01 The short version
The sections that follow give the full detail: what stays on your device, the limited data sent to servers to make features work, the logs and analytics involved in running a website, how advertising works, and the rights you have.
02 Who and what this policy covers
This Privacy Policy applies to the XCODX website at xcodx.io and the XCODX editor, compiler, emulator, and related developer tools (the “Service”), operated by the XCODX team (“we”, “us”). For privacy questions, the controller responsible for your data can be reached at [email protected]. It does not cover third-party websites, packages, or advertisers, which have their own policies.
03 Data that stays on your device
XCODX is a local-first application. Your projects, files, code, editor settings, themes, and file history are saved directly in your browser using technologies such as IndexedDB and local storage. This data:
- Stays on your device and is not transmitted to or stored by us in the ordinary course of editing;
- Is controlled by you — you can view, export, or delete it, including by clearing your browser’s site data;
- Can be lost if you clear browser data, use private/incognito mode, or switch devices, because it is not backed up to us. Please export important work.
Because we do not receive this data, we cannot recover it for you.
04 Data processed to run specific features
Some features only work by sending data to a server. We keep this to the minimum needed to perform the feature you asked for:
- Running code in non-web languages. When you run languages such as Python, Java, C/C++, Go, or Rust, the relevant source code and any input you provide are sent to our code-execution service so the program can run, and the output (including errors) is returned to you. This is processed to deliver the result you requested.
- Live preview and audits. To render a live preview or run an in-browser audit, your compiled project files may be sent to our preview service to be displayed back to you.
- Loading packages and libraries. When your code imports an npm package or library, your browser requests it from third-party content-delivery networks and package registries. Those providers receive the request (including your IP address and the resource requested) as part of delivering the file.
We use this data only to operate the feature. We do not use your code or files for advertising, and we do not sell them or use them to train machine-learning models.
05 Server and security logs
Like virtually every website, our hosting and security provider (Cloudflare) automatically processes standard technical information when your browser connects to us — for example your IP address, browser and device type (user-agent), the pages or files requested, referring page, and timestamps. This is used to deliver the site, keep it secure, prevent abuse and fraud, and diagnose problems. It is a normal and necessary part of operating an internet service.
06 Analytics
We use Cloudflare Web Analytics to understand, in aggregate, how the site is used and how it performs (for example, page views, referrers, approximate country-level location, device and browser type, and Core Web Vitals performance metrics).
07 Advertising and advertising partners
XCODX is free and is funded by advertising served through independent, third-party advertising networks. To display and measure ads, those partners — and their own sub-partners — may collect and process data about your device and activity, such as your IP address, device and browser information, cookies or similar identifiers, pages viewed on our site, and interactions with ads. Depending on your settings and consent, they may use this to show personalized (interest-based) ads and to limit repetition and measure performance.
Important points:
- This data is collected by the advertising partners under their own privacy policies, not ours. We do not control how they use it.
- Where required by law (for example, for visitors in the European Economic Area, the United Kingdom, and Switzerland), we ask for your consent before non-essential advertising cookies or identifiers are set, through a consent tool. You can change or withdraw your choice at any time.
- You can usually opt out of personalized advertising through industry tools such as Your Online Choices (EU), the DAA opt-out, and NAI opt-out, and through your device or browser ad-settings. If Google advertising is used, you can manage it at Google Ads Settings.
See our Cookie Policy for the categories of cookies involved.
09 If you contact us
If you email us (for example at [email protected]), we receive your email address and whatever you include in your message. We use it only to read and respond to your enquiry and to keep a record of the correspondence.
10 Legal bases (for EEA/UK users)
Where the EU or UK General Data Protection Regulation applies, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Delivering the Service, running features you request, keeping it secure and preventing abuse | Legitimate interests / performance of a contract |
| Server logs and cookieless, aggregate analytics | Legitimate interests in operating and improving a secure website |
| Advertising cookies and personalized ads (where consent is legally required) | Consent |
| Responding to your enquiries | Legitimate interests / taking steps at your request |
| Complying with legal obligations | Legal obligation |
Where we rely on consent, you can withdraw it at any time without affecting processing that already took place.
12 International data transfers
We and our providers operate globally (Cloudflare, for example, uses a worldwide edge network), so data may be processed in countries other than your own. Where personal data is transferred internationally, appropriate safeguards — such as the European Commission’s Standard Contractual Clauses — are relied upon by the relevant providers where required.
13 Data retention
We keep personal data only as long as needed for the purpose it was collected. Data on your device stays until you remove it. Server and security logs and aggregate analytics are retained for a limited period consistent with security and operational needs. Data processed to run a feature (such as code sent for execution or preview) is processed transiently to return your result and is not retained by us as a persistent copy of your projects. Advertising partners retain data under their own policies. Correspondence is kept as long as needed to handle your enquiry and for our records.
14 Security
We serve the site over HTTPS/TLS, apply security headers, and rely on a local-first design that keeps most of your data on your own device rather than on our servers. Our hosting provider adds network-level protections. No method of transmission or storage is 100% secure, however, and we cannot guarantee absolute security.
15 Your privacy rights
Depending on where you live (for example under the GDPR or the California Consumer Privacy Act), you may have rights to access, correct, delete, port, restrict, or object to the processing of your personal data, to withdraw consent, and to opt out of the “sale” or “sharing” of personal data for targeted advertising. You also have the right not to be discriminated against for exercising these rights.
- For data stored on your device, you can exercise most of these rights yourself by managing or clearing your browser’s site data and adjusting cookie/consent settings.
- For advertising data, use the opt-out tools in section 7 and the settings of the relevant advertising partner.
- To make a request to us, or to ask a question about your rights, contact [email protected]. EEA/UK users also have the right to complain to their local data-protection authority.
16 Children’s privacy
The Service is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will take appropriate steps to address it.
17 Changes to this policy
We may update this Privacy Policy from time to time. We will revise the “Last updated” date above and post the new version here; material changes may be highlighted on the site. Please review it periodically.
18 Contact us
For any privacy question or request, email [email protected].