Updated 26 October 2026
Xcard provides account, messaging, gift card exchange and related transaction services. This policy explains how information is used when you use these services.
We process the username, contact details, country and password you provide; passwords are stored as hashes. We also process profile images, messages, files you choose to upload, support requests, transaction records and bank or payout details you submit. Optional birthday information is used for birthday features. Server request logs and session information are used to operate and secure the service.
Information is used to create and authenticate accounts, deliver messages, provide customer support, process transactions and payouts, manage referrals and account benefits, and investigate fraud or service errors. Sharing information in a conversation makes it available to the recipients and relevant support staff.
Android gallery uploads use the system Photo Picker, or the system document picker on older devices. The app receives access to the item you select, without requesting broad photo, video or storage access. Camera and microphone permissions are requested when you choose camera, voice or video-call features. You may decline optional permissions; the corresponding feature will remain unavailable. Selected media may be copied to the app cache before upload.
Hosting and file storage providers process data needed to operate the service. Video calls use Tencent TRTC when configured, including participant identifiers and audio/video during calls. If message notifications are enabled, a device token or browser push subscription is processed to deliver them. Service providers may process information in countries where their infrastructure operates.
You can delete your account in Settings > Delete account by confirming your password. Deletion closes the account, removes identifying profile and saved bank details, disables its invite code, and removes registered push devices and browser subscriptions. Existing sessions lose account access. Messages, uploaded files, transaction and payout records, and security or accounting records may remain where needed to preserve other participants' records, complete outstanding obligations or meet applicable requirements. Backups may retain prior copies until their normal rotation. Deleting the app alone does not delete your account.
You can choose which media to share, manage device permissions and notifications, update your avatar, and request account deletion in Settings. For other access, correction or deletion requests, use the in-app Support conversation. Additional rights depend on your location.
A new policy version may require you to review the updated notice again before continuing.
Operator: ____________________ Privacy contact email: ____________________ Retention schedule: ____________________