Your data, plainly.
xapa app (Android, iOS) · Last updated: September 23, 2026
In short
- xapa works without an account: an anonymous identity (a random identifier) is created on your device. If you wish, you can sign in with Google to get your data back on another device.
- Your identity (anonymous or account) is used to remember the cards you liked, saved or skipped, your collections, and to personalise your feed.
- No ads, no third-party analytics, no data sold.
- You can erase everything at any time from Settings → Reset my identity (no account) or Settings → Account → Delete my account.
The app interface is currently in French; menu names are translated on this page.
1. Who is responsible?
The xapa app is published by Mathias Duprat. For any question about your data: contact@xapa-app.fr.
2. What xapa stores
On our servers (hosted by Supabase)
| Data | Details | Why |
|---|---|---|
| Identifier | A random identifier created on first use (anonymous authentication). Without a Google sign-in it is not linked to any information about you. | Attach your data to your device without knowing who you are. |
| Google account (optional) | If you sign in: your email address and Google account identifier, plus the profile information Google sends (name, photo), kept by Supabase. xapa only uses the email address and does not display the rest. | Get your data back on another device or after a reinstall. |
| Votes | The card concerned (like). | Bring back the cards you liked and build the community rankings. |
| Saved cards and collections | The cards you save, the name and content of your collections, with dates. | Find them each time you open the app and on your other devices. |
| Reading events | Card, type of action (viewed, skipped, liked, saved, shared, article opened), display time, category, date and time. | Measure what people enjoy and improve the cards and the selection. |
| Feed preferences | A weight per category, computed on your device and sent with the request for new cards. | Compose your feed. These weights are only used to answer the request. |
Like any server, this one technically receives your IP address when the app contacts it. xapa does not use it to identify you and does not store it in its tables; it may appear in the host's technical logs.
On your device only
- The history of what you have viewed (for your recap and streak) and a copy of your saved cards, to show them faster.
- Your learned tastes (one score per category) and the list of recently seen cards, so they are not shown again.
- Your session token (anonymous or Google), and your notification choice.
This data never leaves your phone. Uninstalling the app deletes it.
3. What xapa does not collect
Without a Google sign-in, xapa knows neither your name nor your email; with one, only what Google sends (see above). In all cases: not your phone number, location, contacts or photos; not the microphone or camera; no advertising identifier. There is no advertising, no third-party tracker and no analytics kit in the app.
4. Why, and on what basis?
- Making the app work (votes, saved cards, collections, personalised feed, card of the day, account and sync): performance of the service you use.
- Measuring what people enjoy and improving content: legitimate interest, on usage statistics that are not used to profile you.
- Notifications: your consent, through the system permission.
5. Notifications
If you turn them on, xapa schedules reminders on your phone: your card of the day, and an evening reminder when your streak is at stake. Their time follows your reading habits. They are local: no server sends you a message and no notification token is collected. Turn them off in Settings or in your system settings.
6. Third-party services
- Supabase hosts the database, authentication (anonymous or Google) and the card images. Servers located in: West EU (Ireland). Supabase's policy.
- Google: if you choose “Continue with Google”, sign-in goes through Google, which then receives your request to sign in to xapa. Google's policy.
- Wikipedia / Wikimedia: when you open a full article, your device loads it directly from fr.wikipedia.org, which then receives your IP address. The link to an image's source leads to Wikimedia Commons. Wikimedia Foundation's policy.
- Google Play / App Store: distribution of the app is governed by their own policies.
- Sharing: the card is turned into an image on your device and handed to the app you choose. xapa sends nothing at that moment.
Your data is neither sold nor rented, and is not used for advertising.
7. Retention
Your data (votes, events, saved cards, collections, and your account's email address if you have one) is kept as long as your identity exists, and deleted as soon as you reset it or delete your account. For an abandoned anonymous identity (app uninstalled without resetting): deleted after 12 months of inactivity.
8. Deleting my data
In the app: Settings → Reset my identity (no account) or Settings → Account → Delete my account (Google account). This:
- deletes your votes, reading events, saved cards and collections on our servers;
- for an account, also deletes the account itself, with your email address;
- erases the history and learned tastes on your device, then creates a new, blank identity at next launch.
This cannot be undone.
Without the app (for example if you uninstalled it): write to contact@xapa-app.fr from your xapa Google account's email address, asking for the account to be deleted; we will do so. An anonymous identity, which carries no information about you, cannot be found by email: resetting in the app is then the way to delete it.
9. Your rights
Under the GDPR you may request access, rectification, erasure, restriction of or objection to the processing of your data. Erasure goes through the reset or account deletion described above. For any question, contact contact@xapa-app.fr. You may also lodge a complaint with your data protection authority (in France, the CNIL).
10. Security
Exchanges with the servers are encrypted (HTTPS). Each user can only read and change their own data (votes, saved cards, collections, events): the database's access rules enforce it, not only the app.
11. Children
xapa is not specifically aimed at children and does not ask for an age. Without a Google sign-in, no data that could identify a person is collected.
12. Changes
This policy may change, for instance if a feature changes. The date at the top of the page shows the last update.