Privacy Policy

Updated July 22, 2026

XOXO is operated by Supertape, LLC, doing business as XOXO Email (“we”, “us”, and “our”). The short version: our marketing analytics are cookieless, we don’t sell data or share it for ads, and XOXO is built around consent-based email.

Scope

This policy covers the personal data we collect from XOXO account holders — the people who create and send newsletters — from people who join our waitlist, and from visitors to our website. Account holders are “you” throughout this policy.

If you’re a newsletter subscriber rather than an account holder, see For subscribers below.

This policy describes how XOXO processes subscriber data for you. You’re responsible for your own use, which is governed by your privacy policy. Link it in your sending settings so we can show it in your emails and forms. Subscriber questions should go to you. Our commitments are in the Data processing section of our Terms of Service.

Data we collect

  • Waitlist data — If you join the waitlist, we collect your email address so we can confirm your request and let you know when you can use XOXO.
  • Account data — When you create an account, we collect your name and email address, account and team settings, connected apps, sending settings, and the physical mailing address you set for sending (anti-spam laws require one in every email).
  • Newsletter and form data — We store the emails, hosted forms, images, uploads, custom fields, tags, groups, imports, and settings you create or upload in XOXO.
  • Payment data — Payments are processed by Stripe on their site; your card details never touch our servers. Stripe’s privacy policy applies to payment data.
  • Technical data — We collect basic technical information when you use XOXO, such as your IP address, browser type, logs, device and request data, and usage patterns. We use this to keep the service running, secure it, and understand how people use it.
  • Site analytics — Our public marketing pages use cookieless analytics to count visits: pages viewed, referrer, and rough location derived from your IP address. We don’t use this to identify you.
  • Product analytics — Inside the XOXO app, we use cookieless product analytics tied to your user and account so we can understand usage, debug product flows, and improve the service. We don’t use session replay, advertising pixels, or ad targeting.
  • Support and error data — If you contact support or hit an error, we may receive your account context, messages, logs, browser details, and the information needed to troubleshoot.
  • Subscriber data — We process subscriber email addresses, custom fields, tags, groups, source data, import data, and delivery or engagement data on your behalf. You’re responsible for what you collect from subscribers and how you use it.

How we use data

We use the data we collect to:

  • Operate and improve the XOXO service
  • Deliver newsletters and track engagement on your behalf
  • Manage the waitlist and account access
  • Email you about your account and about XOXO itself
  • Respond to support requests
  • Provide AI-assisted writing, editing, style, and review features when you ask us to
  • Review sends and prevent spam, fraud, abuse, and deliverability problems
  • Comply with legal obligations

Most emails we send are about your account — billing, subscriber limits, and plan changes. We may also send tips or product news; those emails include an unsubscribe link, and opting out doesn’t affect necessary account messages.

Email tracking

For newsletters sent through XOXO, we record delivery and engagement signals: delivery, bounce, complaint, unsubscribe, open, click, and like timestamps, plus aggregate counts and rates. Opens are detected with a tracking pixel and clicks by routing links through a redirect.

Our email delivery provider sends us technical details such as IP address and user agent with engagement events. We use those details to filter out bots and automated privacy prefetches, then store the event timestamp rather than the IP address or device details. Subscribers can prevent open tracking by disabling image loading in their email client.

Data sharing

We share data only with the service providers we need to operate XOXO:

  • Postmark — email delivery
  • Stripe — payments
  • Render — application hosting
  • PlanetScale — database hosting
  • Cloudflare — website, image, and file hosting, including temporary storage of subscriber imports and exports, and the gateway used for AI requests
  • Sentry — error reporting
  • OpenPanel — analytics
  • Plain — customer support
  • Iframely — link previews
  • Google — sign-in, if you use it, and AI features or automated abuse review
  • Apple — sign-in, if you use it

When you use an AI feature, the content, images, or URLs it needs go through Cloudflare’s AI gateway to our AI provider. Don’t include personal information you don’t want processed for that request.

If a send trips our abuse checks, the email content, subject, links, account and list risk signals, top recipient domains, and derived list-shape signals may be reviewed by an AI service before the email goes out. We don’t send full subscriber email addresses to the AI service.

If the send needs human review, a XOXO admin may review the email and a sample of recipient addresses to decide whether it can be sent.

We don’t allow the AI providers we use to train their models on your content or data.

We share only what each provider needs. We’ll keep this list current and notify you by email or in the app at least 15 days before a new provider starts handling subscriber data.

We’re based in the United States, and our providers may process data in the United States and other countries. If you use XOXO from elsewhere, your data will be transferred to the United States. Where required, we use contractual or other recognized safeguards for international transfers. If you’re in the EEA, UK, or Switzerland, transfers of subscriber data are covered by the transfer terms in our Terms of Service.

