Appearance
Privacy policy
Effective 26 October 2026.
This policy explains how Xandria handles information when you visit xandria.me, use our applications or create a hosted account.
Your account
Google sign-in. Google shares your account identifier, email address, email-verification status and basic profile information, such as your name. We store your identifier, email and name to create your account, recognize you when you return and display your account information. We also maintain Xandria account identifiers and the link to your Google identity. We currently do not save Google's picture URL or a copy of your photo, or retain Google access or refresh tokens for later use.
Google handles your Google password. Xandria does not receive it or gain access to your Gmail, Drive, contacts or calendar. See Google's privacy policy for Google's own processing.
Email and password. We store your email, protected password credentials and the information needed for verification and recovery. Sign-in uses necessary cookies, sessions and tokens. Security records may include IP addresses, request times and device/browser information.
We use account information to provide sign-in, send necessary account emails and protect accounts. We do not sell Google user data, use it for advertising or train AI models with it. Signing in does not subscribe you to marketing.
Your library
Xandria's Local workspace keeps your library and reading work on your device. Creating an account or signing in with Google does not upload your local books, notes or annotations. The application does not send usage telemetry.
Sync, hosted storage and Server AI require separate access; new accounts do not receive those features automatically. When you use an enabled hosted feature, the service processes the content and metadata you choose to upload or sync, including books, notes, annotations and reading progress as applicable.
If you configure an AI provider or connect another service, the material sent depends on the provider and action you choose. That provider's privacy terms apply to its processing. Google sign-in itself sends no library content to an AI provider.
Website, sessions and support
The website and hosted services process technical request information needed to deliver pages and downloads, operate the service, diagnose failures and prevent abuse. Sign-in uses necessary cookies and session storage. The website stores your appearance preference in your browser; the applications store account sessions and preferences on your device.
If you email us, we process your email address, message and any information you choose to include so we can respond. Please avoid sending passwords or other information that is unnecessary for your request.
Service providers and international processing
| Provider | Purpose |
|---|---|
| Google sign-in, when you choose it. | |
| Hetzner | Hosting the account and application services in Germany. |
| Cloudflare | Website and download hosting, DNS and delivery/security services. |
| Zoho | Support/privacy mail and delivery of account emails; our mail account uses Zoho's EU region. |
| Backblaze | Storage for enabled hosted features and encrypted recovery backups; the configured storage region is US East. |
The operator can access account and support information when needed to provide the service, handle your requests or investigate security issues. Providers process the information needed for their roles. We may also disclose information when required by law or necessary to establish or defend legal claims.
Some providers use infrastructure outside the European Economic Area, including in the United States. Their linked privacy information explains their processing locations and transfer safeguards. Contact [email protected] for information about the arrangements applicable to your data.
Retention and deletion
We retain account information while your account exists. Session and recovery data remain for their validity and operational lifecycle. Technical and support records are retained as needed to operate and secure the service, resolve the request, meet legal obligations or handle disputes.
To request deletion of your Xandria account and associated hosted data, email [email protected] from your account email address. Requests are handled manually. We may ask for information needed to verify ownership and will explain the outcome, including any information that must be retained. Recovery backups are separate from active account records; residual copies can remain until those backups are replaced or expire.
Removing Xandria's access in your Google account stops future Google authorization; it does not itself delete your Xandria account. Deleting your Xandria account does not delete your Google account, local source books or copies you exported to your own devices.
Legal bases and your rights
Where the GDPR applies, we process information needed to provide your requested account and hosted features under Article 6(1)(b), and necessary security, reliability and support processing under our legitimate interests in operating and protecting the service, Article 6(1)(f). Processing required by law relies on Article 6(1)(c). Where a particular activity requires consent, we ask for it and you can withdraw it without affecting earlier lawful processing.
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. Contact [email protected] to exercise these rights. You can also complain to a competent data-protection supervisory authority, including the authority where you live or work.
Contact
Xandria is operated by Utkarsh Raj, the controller responsible for the information described here. Privacy and account-deletion requests: [email protected]. Product support: [email protected].
This policy covers Xandria's own hosted service. A separately operated Xandria server is covered by its operator's privacy information.
We will update this page when our practices change and revise the effective date. We will provide additional notice and request consent when required before using Google user data for a new purpose.