Privacy Policy

Last Updated: 15 September 2026

Contents

Introduction
Information We Collect
Google User Data
How We Use Information
Legal Basis for Processing
How We Share Information
Data Storage and Security
Data Retention
User Controls, Revocation and Data Deletion
Cookies and Similar Technologies
International Data Transfers
GDPR and EEA User Rights
Children’s Privacy
Changes to This Privacy Policy
Contact Us
Google API Services User Data Policy

1. Introduction

This Privacy Policy applies to the xChina website at https://xchina.co/, its language versions (including en.xchina.co, tw.xchina.co, kr.xchina.co and es.xchina.co), and related services we operate in connection with that website, including account registration and Google Sign-In on https://xchina.online/ (together, “xChina”, “we”, “us”, or “our”).

xChina is an adult content website. This policy explains what information we collect, how we use it, how we share it, and the choices you have. It is written for ordinary users, including people who sign in with Google.

If you do not agree with this policy, please do not use xChina or sign in. Questions can be sent to [email protected].

2. Information We Collect

We collect only the information needed to run the website, create and maintain accounts, keep the service secure, process optional payments, and (where ads are shown) display advertising. We do not collect information that the product does not actually use.

2.1 Information you provide directly

Depending on how you use xChina, you may give us:

Account details: email address, password, nickname, and optional avatar or appearance settings if you register with email instead of Google.
Profile and activity: comments, ratings, favorites, browsing history associated with your account, and other content you choose to post, such as amateur photo posts or fiction.
Support and business contact: messages you send through our contact channels, including Telegram usernames or email addresses you choose to provide.
Advertising orders: if you buy advertising, information such as your name or campaign details, URL, media, Telegram handle, email, country, and IP address associated with the order.
Payment details: if you pay with PayPal, PayPal may provide us with payer email, name, PayPal payer ID, transaction amount and currency, and shipping address fields returned by PayPal. If you pay by other methods we support (such as cryptocurrency), we store the order amount, currency, country, IP address, and payment identifiers needed to match the payment. We do not collect full credit-card numbers on xChina pages.

2.2 Information from Google Sign-In

If you choose “Sign in with Google”, Google sends us an ID token after you approve the request. We verify that token and read only the fields described in Section 3. We do not receive your Google password.

2.3 Information collected automatically

When you visit xChina, our servers and infrastructure automatically process:

IP address (including the address supplied by Cloudflare when you connect through our CDN).
Approximate country from the Cloudflare CF-IPCountry header, stored on the user record at registration and used in logs and orders.
Browser and device information derived from your user-agent, including browser name, device type (PC, mobile, tablet, or app), and operating-system family.
Language preference from the site language you are using and, in some logs, your browser language.
Pages requested, timestamps, referrer URL, and click events used for visit counting, security, and abuse prevention.
Cookies and similar technologies, as described in Section 12.

On xchina.co we also load Google Analytics, which independently collects device, browser, and usage data as described in Google’s own documentation. We do not send your Google account ID or Google email to Google Analytics as a user identifier.

Advertising partners (including ExoClick / magsrv.com and other networks we embed) may collect their own technical data through tags or cookies on pages where ads are shown. Account pages, this Privacy Policy, login, and several other utility pages are served without our site ads.

3. Google User Data

xChina uses Google Identity Services (Sign in with Google) so you can create or open an xChina account without a separate password. The Sign-In button does not request extra data-scope values. The default Google Sign-In scopes, and the only Google user data this application uses, are:

Google scope	What it lets us read	Why we need it / how we use it
`openid`	A stable Google account identifier (`sub`) that proves which Google account signed in. It does not give access to Gmail, Drive, Calendar, Contacts, or other Google products.	We store this identifier as your xChina `GoogleId` so we can recognize the same Google account on later visits, avoid creating duplicate accounts, and log you in.
`email` (`https://www.googleapis.com/auth/userinfo.email`)	The email address on the Google account you use to sign in, and whether Google has verified it.	We store the email as your xChina account email. If that email already exists, we link the Google account to it instead of creating a second user. We use the address to send transactional mail (for example, a registration notice) and to identify your account if you contact us. Google-sign-in accounts are marked as email-confirmed because Google has already verified the address.
`profile` (`https://www.googleapis.com/auth/userinfo.profile`)	Basic profile information. In practice we read the display name. Google may also include a profile photo URL in the ID token.	We use the display name, truncated if needed, as your initial xChina nickname so the account has a name to show on the site. If the name is empty, we generate a random nickname. We do not save your Google profile photo. The photo URL in the token is not stored and is not used as your xChina avatar.

