Privacy Policy
This Privacy Policy (the "Policy") explains how x6o4 (an individual developer, "we" or "us") collects, uses, stores and shares your personal information when you use x6o4 RSS Cloud (the "Service"), and the rights you have under applicable law. Please read it carefully before using the Service; using the Service means you have read and accepted this Policy. Together with the Terms of Service, it forms the entire agreement between you and us.
This Policy describes what the currently released version actually does with data. If a future version changes data handling, we will update this page first and notify you as described in Section 13.
1. Data Controller
The data controller for the Service is:
- Operator: x6o4 (individual developer; no incorporated legal entity)
- Website: https://rss-cloud.x6o4.com
- Privacy contact: veesong.szu@gmail.com (privacy matters and data rights requests are all handled via this inbox)
- Data Protection Officer (DPO): not appointed (not applicable for an individually operated service)
2. Information We Collect
Account information: email address, password (stored as an argon2id hash; we never keep the plaintext), and nickname (optional). If you bind WeChat sign-in, we also store your WeChat openid (obtained server-side by exchanging the WeChat authorization code, used for passwordless login and account linking).
Service content data: the feeds you add (URL, title), categories, favorites (stars), read / unread state, per-feed reading settings (fetch full article, hotlink referer URL) and e-reader configuration. These are required to provide the cloud sync service.
Payment transaction records: transaction ID, pass purchased, amount, payment status and time, account attribution. We never store full card numbers or payment credentials — card data is processed by our payment processor Waffo Pancake under PCI-DSS (see Section 5).
Communications: inquiries, feedback or rights requests you send us by email.
Automatically collected: IP address, User-Agent, request time, error and performance logs, rate-limit counters, and security audit logs of admin console operations — for operating, protecting and preventing abuse of the Service.
We do not collect: location, contacts, photos or device fingerprints; we use no third-party analytics or ad-tracking SDKs; we send no marketing cookies.
3. How We Use Personal Information
| Purpose | Legal basis |
|---|---|
| Providing and maintaining the Service (sync, reading, e-reader, API) | Contract performance |
| Account management and security (sign-in, sessions, password reset) | Contract performance |
| Billing and payment confirmation | Contract performance |
| Customer support and rights requests | Contract performance / legitimate interests |
| Service notices (email verification, password reset, payment receipts — necessary transactions) | Contract performance / legitimate interests |
| Security and abuse prevention (rate limiting, auditing, fraud prevention) | Legitimate interests |
| Legal compliance | Legal obligation |
We do not use your personal information for personalized advertising and we make no automated decisions. We may aggregate or de-identify data for statistics; such data cannot identify an individual.
4. Cookies and Tracking
| Type | Purpose | Can be disabled |
|---|---|---|
| Strictly necessary | Web and e-reader sign-in session (cookie gw_web_session, HttpOnly, 30-day sliding expiry by default) | No |
There are no other cookies: the Service uses no functional, analytics or marketing cookies and integrates no third-party analytics or ad trackers. The interface language is negotiated from your browser's Accept-Language header, not stored in a cookie. You can clear cookies or sign out at any time to invalidate the session; this only affects sign-in state, not the Service itself.
5. Sharing and Disclosure
We do not sell your personal information, including "sale" as defined by applicable law (such as the CCPA). We share your information only in these cases:
- Payment processing: Waffo Pancake — our PCI-DSS compliant payment processor, which handles payment card data exclusively; card data is never stored on our servers. To complete payments, refunds and reconciliation we provide them the necessary transaction information;
- Infrastructure and communication providers: cloud hosting (Aliyun, mainland China), DNS / CDN (Cloudflare), and the email sending provider — each processes only the data necessary for the service and is bound by confidentiality and data-processing terms;
- Legal and regulatory requirements: pursuant to law, court orders or lawful requests from competent authorities;
- Business transfers: if a merger, acquisition or asset transfer involving the Service ever occurs, we will notify you in advance and ensure continuity of the protections in this Policy;
- With your consent: for other purposes, after obtaining your explicit prior consent.
One more thing to know: once you add a feed, the Service accesses that feed's server with an automated program to fetch content — their server sees our server's IP and request records. This is technically required for an RSS reading service and does not involve your personal identity.
