Privacy Policy

Updated October 9, 2026

XOXO is operated by Supertape, LLC, doing business as XOXO Email (“we”, “us”, and “our”). In short, we don’t sell data or share it for ads, our marketing analytics don’t use cookies, and XOXO is built around consent-based email.

Scope

This policy covers the personal data we collect from XOXO account holders (the people who create and send newsletters), from people who join our waitlist, and from visitors to our website. Account holders are “you” throughout this policy. If you’re a newsletter subscriber instead, see For subscribers.

It also describes how XOXO processes subscriber data for you. How you use that data is up to you, and your own privacy policy governs it. Link it in Settings and we’ll show it in your emails and forms.

Subscriber questions about their data should go to you. Our commitments as your processor are in our Data Processing Agreement.

Data we collect

Waitlist data. If you join the waitlist, we collect your email address so we can confirm your request and let you know when you can start using XOXO.
Account data. When you create an account, we collect your name and email address, account and team settings, connections, sending settings, and the physical mailing address you set for sending (anti-spam laws require one in every email).
Newsletter and form data. We store the emails, hosted forms, images, uploads, custom fields, tags, groups, imports, and settings you create or upload in XOXO.
Payment data. Stripe processes payments on its own site, so your card details never touch our servers. Stripe’s privacy policy applies to payment data.
Referral data. If you create your account after following a referral link, we record which account referred you so we can credit it, along with any credits and reversals that follow. Referring accounts see how many referrals they have and the credits they’ve earned, never who signed up.
Technical data. When you use XOXO, we collect basic technical information like your IP address, browser type, logs, device and request data, and usage patterns. We use it to keep the service running and secure, and to understand how people use it.
Site analytics. Our public marketing pages use cookieless analytics to count visits. They record the page viewed, the referrer, and a rough location derived from your IP address, and we don’t use them to identify you.
Product analytics. Inside the app, we use cookieless product analytics tied to your user and account, so we can understand usage, debug product flows, and improve XOXO. We don’t use session replay, advertising pixels, or ad targeting.
Support and error data. If you contact support or hit an error, we may receive your account context, messages, logs, browser details, and whatever else we need to troubleshoot.
Subscriber data. We process subscriber email addresses, custom fields, tags, groups, source data, import data, and delivery and engagement data for you, including what you bring in from files and platforms you connect. You’re responsible for what you collect and how you use it.
Form submission data. When someone submits one of your subscription forms, we record their IP address, the country and network it comes from, browser details, and the page the form was on, so we can spot and block abuse. We also hold their email address and any custom field answers, encrypted, until they confirm. Retention covers how long each of these stays.

How we use data

We use the data we collect to:

Run and improve XOXO
Deliver newsletters and track engagement on your behalf
Manage the waitlist and account access
Email you about your account and about XOXO itself
Respond to support requests
Review sends, enforce our Acceptable Use Policy, and prevent spam, fraud, abuse, and deliverability problems
Comply with legal obligations

Most of our emails to you are about your account, like billing, subscriber limits, and price changes. We may also send tips or product news. Those include an unsubscribe link, and opting out won’t stop the account emails you need.

Email tracking

For newsletters sent through XOXO, we record delivery and engagement signals: delivery, bounce, complaint, and unsubscribe timestamps, plus aggregate counts and rates.

Open and click tracking is separate, and it only happens while the sender has it turned on. It’s on for new accounts, and the sender can turn it off in their settings.

Every link in a newsletter sent through XOXO goes through XOXO’s own link domain, whether or not tracking is on, so we can turn off the links of an account that breaks our rules. When tracking is on, we use a tracking pixel for opens and record a click as the link is followed. We store only each event’s timestamp. We don’t store the reader’s IP address, device, or browser, and we don’t filter out automatic opens, so the counts are estimates. When tracking is off, nothing is recorded. Subscribers can block open tracking by turning off image loading in their email app.

We share data only with the service providers we need to run XOXO. Each is listed with where it processes data:

Mailgun (United States): email delivery and address verification for creators’ emails
Stripe (United States and other countries): payments, and the card fingerprint we check against paused and banned accounts (see below)
Render (United States): application hosting
PlanetScale (United States): database hosting
Cloudflare (its global network): website, image, and file hosting, including temporary storage of subscriber imports and exports, the bot check on subscription forms, the gateway for AI requests, and delivery of our own emails to you, like sign-in codes
Sentry (United States): error reporting
OpenPanel (Germany): analytics
Google (United States and other countries): sign-in, if you use it, the AI model that reviews sends and suggests subject lines and preview text, and checking links in your emails against its Web Risk lists
Apple (United States and other countries): sign-in, if you use it

Each provider gets only what it needs. We’ll keep this list current, and let you know by email or in the app at least 15 days before a new provider starts handling subscriber data, unless we have to replace one urgently, as our Data Processing Agreement describes.