We do not request, and this application does not use, any other Google scopes. In particular we do not request access to Gmail, Google Drive, Calendar, Contacts, YouTube, or Google Photos.

What we store from Google, and what we do not

Stored: Google account ID (sub), email address, and display name (as nickname).
Not stored: Google profile photo; Google access tokens; refresh tokens; the ID token after it has been verified; given name or family name as separate fields; Google locale; Google account password; or any other Google user content.

After Google Sign-In succeeds, xChina keeps an ordinary website session (see Section 12). That session is our own session identifier. It is not a Google access token.

Limited use of Google user data

Google user data is used only to authenticate you and to operate your xChina account. We do not use Google user data to show ads, build advertising profiles, sell data, or train unrelated models. We do not transfer Google user data to other apps, except to the infrastructure providers needed to run the account itself (for example, our database and the email provider that sends a registration email to the address Google provided).

4. How We Use Information

We use the information described above to:

create, authenticate, and maintain your account, including Google Sign-In and email/password login;
show your nickname, avatar, and public activity where the site is designed to display them;
send transactional email, such as registration or email-confirmation messages;
remember preferences such as language, theme, and login session;
operate site features you use (comments, posts, favorites, history, premium status);
process payments and advertising orders you request;
protect the service against abuse, spam, fraud, and attacks, including IP-based blocking where necessary;
count visits and understand aggregated traffic;
load Google Analytics on xchina.co to understand how the site is used;
display third-party ads on pages that are not marked ad-free, which funds the service.

We do not use Google user data for advertising, remarketing, or user profiling unrelated to providing your account.

5. Legal Basis for Processing

If the EU General Data Protection Regulation (GDPR) or similar laws apply to you, we process personal data on these bases:

Consent: when you choose Sign in with Google, post optional content, or otherwise volunteer information that is not required to browse public pages.
Contractual necessity: to create and run your account, keep you logged in, provide features you request, and process payments or advertising orders.
Legitimate interests: to keep the website secure, prevent abuse, measure traffic, operate logs, and display advertising that funds a free site, provided those interests are not overridden by your rights. We do not rely on legitimate interests to use Google user data for advertising.
Legal obligation: when we must keep or disclose information to comply with applicable law or a valid legal request.

You may withdraw consent where processing is based on consent, including by disconnecting Google access as described in Section 11. Withdrawal does not affect processing already completed.

We do not sell your personal information.

We share information only in the following situations:

Google: when you use Sign in with Google, you interact with Google under Google’s terms and privacy policy. We receive the ID token described in Section 3. Separately, Google Analytics runs on xchina.co and receives the technical data that product collects. Google Sign-In data is not passed to Google Analytics as an advertising identifier.
Cloudflare: traffic to xChina is delivered through Cloudflare, which necessarily processes IP addresses and request metadata to provide CDN and security services.
Email delivery: transactional emails are sent through our email-sending provider. That provider receives the destination email address and message content.
PayPal: if you pay with PayPal, PayPal processes the payment. We store the payer and transaction fields PayPal returns so we can record that the order was paid.
Advertising partners: on pages with ads, third-party ad networks may collect their own cookies and device data. We do not provide them with your Google account ID, Google email, or Google display name.
Legal requests: we may disclose information if we believe in good faith that we are required to do so by law, regulation, court order, or a valid government request, or to protect the rights, safety, or security of xChina, our users, or the public.

We do not share Google user data with other applications, data brokers, or advertisers.

7. Data Storage and Security

Account records are stored in databases we operate. Login sessions are stored in Redis and referenced by an HTTP-only cookie. The site is served over HTTPS and sits behind Cloudflare.

Session cookies are set with Secure, HttpOnly, and SameSite=Lax. Passwords for email/password accounts are stored hashed. Google Sign-In accounts may have no password on file.

No method of transmission or storage is completely secure. We take reasonable technical and organizational measures, but we cannot guarantee absolute security.

