1. Introduction
XPadite is a productivity platform that combines a task manager, activity tracking and time logging, a planner and journal, a productivity calendar with analytics, a mind-mapping canvas and related tools to help you plan your time and measure your progress.
XPadite is operated by Chirag Parikh, an individual based in British Columbia, Canada (“XPadite”, “we”, “us” or “our”). You can contact us at support@xpadite.com.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the choices you have. It applies to the XPadite website at xpadite.com (the “Website”) and to the XPadite application (the “App”), together the “Service”. By using the Service you acknowledge the practices described here. Our Terms & Conditions also apply to your use of the Service.
2. Information We Collect
We collect the following categories of information, depending on how you use the Service.
Information you provide
- Account information: your email address, display name and account identifiers, and the details needed to authenticate you (for example a password, which is handled by our authentication provider rather than stored by us in readable form).
- Your content: tasks and subtasks, notes, journal entries, plans, mind maps, calendar entries and other content you create in the App.
- Activity and time records: activities you define in the Activity Manager and the sessions and time you log against them.
- Uploaded files: images, files and attachments you upload where the feature is supported, including a profile photo and gallery images.
- Support, feedback and reviews: messages, attachments and feedback you send us, and any review you choose to publish (which may include your name, profession, rating, text and photo).
- Waitlist sign-ups: your email address if you join a waitlist (for example for the planned Premium plan) on the Website.
Information generated by your use of the Service
- Productivity analytics: streaks, productive-day markers, totals and trends calculated from the content and time records above, and your session history.
- Subscription and transaction information: your plan, trial and subscription status, and references to transactions made through our payment provider. We do not receive or store your full payment card number (see section 5).
- Preferences: settings such as theme, notification and reminder preferences.
Technical information
- Basic technical and diagnostic information that is collected when you use the Service, such as your browser and device type, approximate location derived from your IP address, pages viewed, and error or security logs. We only describe technical data that our systems actually collect; see section 9 for cookies and analytics.
- When you send a support request, we may also receive limited device and browser details included with it to help us troubleshoot.
3. How Information Is Used
We use personal information to:
- create, authenticate and manage your account;
- provide the productivity features you use, and save and synchronise your content across your devices;
- calculate productivity analytics, streaks and summaries for you;
- manage free trials, subscriptions and purchases, and keep related records;
- send transactional messages you ask for or need, such as reminders you set, exports you request, account and security notices, and replies to support requests;
- protect the Service, detect and prevent abuse or fraud, and troubleshoot problems;
- understand how the Website and App are used so that we can improve their reliability and quality;
- send waitlist or product updates to people who asked to receive them (you can unsubscribe at any time); and
- comply with legal obligations and enforce our terms.
AI-powered functionality. AI features, such as the planned AI Coach, are not currently part of the Pro plans. If and when AI features are made available, content you choose to submit to them (and limited related context needed to respond) will be sent to a third-party AI provider to generate a response. We will identify those features and providers at that time and update this policy first.
We do not sell your personal information.
4. Service Providers
We use trusted third-party service providers to operate the Service. They process personal information on our behalf, or in the case of payments, for their own stated purposes, and have their own privacy practices.
- Supabase — authentication and the database and file storage that hold your account and App content.
- Vercel — hosting for the Website and App, and privacy-focused aggregate usage analytics for the Website if you opt in (see section 9).
- PostHog — optional product and website analytics, only if you opt in (see section 9). PostHog is configured to use its United States cloud infrastructure.
- Resend — delivery of transactional emails, such as reminders, requested exports and support-related messages.
- Loops — management of the email list for people who join a waitlist on the Website.
- Stripe — our payment processor for subscriptions and one-time purchases. Online checkout is not yet open, so Stripe is not yet processing live payments through XPadite; this policy will be updated when it does.
We do not currently use any other third-party advertising or data-broker services. If we add providers that receive personal information, we will update this list. We may also disclose information where required by law, to protect rights, safety and security, or as part of a sale or transfer of the service (in which case you will be notified as required).
5. Payment Information
When online checkout opens, payments will be processed by Stripe. Card and other payment details are entered into Stripe’s secure payment pages and are handled by Stripe; XPadite does not store your full payment card number or card security code. Stripe also handles the tax and billing-address details collected at checkout.