If you connect a third-party service, such as an AI assistant or automation tool, you authorize it to access your account data on your behalf. Its privacy policy applies, and you can disconnect it at any time in your settings.

We may also disclose information if required by law or to protect the safety or rights of our users or the public. If we’re involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, data may be transferred as part of that transaction, subject to this policy and applicable law.

We don’t sell your data or your subscribers’ data, and we don’t share it for cross-context behavioral advertising.

Cookies and storage

We use a small number of first-party cookies and similar browser storage, all essential for running the app: keeping you signed in, remembering which account you last used, and avoiding duplicate sign-in analytics within a browser tab. We don’t use advertising or targeting cookies, and our analytics are cookieless.

You can manage or block cookies through your browser settings, but without our essential cookies you won’t be able to sign in.

Privacy rights

You can access, update, or delete your data through your account settings or by asking us. In the EEA or UK, you may also restrict processing, receive a portable copy, or object to certain uses. You can withdraw consent at any time without affecting earlier processing. Our legal bases are our contract with you, our legitimate interests in securing, operating, and improving XOXO and communicating with you, your consent where requested, and our legal obligations.

You also have the right to lodge a complaint with your local supervisory authority — though we’d appreciate the chance to sort things out first.

US state privacy laws may give you additional rights too: to know what personal information we’ve collected about you and request a copy, to correct or delete it, to opt out of sale or sharing for targeted advertising — we don’t do either — and to not be discriminated against for exercising any of these rights. We honor these requests for everyone, whether or not a particular law applies to you.

To submit a request, email help@xoxo.email. We’ll respond within the timeframe required by law.

If we decline a request, we’ll explain why, and you can appeal by replying to our response — we’ll take a fresh look at it. If you’re still unsatisfied, you can raise it with your state attorney general or local data protection authority.

Some browsers send opt-out signals like Global Privacy Control or Do Not Track. We don’t sell or share data for targeted advertising, so that opt-out is already everyone’s default.

Retention

We keep your data while your account is active. If you’re on the waitlist, we keep your email until you’re approved, you ask us to remove it, or we no longer need the waitlist.

When you close your account, we delete its data — including your subscriber list and sent emails — from our primary application database immediately. We then promptly delete associated images, import and export files, and provider-side account resources where provider APIs allow.

When you import subscribers from a file, we delete the source file after processing or when you dismiss the import. Export files and any import files left behind after an interrupted process are automatically removed once they’re about a week old. Export links only work while you’re signed in.

Some records can persist outside live XOXO tables: database backups until they cycle out, Postmark delivery records for its retention window, Stripe billing records, support conversations, error logs, analytics records that require provider support to remove, and anything we need to keep for legal, security, abuse-prevention, or tax reasons. For accounts closed for terms violations, we may keep limited records for up to 30 days to investigate and prevent repeat abuse.

One deliberate exception: when a subscriber unsubscribes, bounces, complains, or is removed with suppression enabled, we keep a one-way cryptographic hash of their email address so they can’t be accidentally re-added to your list. The hash can’t reasonably be turned back into an email address, and it’s deleted along with your account.

Security

We take reasonable technical and organizational measures appropriate to the risk, including access controls, encrypted network transport, encryption for stored secrets, data minimization, logging and monitoring, backups, and incident-response procedures. We review and update these measures as the service changes. No system is perfectly secure, and we can’t guarantee your information will never be accessed without authorization. If we become aware of a breach affecting your data, we’ll investigate promptly, let you know without undue delay, and notify regulators where the law requires it.

Children

XOXO doesn’t knowingly collect personal information from children under 13, and you must be at least 18 to have an account. Don’t use XOXO for newsletters or forms directed to children under 13, or knowingly collect personal information from children under 13, unless we approve a legally compliant arrangement in writing before you collect anything. We may suspend or terminate accounts that don’t follow this rule.

For subscribers

If you subscribed to a newsletter sent through XOXO, the sender of that newsletter is responsible for your data — we process it on their behalf to deliver their emails. We store delivery and engagement timestamps, but not your IP address, location, or device details. See Email tracking.

If you unsubscribe, bounce, complain, or ask the sender to suppress you, we keep only a one-way hash of your email address so the sender can’t accidentally re-add you. For anything else about your data — including access or deletion requests — contact the sender directly; their privacy policy governs your relationship with them.

Changes to this policy

We may update this policy from time to time. When we do, we’ll update the date at the top, and we’ll communicate material changes by email or in the app.

Contact us

Questions about this policy or a privacy request? Contact:

Supertape, LLC, doing business as XOXO Email
50 W BROADWAY STE 333 PMB 20104, SALT LAKE CITY, UT 84101
help@xoxo.email