Privacy Policy

Updated August 19, 2026

XOXO is operated by Supertape, LLC, doing business as XOXO Email (“we”, “us”, and “our”). The short version: our marketing analytics are cookieless, we don’t sell data or share it for ads, and XOXO is built around consent-based email.

Scope

This policy covers the personal data we collect from XOXO account holders (the people who create and send newsletters), from people who join our waitlist, and from visitors to our website. Account holders are “you” throughout this policy.

If you’re a newsletter subscriber rather than an account holder, see For subscribers below.

This policy describes how XOXO processes subscriber data for you. You’re responsible for your own use, which is governed by your privacy policy. Link it in your sending settings so we can show it in your emails and forms. Subscriber questions should go to you. Our commitments are in the Data processing section of our Terms of Service.

Data we collect

  • Waitlist data. If you join the waitlist, we collect your email address so we can confirm your request and let you know when you can use XOXO.
  • Account data. When you create an account, we collect your name and email address, account and team settings, connected apps, sending settings, and the physical mailing address you set for sending (anti-spam laws require one in every email).
  • Newsletter and form data. We store the emails, hosted forms, images, uploads, custom fields, tags, groups, imports, and settings you create or upload in XOXO.
  • Payment data. Payments are processed by Stripe on their site, so your card details never touch our servers. Stripe’s privacy policy applies to payment data.
  • Referral data. If you create your account after following a referral link, we record which account referred yours so we can credit it, along with the credits and reversals that follow. Referring accounts see how many referrals they have and what they’ve earned, never who signed up.
  • Technical data. We collect basic technical information when you use XOXO, such as your IP address, browser type, logs, device and request data, and usage patterns. We use this to keep the service running, secure it, and understand how people use it.
  • Site analytics. Our public marketing pages use cookieless analytics to count visits: pages viewed, referrer, and rough location derived from your IP address. We don’t use this to identify you.
  • Product analytics. Inside the XOXO app, we use cookieless product analytics tied to your user and account so we can understand usage, debug product flows, and improve the service. We don’t use session replay, advertising pixels, or ad targeting.
  • Support and error data. If you contact support or hit an error, we may receive your account context, messages, logs, browser details, and the information needed to troubleshoot.
  • Subscriber data. We process subscriber email addresses, custom fields, tags, groups, source data, import data, and delivery or engagement data on your behalf. You’re responsible for what you collect from subscribers and how you use it.

How we use data

We use the data we collect to:

  • Operate and improve the XOXO service
  • Deliver newsletters and track engagement on your behalf
  • Manage the waitlist and account access
  • Email you about your account and about XOXO itself
  • Respond to support requests
  • Review sends and prevent spam, fraud, abuse, and deliverability problems
  • Comply with legal obligations

Most emails we send are about your account: billing, subscriber limits, and price changes. We may also send tips or product news. Those emails include an unsubscribe link, and opting out doesn’t affect necessary account messages.

Email tracking

For newsletters sent through XOXO, we record delivery and engagement signals: delivery, bounce, complaint, unsubscribe, open, click, and like timestamps, plus aggregate counts and rates. Opens are detected with a tracking pixel and clicks by routing links through a redirect.

Our email delivery provider sends us technical details such as IP address and user agent with engagement events. We use those details to filter out bots and automated privacy prefetches, then store the event timestamp rather than the IP address or device details. Subscribers can prevent open tracking by disabling image loading in their email client.

Data sharing

We share data only with the service providers we need to operate XOXO:

  • Postmark: email delivery
  • Stripe: payments
  • Render: application hosting
  • PlanetScale: database hosting
  • Cloudflare: website, image, and file hosting, including temporary storage of subscriber imports and exports, and the gateway used for AI requests
  • Sentry: error reporting
  • OpenPanel: analytics
  • Plain: customer support
  • Google: sign-in, if you use it, and automated abuse review
  • Apple: sign-in, if you use it

Send review is the only place we send your data to an AI provider, and it goes through Cloudflare’s AI gateway. If a send trips our abuse checks, the email content, subject, links, account and list risk signals, top recipient domains, and derived list-shape signals may be reviewed by an AI service before the email goes out. That review never includes full subscriber email addresses.

If the send needs human review, a XOXO admin may review the email and a sample of recipient addresses to decide whether it can be sent.

We don’t allow the AI providers we use to train their models on your content or data.

We share only what each provider needs. We’ll keep this list current and notify you by email or in the app at least 15 days before a new provider starts handling subscriber data.

We’re based in the United States, and our providers may process data in the United States and other countries. If you use XOXO from elsewhere, your data will be transferred to the United States. Where required, we use contractual or other recognized safeguards for international transfers. If you’re in the EEA, UK, or Switzerland, transfers of subscriber data are covered by the transfer terms in our Terms of Service.

