immediately remove backup copies, records needed for a legal obligation or dispute, or copies independently held by recipients. We do not promise a fixed backup-erasure period in this interim notice. Ask us about the records relevant to your request.

We respond within applicable legal deadlines. Information retained after a request must remain limited to its justified purpose. Deleting companion chat and deleting saved memories are separate controls; neither is an account-wide deletion.

9. Security and international processing

Xeroya uses password hashing and session controls. No service can guarantee complete security. Report suspected account compromise or a privacy incident to [email protected]. We assess incidents and provide notifications where the applicable legal thresholds and deadlines require them.

The operator is in the Philippines, while cloud services and external providers may process information in other countries. The relevant locations depend on the service and provider arrangements. Contact us for information about the locations and safeguards relevant to your processing. Transfers remain subject to applicable legal requirements; worldwide availability is not a certification of compliance in every country.

10. Your rights, children and policy updates

Depending on applicable law, you may request information, access, correction, deletion or blocking, portability, restriction or objection, and withdrawal of consent. You may also challenge an applicable automated decision or request human review where required. We explain lawful limitations and applicable review routes. Contact [email protected]; you will not be unlawfully penalized for exercising your rights.

You may complain to the Philippine National Privacy Commission at privacy.gov.ph or another competent regulator without first completing our internal process where the law permits. We do not claim that every regional privacy law applies identically to every user.

We do not offer Xeroya to people under 18. Report a suspected underage account to us. We will assess it and restrict access and handle the information as required by law.

We will update this notice as development, providers and practices change. Material changes receive appropriate notice, and new consent is requested where required before the relevant processing begins. Dated copies help you identify the notice applicable at a particular time.