8. Data Retention

Account data (email, nickname, Google ID, profile settings, posts, comments, and related records) is kept for as long as the account exists. There is currently no automatic account-deletion timer in the product. If you ask us to delete your account, we delete or anonymize personal account data as described in Section 11, except where we must keep information for security, abuse prevention, or legal records.
Login sessions expire after 30 days of inactivity. Using the site while logged in refreshes that period.
Google Sign-In return-context cookie (__options on xchina.online) expires after 3 days.
Theme and similar preference cookies typically last up to 90 days unless you clear them sooner.
Short-lived feature cookies (for example, vote or report cookies) last from hours to a few days.
Payment and advertising-order records are kept as business records of the transaction.
IP addresses, country, device, and visit/click logs are kept as needed to operate, secure, and measure the service. The code does not define a published auto-delete interval for these logs.
Google Analytics retention follows the settings of that Google Analytics property.

We do not keep Google ID tokens or Google access tokens after sign-in has been verified.

9. User Controls, Revocation and Data Deletion

Revoking Google access

You can disconnect xChina from your Google account at any time on Google’s permissions page:

https://myaccount.google.com/permissions

After you revoke access, we will no longer be able to sign you in with that Google authorization. Your existing xChina account and the Google ID / email already stored for that account remain until you ask us to delete them or you delete the xChina account.

Site controls

You can log out from your account page (the control labelled for signing out).
You can change nickname, password (if one is set), and certain profile settings while logged in.
You can block or delete cookies in your browser. Blocking cookies will prevent login from working and will affect preferences and some features.

Access, correction, and deletion requests

The site does not currently offer a self-service “delete my account” button. To access, correct, or delete personal data we hold about you, email [email protected] from the email address on the account, or include enough information for us to identify the account (for example, your xChina nickname and the Google email you used to sign in).

We will review the request, confirm that it comes from the account holder, and then provide a copy of the account data we hold, correct inaccurate account data, or delete the account and associated personal data we no longer need. We may retain limited records where we must do so for security, fraud prevention, or legal reasons (for example, a completed payment record). We will tell you if we cannot fully delete a category of data and why.

10. Cookies and Similar Technologies

We and certain third parties use cookies and similar technologies:

Strictly necessary: __login_user_session_id keeps you logged in; __options on the login host remembers which site to return you to after Google Sign-In; Google’s g_csrf_token cookie is used to validate the Sign-In callback.
Preferences: ck_theme stores light/dark theme on xchina.co. Other cookies may remember reading or display preferences.
Security and anti-abuse: cookies that prevent repeat voting or duplicate reports.
Analytics: Google Analytics cookies such as _ga on xchina.co.
Advertising: third-party ad networks may set cookies on pages that display ads.

We do not currently display a separate cookie-consent banner. You can refuse or delete cookies through your browser settings. Google Analytics and ad cookies can also be limited through industry opt-out tools and, for Google, through your Google account ad settings.

11. International Data Transfers

xChina is used by people in many countries. Our hosting, Cloudflare, Google (Sign-In and Analytics), PayPal, email delivery, and advertising partners may process data in the United States or other countries that may not provide the same legal protections as your home country. If you are in the EEA, United Kingdom, or Switzerland, those transfers are made in order to provide the service you requested and to operate the website. You can contact us if you want more detail about the providers involved in your request.

If GDPR or equivalent law applies to you, you have the right to:

Access the personal data we hold about you;
Rectification of inaccurate personal data;
Erasure of personal data in the circumstances the law allows;
Restriction of processing in the circumstances the law allows;
Objection to processing based on legitimate interests, including profiling related to such processing;
Portability of personal data you provided to us, where processing is based on consent or contract and is carried out by automated means;
Withdraw consent at any time where processing is based on consent, including by revoking Google access;
Lodge a complaint with your local supervisory authority. EEA users can find their authority via the European Data Protection Board: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

To exercise these rights, email [email protected]. We may need to verify your identity before fulfilling the request.

13. Children’s Privacy

xChina is an adult website. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. The site is labelled with RTA adult-content meta tags. If you believe we have collected information from a minor, contact [email protected] and we will delete it.

14. Changes to This Privacy Policy

We may update this policy when the product or the law changes. The “Last Updated” date at the top will change when we do. The current version will always be published at https://xchina.co/policy.html. If a change materially affects how we use Google user data, we will update this page before that change takes effect.

15. Contact Us

This website and application are operated under the name xChina.

Website: https://xchina.co/
Privacy and data requests: [email protected]

Please use email for access, correction, or deletion requests so we have a written record of the request.

16. Google API Services User Data Policy

xChina’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

xChina is not a Google product and is not endorsed or certified by Google, except to the extent Google independently reviews OAuth branding or API use.