We may also disclose information if required by law or to protect the safety or rights of our users or the public. If we’re involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, data may be transferred as part of that transaction, subject to this policy and applicable law.

We don’t sell your data or your subscribers’ data, and we don’t share it for cross-context behavioral advertising.

Cookies and storage

We use a small number of first-party cookies and similar browser storage, almost all essential for running the app: keeping you signed in, remembering which account you last used, and avoiding duplicate sign-in analytics within a browser tab. The one exception is the referral cookie. Following a referral link sets a first-party cookie naming the referring account for up to 30 days, so we can credit that account if you sign up. It does nothing else, is never shared, and is removed when you create an account. We don’t use advertising or targeting cookies, and our analytics are cookieless.

You can manage or block cookies through your browser settings, but without our essential cookies you won’t be able to sign in.

Privacy rights

You can access, update, or delete your data through your account settings or by asking us. In the EEA or UK, you may also restrict processing, receive a portable copy, or object to certain uses. You can withdraw consent at any time without affecting earlier processing. Our legal bases are our contract with you, our legitimate interests in securing, operating, and improving XOXO and communicating with you, your consent where requested, and our legal obligations.

You also have the right to lodge a complaint with your local supervisory authority, though we’d appreciate the chance to sort things out first.

US state privacy laws may give you additional rights too: to know what personal information we’ve collected about you and request a copy, to correct or delete it, to opt out of sale or sharing for targeted advertising (we don’t do either), and to not be discriminated against for exercising any of these rights. We honor these requests for everyone, whether or not a particular law applies to you.

To submit a request, email help@xoxo.email. We’ll respond within the timeframe required by law.

If we decline a request, we’ll explain why, and you can appeal by replying to our response. We’ll take a fresh look at it. If you’re still unsatisfied, you can raise it with your state attorney general or local data protection authority.

Some browsers send opt-out signals like Global Privacy Control or Do Not Track. We don’t sell or share data for targeted advertising, so that opt-out is already everyone’s default.

Retention

We keep your data while your account is active. If you’re on the waitlist, we keep your email until you’re approved, you ask us to remove it, or we no longer need the waitlist.

When you close your account, we delete its data, including your subscriber list and sent emails, from our primary application database immediately. We then promptly delete associated images, import and export files, and provider-side account resources where provider APIs allow.

When you import subscribers from a file, we delete the source file after processing or when you dismiss the import. Export files and any import files left behind after an interrupted process are automatically removed once they’re about a week old. Export links only work while you’re signed in.

Some records can persist outside live XOXO tables: database backups until they cycle out, Postmark delivery records for its retention window, Stripe billing records, records of referral credits and reversals (they document money that moved), support conversations, error logs, analytics records that require provider support to remove, and anything we need to keep for legal, security, abuse-prevention, or tax reasons. For accounts closed for terms violations, we may keep limited records for up to 30 days to investigate and prevent repeat abuse.

One deliberate exception: when a subscriber unsubscribes, bounces, complains, or is removed with suppression enabled, we keep a one-way cryptographic hash of their email address so they can’t be accidentally re-added to your list. The hash can’t reasonably be turned back into an email address, and it’s deleted along with your account.

Security

We take reasonable technical and organizational measures appropriate to the risk, including access controls, encrypted network transport, encryption for stored secrets, data minimization, logging and monitoring, backups, and incident-response procedures. We review and update these measures as the service changes. No system is perfectly secure, and we can’t guarantee your information will never be accessed without authorization. If we become aware of a breach affecting your data, we’ll investigate promptly, let you know without undue delay, and notify regulators where the law requires it.

Children

XOXO doesn’t knowingly collect personal information from children under 13, and you must be at least 18 to have an account. Don’t use XOXO for newsletters or forms directed to children under 13, or knowingly collect personal information from children under 13, unless we approve a legally compliant arrangement in writing before you collect anything. We may suspend or terminate accounts that don’t follow this rule.

For subscribers

If you subscribed to a newsletter sent through XOXO, the sender of that newsletter is responsible for your data. We process it on their behalf to deliver their emails. We store delivery and engagement timestamps, but not your IP address, location, or device details. See Email tracking.

If you unsubscribe, bounce, complain, or ask the sender to suppress you, we keep only a one-way hash of your email address so the sender can’t accidentally re-add you. For anything else about your data, including access or deletion requests, contact the sender directly. Their privacy policy governs your relationship with them.

Changes to this policy

We may update this policy from time to time. When we do, we’ll update the date at the top, and we’ll communicate material changes by email or in the app.

Contact us

For questions about this policy or to make a privacy request, contact:

Supertape, LLC, doing business as XOXO Email
350 E 400 S #54406, SALT LAKE CITY, UT 84111
help@xoxo.email