Legal
Privacy Policy
Last updated August 4, 2026.
This explains what ExpandiaX collects, why, and how you can control it. We collect as little as we can get away with while still making the app useful.
What we collect
Account details - your email, username, display name, avatar, and bio, whether you sign up with a password or with Google.
Content you add - the countries and events you log, along with any photos, videos, notes, and ratings attached to them.
Basic usage data - anonymous, privacy-friendly analytics (page views, not individual behaviour tracking) and error reports if something crashes, so we can fix it.
Push notification token - if you use the ExpandiaX app on iOS or Android and allow notifications, we store a device token (not tied to your physical device’s identity beyond delivering pushes) so we can notify you about likes, comments, and new followers. You can turn this off any time in your device’s notification settings, which removes the token.
How we use it
To run the app: show your archive back to you, show your public or friends-only content to the people your visibility settings allow, power the feed and follow system, send you push and email notifications you’ve opted into, and keep your account secure. We don’t sell your data, we don’t use your content to train anything, and we never use your push notification token for advertising or to track you across other apps or services.
Who can see your content
Entirely up to you, per profile and per event: private (only you), friends (people who follow you and whom you follow back), or public (anyone with the link, and discoverable on Explore). You can change this at any time.
Where it’s stored
Your data lives in Supabase (managed Postgres, authentication, and file storage). Sign-in with Google is handled by Google’s own OAuth flow - we only receive your email and basic profile info from it, never your Google password. We use Vercel for hosting and privacy-friendly analytics, Sentry for error monitoring, and Firebase Cloud Messaging (Google) solely to deliver push notifications to the iOS and Android app.
Cookies
We use one cookie to keep you signed in and one to remember your light/dark theme preference. That’s it - no tracking or advertising cookies.
Your rights
You can export a complete copy of your data or permanently delete your account, at any time, from your account settings - no need to ask us. Deleting your account removes your profile, your archive, and every photo and video you uploaded from our storage, and can’t be undone.
Retention
We keep your data for as long as your account exists. If you delete your account, your data is removed from our active systems; backups that include it are cycled out shortly after.
Children
ExpandiaX isn’t intended for anyone under 16.
Changes
If we change this policy in a way that matters, we’ll do our best to let you know before it takes effect.
Contact
Questions, or want to exercise a data right directly? Reach out at mark@expandiax.com.