6. Data Security
- Encryption in transit: HTTPS / TLS site-wide;
- Encryption at rest: passwords stored as argon2id hashes; Miniflux service credentials stored AES-256-GCM encrypted; database access is credential-protected;
- Access control: the Service is operated by one person on a least-privilege basis, with no team-shared credentials;
- Auditing and rate limiting: admin console writes require CSRF tokens and are written to a security audit log; sign-in, registration and data APIs are rate-limited.
If a data security incident affects your rights, we will notify you and the competent authority within 72 hours of discovery, as required by law. Please keep your account credentials safe and do not share them.
7. Retention Periods
| Data type | Retention | After expiry |
|---|---|---|
| Account and service content data | Lifetime of the account | Deleted or anonymized within 30 days after account deletion (unless the law requires retention) |
| Payment transaction records | 5 years from the transaction | Deleted or anonymized (needed for reconciliation and disputes) |
| Server and security audit logs | 90 days | Securely deleted |
| Communications (email) | 2 years | Securely deleted |
| Web session records | Lifetime of the session (30 days by default) | Expire automatically |
After these periods, or once you exercise your deletion rights, data is deleted or anonymized; copies the law requires us to keep (such as transaction records) remain protected by this Policy during their retention.
8. Your Data Rights
To exercise any of the rights below, email veesong.szu@gmail.com; we will respond within 30 calendar days.
| Right | Meaning |
|---|---|
| To be informed | Know what data we collect and how we use it |
| Access | Obtain a copy of your personal information |
| Rectification | Correct inaccurate or incomplete information |
| Erasure | Request deletion of data under certain conditions |
| Restriction | Pause processing in certain situations |
| Portability | Receive your data in a machine-readable format |
| Objection | Object to processing based on legitimate interests |
| Withdraw consent | Withdraw consent-based processing |
If you believe we have not handled your request properly, you may lodge a complaint with the data protection authority where you live or that has jurisdiction.
9. Marketing Communications
We currently send no marketing or promotional messages. Emails you may receive are limited to necessary service transactions: email verification, password reset, account security notices, and payment receipts sent by our processor Waffo Pancake. If marketing messages are ever introduced, we will obtain your consent beforehand and provide an opt-out; opting out will not affect necessary transactional notices.
10. Cross-Border Transfers
The Service's primary infrastructure (application server, database, Miniflux fetching service) is located in mainland China (Aliyun). Some steps may involve processing abroad: payment processing (Waffo Pancake and its acquiring partners), DNS / CDN (Cloudflare), and the email sending provider. For cross-border transfers we apply these safeguards:
- Only the minimum data necessary for providing the Service is transferred;
- Recipients are bound by confidentiality and data-protection obligations;
- Where applicable law requires, we rely on standard contractual clauses (SCCs) or equivalent protection mechanisms.
11. Children's Privacy
The Service is intended for users aged 16 and above. We do not knowingly collect personal information from anyone under 16. If you believe your child has provided us personal information, contact us immediately at veesong.szu@gmail.com and we will delete it promptly.
12. Third-Party Links and Services
Content shown through the Service (feed articles, images, site icons) comes from the third-party websites you subscribe to, and those sites may contain their own links and services. Installing the app via Google Play and paying via Waffo Pancake are each governed by their own terms and privacy policies. This Policy covers only information we collect directly; we are not responsible for third parties' data practices, and we recommend reviewing their policies before use.
13. Changes to This Policy
We may update this Policy from time to time. For material changes we will notify you at least 15 days in advance via your registered email and update the effective date at the top of this page. Continuing to use the Service after the effective date means you accept the updated Policy. We keep version history so we can always state which version was in effect at any point in time.
14. Contact Us
- Privacy matters and data rights requests: veesong.szu@gmail.com
- Customer support: veesong.szu@gmail.com
- Operator: x6o4 (individual developer)
- Website: https://rss-cloud.x6o4.com
- Response time: target reply within 2 business days (complex rights requests within 30 calendar days)
Adapted from the Waffo Pancake merchant template. For reference only; not legal advice.