Privacy Policy

Last updated: 2026-07-16

xvn.app is XVN Web Services' own showcase site — a public "deploy manifest" listing our live products and a live activity feed of deploy events. It is not a multi-tenant service with public account registration: the only login on this site is a single administrator account used by XVN Web Services staff to manage the manifest. This policy is correspondingly lightweight and focused on what the public pages and API actually do.

Data controller / contact: XVN Web Services — [email protected] (also reachable at [email protected]).

1. What the public API returns

The manifest grid and activity feed on the homepage are populated from two read-only, public endpoints:

• /api/projects.php — returns each live project's name, domain, description, status, and deploy date. This is marketing/portfolio metadata about our own products, not personal data.
• /api/events.php — returns a short log of deploy-related events (a message, an event type, a timestamp, and the associated project name/domain). These entries describe what we deployed and when — they do not log or expose visitor information; no IP addresses, identifiers, or personal data about site visitors are recorded in this feed.

Both endpoints are called by the page's own script with credentials: "omit", so no cookies are sent to or read from these API calls, and visiting the page does not create any account or session for you.

2. The admin login

A single administrator login exists so XVN Web Services staff can add, edit, and remove manifest entries and post notes to the activity feed. This is not a public registration system, and no visitor or customer accounts are created or stored by this site. The admin session uses a standard session cookie plus a CSRF cookie/token pair to protect the admin panel from cross-site request forgery; these cookies are only ever set for the administrator, never for public visitors browsing the homepage.

3. Cookies & third-party resources

The public pages of xvn.app do not set any analytics, advertising, or tracking cookies. Two third-party resources are loaded to render the page:

• Google Fonts (fonts.googleapis.com / fonts.gstatic.com) — used to load the site's typefaces. Loading a font from Google's servers discloses your IP address and browser user-agent to Google as part of that request, under Google's privacy policy.
• Cloudflare — used as a content-delivery network and security layer in front of this site. Cloudflare may process connection metadata (such as your IP address) to route and protect traffic; see Cloudflare's privacy policy.

4. Server logs

Like most web servers, our hosting infrastructure keeps standard access/error logs (IP address, requested URL, timestamp, user agent) for security and troubleshooting purposes. These are retained only as long as needed for that purpose and are not used to build visitor profiles.

5. Your GDPR rights

To the extent any incidental personal data about you exists in the data described above (for example, in server logs), you have the right under the GDPR to request access, correction, or erasure of that data, and to object to its processing. To exercise these rights, email [email protected]. You also have the right to lodge a complaint with your local data protection supervisory authority.

6. Changes to this policy

We may update this policy from time to time; material changes will be reflected by updating the "Last updated" date above.

7. Contact

Questions about this policy: [email protected].