Privacy Policy

Last updated: 2026-06-09.

This policy covers how xhost (the platform at xhostd.com) handles data on behalf of channels that opt in to platform-managed Google sign-in. Each channel is operated by its own user; see that channel's own privacy notice for what they do with the data once it reaches their app.

What we collect from end-users

When you sign in to a channel that uses xhost's Google sign-in, Google sends us three pieces of identity information:

• Your email address.
• Your display name.
• Your Google subject identifier (sub) — a stable opaque ID scoped to xhost's OAuth client.

We collect this only at the moment you sign in. We do not request access to Drive, Gmail, Calendar, contacts, or any other Google service.

What we do with it

We pass the three fields to the channel's application inside a signed identity cookie (a JWT) set on the channel's hostname after sign-in. We do not store these values in a user-account database, and we do not share them with third parties. We do not sell, rent, or use them for advertising.

Channel operators may store this data in their own databases. Their handling of it is governed by their own policies.

Cookies

After successful sign-in, the gateway sets a signed identity cookie named __Host-xhost_id on the channel's exact hostname. The cookie:

• Is host-only (the __Host- prefix forces Secure, Path=/, and no Domain) — it is never sent to another channel.
• Is marked HttpOnly and Secure.
• Is an RS256-signed JWT (signed with xhost's private key) carrying the three identity fields plus iss, aud (the hostname), iat, and exp.

Clearing your browser cookies for the channel hostname signs you out of that channel.

Logs

The OAuth gateway records the channel hostname and Google subject identifier on each successful sign-in for operational debugging. Logs are retained per the operator's system log policy and pruned on a best-effort basis. We do not log IP addresses, user agents, or request bodies at the gateway.

Traffic analytics

We log per-channel hit counts and one-way hashed IP fingerprints (SHA-256 with a per-channel salt, never reversed) to estimate unique visitors. Hashed fingerprints are retained for 7 days and never leave xhost servers. We use the MaxMind GeoLite2 Country database for country lookup (attribution: "This product includes GeoLite2 data created by MaxMind, available from https://www.maxmind.com").

Deleting your data

To have your gateway logs and any platform-side traces removed, email support@xhostd.com with the email address you signed in with. We will clear the relevant rows and invalidate active sessions. To remove data the channel's application stored about you, contact the channel operator directly.

Contact

Questions or requests: support@xhostd.com.