We use Cloudflare Turnstile to protect sign-in and subscription forms from bots. Cloudflare’s Turnstile Privacy Addendum covers it.

AI

We send your data to an AI provider in two places, and every request goes through Cloudflare’s AI gateway.

Send review. Before an email goes out to your subscribers, Google’s AI model reviews its content, subject, and links, along with your account’s name, top recipient domains, and signals about the list’s shape. We don’t send it your subscribers’ email addresses.
Suggestions. When you ask XOXO to suggest a subject line or preview text, we send Google’s AI model the draft’s text, its subject, and the line being replaced. This happens only when you ask.

Our agreements with the AI providers we use don’t let them train their models on your content or data.

If a send needs a closer look, a person on our team may review the email, its links, and the signals about the list to decide whether it can go out.

If you connect an AI app like ChatGPT or Claude as an agent, it can read and change what’s in your account for you, including your subscribers’ email addresses, custom fields, and tags.

What it reads goes to that app’s provider, whose own terms and privacy policy apply. You chose that provider, so our agreements on training don’t reach it. You can remove an agent at any time in your account settings.

Abuse prevention

When an email is reviewed, we also check its links against Google Web Risk, which watches for phishing, malware, and other abuse. Google receives only the links, not the rest of the email or who it’s going to.

To keep accounts we’ve paused or banned from coming back under a new one, we compare a keyed hash of the addresses you import, and the card fingerprint Stripe gives us (never your card details), against our record of paused and banned accounts.

When you import subscribers, we also check that each address’s domain can receive mail before adding it to your list.

An address that has hard-bounced for any XOXO sender can’t be added to your list, and if it’s already there, it’s skipped and removed when you send. If you send from XOXO’s shared address, a reader who reported another sender’s email from that address as spam is skipped too, since mailbox providers treat everyone on the shared address as one sender. Both checks compare hashed addresses, so no sender sees another sender’s list.

Transfers and other disclosures

We’re based in the United States, and our providers may process data in the US and other countries. If you use XOXO from elsewhere, your data will be transferred to the US, and where required, we use contractual or other recognized safeguards.

If you or your subscribers are in the EEA, the UK, or Switzerland, the transfer terms in our Data Processing Agreement cover subscriber data.

We may also disclose information if the law requires it, or to protect the safety or rights of our users or the public. If we’re involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, data may be transferred as part of it, subject to this policy and the law.

We don’t sell your data or your subscribers’ data, and we don’t share it for cross-context behavioral advertising.

Cookies and storage

We use a small number of first-party cookies and similar browser storage. Almost all of it keeps the app working, like keeping you signed in, remembering which account you last used, and avoiding duplicate sign-in analytics within a browser tab.

The one exception is the referral cookie. Following a referral link sets a first-party cookie naming the referring account for up to 30 days, so we can credit that account if you sign up. It does nothing else, is never shared, and is removed when you create an account.

We don’t use advertising or targeting cookies, and our analytics are cookieless. You can block cookies in your browser settings, but without our essential ones you won’t be able to sign in.

Privacy rights

You can access, update, or delete your data in your account settings, or by asking us. If you’re in the EEA or UK, you can also restrict processing, get a portable copy of your data, or object to certain uses. You can withdraw consent at any time, without affecting processing that already happened.

Our legal bases for processing are our contract with you, our legitimate interests in securing, running, and improving XOXO and communicating with you, your consent where we ask for it, and our legal obligations.

US state privacy laws may give you more rights, including the right to know what personal information we’ve collected about you and get a copy, to correct or delete it, and to opt out of its sale or sharing for targeted advertising (we don’t do either). You won’t be treated differently for using any of them.

To make a request, email help@xoxo.email, and we’ll respond within the time the law requires. We may need to confirm who you are first, and where the law allows it, someone you authorize can make a request for you.

If we decline a request, we’ll explain why, and you can appeal by replying. We’ll take a fresh look. If you’re still unsatisfied, you can raise it with your state attorney general or local data protection authority, though we’d appreciate the chance to sort things out first.

