Privacy Policy

Tracking, Profiling & Automated Identification

We believe transparency beats fine print, so here is everything this site does to understand its visitors — including the parts most sites leave out. All of it is first-party: we use no third-party analytics service, advertising network, or social-media tracker, and none of this data leaves our own server.

• First-party page tracking: our own server records each page view with the path, referring page, IP address, browser user agent, and any campaign (UTM) parameters. This powers our traffic dashboards and abuse prevention.
• Company (not person) identification: we look up visitor IP addresses against a locally stored database to identify the organization or networka visit came from (for example, “a visitor from Acme Corp's network”). The lookup happens on our own server, identifies companies rather than individuals, and sends no data to anyone else.
• Repeat-visit linking:we compute a short hash of IP address + browser user agent to connect a day's repeat visits into one anonymous session. This record contains no name or email unless you later identify yourself (for example by signing in), at which point your visits may be linked to your contact record.

AI Agent Processing & Human Oversight

Conversations with XL Roleplay Coach — web chat, SMS, and email — are processed by our AI systems and stored so the agent can answer you and we can review quality.

Every email XL Roleplay Coach sends is copied to a human at XL.net Inc., so an unsupervised AI is never our only record of what was said.

Persona Memory

XL Roleplay Coach keeps a private, per-person memory: facts you share and your conversation history, so later conversations can pick up where you left off. Your memory is visible only to you (and to XL.net Inc. staff reviewing quality) — never to other visitors — and XL Roleplay's own published knowledge always outranks remembered facts when they conflict.

• One memory across channels: if you verify your mobile number on your account, your web chat, SMS, and emailconversations share one memory keyed to that number. Email conversations join it only when the email provably came from you (it must pass DKIM authentication for your address's domain); mail that fails authentication is answered without reading or writing any stored memory.
• Anonymous web chat remembers nothing. Memory applies to web chat only when you are signed in, and signed-in chat has a MEMORY ON/OFF toggle in the chat window — turn it off and that conversation is not saved to memory.
• SMS always remembers. Texting XL Roleplay Coach keeps memory for your phone number (possession of the handset is the authentication); the first reply you receive says so and names the erasure keyword.
• Erasure by text — “FORGET”: text FORGET to +18723448847 and we permanently erase the stored memories, conversation history, and call transcripts for that number — and, if the number is verified on an account, for that account's chat and email memory too. You get a confirmation text once the erasure has completed. FORGET is not STOP: STOP opts you out of receiving messages, FORGET erases what we remember.
• What FORGET does not delete: SMS consent records (kept for legal compliance), usage metadata that contains no conversation content, the deletion-audit record proving the erasure happened, server and diagnostic logs, and the human-oversight copies of emails already sent.
• Recycled numbers: memory is keyed to the phone number itself. If a number is reassigned by a carrier, its new holder could encounter memory from the previous holder — text FORGET from the number to erase it.
• Caller-ID caveat:voice calls recall memory by the calling number, and caller ID can be spoofed — a determined attacker who spoofs your number on a call could expose that number's memories. If this concerns you, text FORGET to erase the memory, or skip verifying your number.

Account Data

If you sign in, we store your email address and display name (provided via Google OAuth or Microsoft OAuth). This information is used only to authenticate you and personalize your experience. We never post on your behalf or access anything else in your provider account.

If you register a mobile number for text messaging, we also store that number, the date you verified it, and your opt-in consent record (see SMS / Text Messaging Data below).

What We Do NOT Do

• We do not sell your data to anyone
• We do not use your data for advertising
• We do not use third-party analytics or tracking cookies
• We do not serve third-party advertisements
• We do not use your data to train AI foundation models. XL Roleplay Coach processes and stores your conversations to answer you, but your data is never sold to, or used to train, third-party models.

Cookies

Essential cookies only. We set a single httpOnly session cookie (roleplay_session, 30 days) when you sign in, plus short-lived cookies during the sign-in handshake. A first-party cookie (roleplay_attrib) remembers the landing page and campaign parameters of your first visit; it is read only by our own server. Your theme preference and interface choices are kept in your browser's localStorage, and the chat widget's conversation state in sessionStorage; none of this is sent to any third party.

Because we set no analytics or advertising cookies, there is no cookie consent banner — there is nothing to consent to. Blocking all cookies in your browser will prevent you from signing in but does not affect the rest of the site.

Third Parties

We share data only with services necessary to operate the site:

• Google OAuth / Microsoft OAuth: authentication only
• Resend: email delivery and receiving for [email protected]
• Twilio: SMS transport (phone numbers and message content, as required to deliver the service)
• Cloudflare: DNS and secure tunnel (no personal data stored)
• Large-language-model providers: when you interact with XL Roleplay Coach, your conversation content is sent to one or more of these providers via their APIs solely to generate the response. We use API terms under which providers do not use this content to train their models.

None of these providers receive your data for their own marketing purposes.

SMS / Text Messaging Data

If you communicate with us via SMS, your mobile phone number and message contents are used solely to respond to your inquiry. Your mobile information will not be sold, rented, or shared with third parties or affiliates for their own marketing purposes. Mobile opt-in data and consent are not shared with any third parties except service providers that help us operate our messaging program, and those providers are restricted from using your information for any other purpose.

If you register your number with us, we record your opt-in consent (the consent language you agreed to, your IP address, and browser) and verify the number with a one-time code before it is added to your account. Message frequency varies based on your interactions with us. Message and data rates may apply. Text STOP to opt out at any time.

For full details on our text messaging program, see our SMS Terms & Conditions.

Data Retention & Deletion

• Account data: as long as your account exists
• Sign-in logs: up to 365 days
• Page-view records: up to 730 days
• IP-to-organization records: up to 365 days
• Email oversight copies: up to 730 days
• Unverified phone-verification codes: 10 minutes
• SMS consent records: for the life of the messaging program plus four years, as required for compliance

Upon a deletion request, all associated personal data is permanently removed within 30 days, except records we are legally required to keep (such as SMS consent logs).

Changes to This Policy

We may update this Privacy Policy from time to time. Changes are effective when posted to this page, and the “Last updated” date above reflects the most recent revision. Your continued use of the site after changes are posted constitutes acceptance of the updated policy.

Contact

To object to any of this processing, request deletion of your account and associated data, or ask privacy questions, contact [email protected].