We keep records needed to run your subscription or licence and to meet our accounting and legal obligations: your plan, amounts, currency (Canadian dollars), dates, subscription and payment status, any guaranteed early-adopter price and its expiry, and Stripe’s customer, subscription, invoice and transaction references. If a payment is refunded or disputed, we also record that outcome. Stripe and other payment providers maintain their own privacy practices, which apply to the information they collect; please review Stripe’s privacy policy.
Until online checkout is available, no payments are processed through the Service.
6. Data Storage and Security
We use reasonable technical and organisational safeguards to protect personal information, including encrypted connections (HTTPS) between your device and the Service, authenticated access to your account, and access controls in our database designed so that each user can only reach their own content. Access to production systems and credentials is restricted to what is necessary to operate the Service.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential and for using a strong, unique password. If you believe your account has been compromised, contact us right away. If a breach affects your personal information in a way that creates a real risk of significant harm, we will notify you and any regulator as required by law.
7. Data Retention and Account Deletion
We keep personal information for as long as your account is active and as needed to provide the Service, resolve disputes, enforce our agreements and meet legal, tax and accounting obligations. We do not keep it longer than is reasonably necessary for those purposes.
Deleting your account. You can delete your account yourself in the App: open your profile and choose Delete Account. You can also ask us to do it by emailing support@xpadite.com. Deleting an account is permanent. It ends your access to the subscriptions and one-time licences associated with the account, and active recurring billing is cancelled first; if that cancellation cannot be confirmed, the account is not deleted so that you are not charged further. Deletion removes the account and the records linked to it from our database (such as your profile, calendar and activity data, time sessions, preferences, gallery entries, reminders and journal organisation data), and removes your profile photo from file storage.
What self-service deletion does not remove. Self-service deletion does not currently remove every stored file or record. Images you uploaded to the gallery, attachments sent with support requests, and the support requests themselves can remain until we remove them. To have these removed, email support@xpadite.com from the address on your account and we will delete them.
Billing records. Payment, invoice, tax, accounting, fraud-prevention and dispute records may be kept after deletion where we are legally required or permitted to keep them, including records held by Stripe under its own obligations. We do not promise that every billing record is erased immediately, and we do not state a fixed retention period beyond what the law or our accounting obligations require.
Some information may also remain for a limited time in backups and logs kept by our service providers until they are overwritten in the ordinary course. Content you published publicly, such as a review, can be removed on request.
8. Privacy Rights
Subject to applicable law, including British Columbia’s Personal Information Protection Act (PIPA) and, where it applies, Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), you may have the right to:
- ask for access to the personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- withdraw your consent to our collection, use or disclosure, where consent is the legal basis (this may limit the features we can provide);
- ask us to delete your personal information where permitted; and
- make a complaint to us, and if you are not satisfied, to the Office of the Information and Privacy Commissioner for British Columbia or the Office of the Privacy Commissioner of Canada.
If you live outside Canada, local law (for example in the European Economic Area or the United Kingdom) may give you additional rights, and we will honour those that apply to us. To exercise your rights, contact support@xpadite.com. We may need to verify your identity first, and we will respond within the time required by applicable privacy law.
10. International Data Processing
Our service providers may store and process information on servers in countries other than the one where you live, including outside Canada (for example in the United States). We do not guarantee that your information stays in Canada. When information is processed in another country it may be accessible to that country’s courts and authorities under its laws. We choose providers that describe appropriate safeguards, and we use contracts and provider settings where available to protect personal information.
11. Children’s Privacy
The Service is intended for people who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us at support@xpadite.com and we will take reasonable steps to delete it.
12. Policy Updates
We may update this Privacy Policy from time to time to reflect changes to the Service, our providers or the law. The “Last Updated” date at the top shows when it last changed. If we make a material change, such as using personal information for a new purpose or adding a provider that receives it, we will give you reasonable advance notice (for example by email or an in-App notice) and, where the law requires, ask for your consent. Continuing to use the Service after the effective date means you accept the updated policy, but this does not override any right you have under applicable law.
13. Contact and Privacy Requests
For questions about this policy or to make an access, correction, deletion or other privacy request, contact Chirag Parikh, who is responsible for privacy at XPadite:
- Email: support@xpadite.com
- Operator: Chirag Parikh, British Columbia, Canada