Some browsers send opt-out signals like Global Privacy Control or Do Not Track. We don’t sell or share data for targeted advertising, so that opt-out is already everyone’s default.

Retention

We keep your data while your account is active. If you’re on the waitlist, we keep your email address until you’re approved, you ask us to remove it, or we no longer need the waitlist.

When you close your account, we delete its data, including your subscriber list and sent emails, from our application database. We then delete its images, import and export files, and provider-side resources where providers allow it.

We keep only the names from your account’s and forms’ web addresses, with nothing that ties them to you, so a link you shared never leads to someone else.

We keep the IP address, country, network, browser details, and page recorded with a form submission for a short time after its confirmation email goes out, so we can prevent abuse.

We hold the submitted email address and any custom field answers, encrypted, only until the person confirms or the confirmation link expires. After that, we keep only a hashed, unreadable form of the address for the same short period.

If we’ve paused a form to stop abuse, the signups it’s holding stay until we send them or delete them, which can take longer.

When you import subscribers from a file, we delete the file after processing or when you dismiss the import. Export files, and any import files an interrupted import leaves behind, are removed automatically after a short time. Export links only work while you’re signed in.

Some records can outlast your account:

Database backups, until they expire
Our email delivery providers’ records, for their retention windows
Stripe billing records
Records of referral credits and reversals, since they document money that moved
Support conversations and error logs
Analytics records that need provider support to remove
Anything we need to keep for legal, security, abuse prevention, or tax reasons

For accounts closed for terms violations, we may keep limited records while we investigate, and to prevent repeat abuse.

We deliberately keep one thing after a subscriber leaves.

When a subscriber unsubscribes, bounces, complains, reports a confirmation they didn’t ask for, or is removed with suppression turned on, we keep a one-way cryptographic hash of their email address, so they can’t be added back to your list by accident. The hash can’t reasonably be turned back into an address, and it’s deleted along with your account. Hard bounces and spam reports on XOXO’s shared address are the exception: they protect every sender, so their hash stays after your account closes.

The delivery and engagement timestamps for emails already sent to a subscriber stay with those emails after the subscriber is removed, tied to the same kind of hash rather than their address, so your send stats stay accurate.

Security

We protect data with reasonable technical and organizational measures appropriate to the risk. They include access controls, encrypted network connections, encryption for stored secrets, data minimization, logging and monitoring, backups, and incident response procedures, and we update them as XOXO changes.

No system is perfectly secure, so we can’t guarantee your information will never be accessed without permission. If we become aware of a breach affecting your data, we’ll investigate promptly, let you know without undue delay, and notify regulators where the law requires it.

Children

XOXO doesn’t knowingly collect personal information from children under 13, and you need to be at least 18 to have an account. Our Terms of Service cover the rules for newsletters and forms directed to children.

For subscribers

If you subscribed to a newsletter sent through XOXO, the sender is responsible for your data, and we process it for them to deliver their emails. For the emails themselves, we store delivery and engagement timestamps, not your IP address, location, or device details. Email tracking has more.

When you sign up through one of their forms, we record your IP address, the country and network it comes from, your browser details, and the page the form was on. We use this to prevent abuse, and delete it shortly after your confirmation email goes out. The form also runs Cloudflare Turnstile, a bot check that works in the background.

If we’ve paused a form to stop abuse, your signup waits until we send it or delete it.

If you unsubscribe, bounce, complain, or report a confirmation you didn’t ask for, we keep a one-way hash of your email address, so the sender can’t add you back by accident. If your address hard-bounces, or our email provider tells us not to mail it, no sender on XOXO can email it again. If you report a newsletter sent from XOXO’s shared address as spam, the other newsletters sent from that address stop too. The delivery and engagement timestamps for emails you already got stay with the sender’s stats, tied to that hash rather than your address.

For anything else about your data, including access or deletion requests, contact the sender directly. Their privacy policy governs your relationship with them. For the records we keep ourselves to prevent abuse, like the signup details and hashes above, write to help@xoxo.email. If you got an email through XOXO that you never signed up for, let us know.

Changes to this policy

We may update this policy from time to time. When we do, we’ll change the date at the top, and we’ll tell you about material changes by email or in the app.

Who we are

XOXO is run by Supertape, LLC, doing business as XOXO Email. Send privacy requests and questions about this policy to help@xoxo.email, or by mail to:

Supertape, LLC
350 E 400 S #54406
Salt Lake City, UT 84111