Privacy Policy

XGenius ("we", "us") is an AI-powered fantasy football platform covering the Premier League, UEFA Champions League, and FIFA World Cup. This policy explains what personal data we collect when you use the XGenius website and apps, why we collect it, and the choices you have.

Account data. When you register we collect your email address, display name, and a password (stored only as a salted bcrypt hash). If you sign in with Google, we receive your name, email address, and profile picture from Google; we never see your Google password.

Gameplay data. Squads you build, transfers you make, leagues you join, and preferences you set are stored against your account so the product can work.

Copilot conversations. Messages you send to the AI Copilot are stored with your account so you can revisit conversations, and are processed by third-party language-model providers (see section 4).

Technical data. We keep standard server logs (IP address, user agent, request time) for security and rate limiting. We do not use third-party advertising or tracking cookies.

We use a small number of strictly necessary cookies: an HttpOnly refresh-token cookie to keep you signed in and a CSRF-protection cookie. These are required for the service to function and are not used for advertising or cross-site tracking.

We share data with the following categories of processors, only as needed to run the service:

• AI providers (such as Groq, OpenAI, and Google) — receive the text of your Copilot messages and relevant football context to generate responses. They do not receive your password or payment details.
• Google — if you choose "Sign in with Google", authentication is handled by Google OAuth.
• Cloud hosting (Amazon Web Services) — our databases and servers run on AWS; data is encrypted in transit (TLS) and at rest.
• Football data providers — match and player statistics come from licensed sports-data APIs. No personal data flows to them.

We never sell your personal data.

We keep your data while your account is active. You can delete your account at any time from Settings, or by emailing us; this permanently removes your account data, squads, and Copilot conversations within 30 days, except where we must retain records to comply with law.

Depending on where you live (including under GDPR and CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact us at the address below. We will respond within 30 days.

XGenius is not directed at children under 13 (or the minimum age required in your country), and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

We will post any changes to this policy on this page and update the date above. For questions or data requests, contact privacy@xgenius.app.