This policy explains what data xocat.host collects, why it's collected, who it goes to, and how long it's kept. Xocat.host is a small, private service run by one operator, and Discord is how you sign in to it.

The short version: your data is not sold and is not shared with advertisers. It is handled by the infrastructure providers needed to run the service, it passes through Discord if you sign in with Discord, and it is disclosed to authorities where the law requires it. Section 4 names exactly who receives what.

All of it is collected for one of four reasons: keeping accounts secure, preventing and investigating abuse, moderating content, and complying with the law.

None of it is collected for advertising, behavioural profiling, or resale. There is no ad network on this service, and nothing here tracks you across other sites. The site may use Cloudflare's own aggregate traffic analytics, which counts page views for the operator without cookies and without building a profile of you. No third party outside the providers named in section 4 receives anything.

Being specific here matters more than sounding reassuring, so here is the full list.

We do not sell your personal data. We do not share it with advertisers, data brokers, or for marketing of any kind. It is disclosed in only three situations:

• Infrastructure providers who operate the service on our behalf. Cloudflare hosts the site, runs the backend functions, stores every uploaded file in R2, stores account records in D1, and handles DNS for custom subdomains. Resend delivers transactional email, so it receives your email address and the contents of messages such as password resets and policy update notices. Both process this data on our behalf and are not permitted to use it for their own purposes.
• Discord, if you sign in with Discord. Signing in sends you to Discord to approve the connection, so Discord learns that a xocat.host account is being linked to your Discord account, and it handles that under its own privacy policy. What travels the other way is described in section 5. We do not send Discord your files, your filenames, your upload links, or your xocat.host password.
• Law enforcement and other authorities, where required by law, in response to valid legal process, or to report or prevent serious harm. Reports of child sexual abuse material to the National Center for Missing & Exploited Children are described in section 5 of the Terms of Use.
• That is the complete list. Nobody else receives your account data or your files.

Discord is how accounts are created and how you sign in. Signing in with a Discord account nobody has linked before creates a new xocat.host account from it. Every account needs a linked Discord account to be usable; an account from before this rule is limited to its account page until it links one. A password can be set from the account page as a backup way in for when Discord is unavailable. One Discord account backs exactly one xocat.host account, which is the point: it is what makes a ban mean something instead of being a speed bump someone steps over with a new account.

The sign-in asks Discord for two scopes, identify and email, and nothing else. From those we receive your Discord user id, your username, your avatar, and the email address on your Discord account, which we accept only when Discord reports it as verified.

What that does not include, stated plainly: we do not receive your Discord password, we do not receive the list of servers you are in, we do not receive your direct messages or any message content, and we cannot read anything in any server through this. We cannot post, send messages, join servers, or take any other action as you. The connection is read-only and it reads exactly the four things named above.

This is a different thing from the Discord moderation integration described in the table in section 2 and in section 8. That one records messages flagged by rules in servers the operator moderates, it involves a bot the operator runs, and it is unrelated to signing in here. Neither one feeds the other.

When Discord does not report your email address as verified, no address is taken from Discord at all and the account is created with a placeholder address that receives nothing, which you can replace on the account page.

Files are stored exactly as you upload them. Nothing is stripped or rewritten on the way in.

That means any metadata your device or software embedded in a file, including EXIF data such as GPS coordinates on a photo, is stored as part of the file and is visible to anyone who has the file's link. If that matters to you, remove it yourself before uploading.

Files are stored in Cloudflare R2. Account records, upload records, and access logs are stored in Cloudflare D1. Custom subdomains are routed through Cloudflare DNS. Cloudflare acts as the infrastructure provider and processes data on behalf of xocat.host under its own data processing terms.

• IP and user agent event logs for registration, sign-in, and upload are kept for about 90 days, then deleted automatically.
• The IP address associated with a specific uploaded file is kept for as long as that file exists, so that an abuse report about a file can still be traced. It goes when the file goes.
• Files are retained until you delete them. Nothing expires on a timer and nothing is deleted automatically.
• The details of a linked Discord account are kept for as long as the xocat.host account they are linked to exists, and go when that account is closed.
• Flagged Discord messages held by the moderation integration are kept 30 days, then deleted.
• You may delete individual files at any time from the dashboard, which removes them from storage. There is no self-service account deletion, closing an account is a request to the operator, described in section 12.
• Deleted files are not recoverable once removed.
• The exception to all of the above: content and records that the law requires us to preserve are retained for as long as that obligation lasts, even if you ask for deletion and even if you ask for your account to be closed.

You should know this rather than assume otherwise: the site operator can open and view files uploaded by any account, in order to handle abuse reports and moderate content.

Every one of those accesses is written to an internal audit log, recording who accessed what, which account the file belonged to, and when. The operator cannot read another account's file without leaving that record. That log is what makes this commitment mean anything, rather than being a promise you have to take on trust.

Content removed for violating the Terms of Use may be quarantined rather than deleted. Quarantined content stops being publicly accessible, but the file may be retained where the law requires it to be preserved.

Passwords are stored hashed with a per-account salt rather than in plain text, using PBKDF2-SHA256 at 100,000 iterations. Accounts dormant since that scheme was introduced still hold an older, weaker hash until their next sign-in, which upgrades them. Session tokens are stored only as hashes, so a copy of the database does not hand over working sessions. The service applies rate limiting on authentication endpoints. No system is perfectly secure, if you believe you've found a vulnerability, report it to the contact below rather than exploiting it.

Uploaded files are accessible to anyone who has the generated link. The link is unguessable, but it is the only thing protecting the file: there is no password, no expiry, no view limit, and no way to restrict a file to particular people. Anyone the link reaches can open it, and can keep opening it. Treat an upload link as public.

Account details such as your email address are visible only to you and the operator, they are not shown publicly.

Email support@xocat.online from the address on your account and you can ask for any of the following:

• A copy of the account data held about you, including your upload records and the access log entries associated with your account.
• Correction of your email address, handle, or display name. Most of this you can change yourself in account settings.
• Deletion of specific files, which you can also do yourself from the dashboard, or closure of your account and deletion of its data. Account closure is carried out by the operator on request.
• The standing exception: where content or records are subject to a legal preservation obligation, they cannot be deleted on request. If that applies to your request, you will be told that it does.

Xocat.host is a private service and is not directed at children. Accounts are not knowingly created for or by anyone under the age of 13, and any account discovered to belong to a child under that age will be removed.

This policy may be updated as the service changes. For questions about your data, or to request account or file deletion, contact support@xocat.online.