Privacy Policy

Effective date: January 1, 2026 | Last updated: April 1, 2026

Xoul ("we," "our," or "us") operates the xoulapp.com website and the Xoul mobile application (collectively, the "Service"). We are committed to protecting the privacy of parents, children, and all users of the Service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information, with particular attention to our obligations under the Children's Online Privacy Protection Act (COPPA) and the California Consumer Privacy Act (CCPA).

If you have questions about this policy, contact us at [email protected].

1. Our Core Privacy Commitment

Xoul's service is built on a single technical constraint: we do not access, transmit, store, or process the content of any messages sent or received by any child. We analyze behavioral metadata only — patterns such as communication frequency, timing, and social graph structure. No message text ever enters our systems.

This is not a policy we aspire to uphold. It is an architectural constraint. Our systems are technically incapable of receiving message content.

2. Information We Collect

From Parents

  • Name and email address (account registration)
  • Payment information (processed by third-party payment processor, not stored by Xoul)
  • Device identifiers and usage data (app analytics)
  • Communications you send to us (support requests)

From the Linked Child Accounts

  • Behavioral metadata: communication frequency, timing patterns, and social graph structure
  • Platform-level indicators available through authorized API access
  • No message content, no contact names, no message recipients

From Website Visitors

  • Standard web analytics (page views, browser type, referring URL)
  • Cookies (see our Cookie Policy)

3. COPPA Compliance

Xoul's service involves processing data related to children under 13. We comply fully with COPPA requirements. Specifically:

  • The parent or legal guardian creates and controls the Xoul account, not the child.
  • We collect only the minimum data necessary to provide the Service.
  • We do not sell any data related to children.
  • Parents may request deletion of their child's data at any time by contacting [email protected].
  • We do not use child behavioral data for advertising purposes.
  • Child data is retained for 12 months from account closure, then securely deleted.

4. CCPA Rights for California Residents

If you are a California resident, you have the following rights under the CCPA:

  • The right to know what personal information we have collected about you
  • The right to delete your personal information
  • The right to opt out of the sale of personal information (we do not sell personal information)
  • The right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us at [email protected]. We will respond within 45 days.

5. How We Use Information

We use the information we collect to:

  • Provide, operate, and improve the Xoul Service
  • Generate wellbeing reports and alerts for parent accounts
  • Send service-related communications (account updates, report delivery)
  • Respond to support requests
  • Comply with legal obligations

We do not use your information for advertising. We do not sell your information to third parties. We do not use child behavioral data to train models for any purpose outside of the Xoul Service.

6. Data Retention

Parent account data is retained for the duration of your subscription plus 30 days after cancellation, then deleted. Child behavioral metadata is retained for the duration of the active monitoring period plus 90 days, then deleted. You may request earlier deletion at any time.

7. Data Security

Wellbeing reports are encrypted end-to-end. No Xoul employee can read the content of a wellbeing report. We use industry-standard encryption for data in transit and at rest. We conduct regular security reviews and engage third-party security researchers through our responsible disclosure program.

8. Third-Party Services

We use limited third-party services for payment processing and infrastructure. These services are contractually prohibited from using your data for any purpose other than providing their service to Xoul. We do not use third-party advertising networks or data brokers.

9. Changes to This Policy

We will notify registered users by email of any material changes to this Privacy Policy at least 30 days before they take effect. Continued use of the Service after that date constitutes acceptance of the updated policy.

10. Contact

For privacy-related questions or to exercise your rights under COPPA or CCPA:

Xoul
301 Congress Avenue, Suite 1200, Austin, TX 78701
[email protected]
+1 (512) 555-7253