Privacy Policy

Service provider

The xxcode service (https://xxcode.app) is operated by Individual Entrepreneur BOZOROV SHOXZOD ODIL O'G'LI, registered in the Republic of Uzbekistan under registration No. 7685057 (dated April 16, 2026, issued by the Samarkand City State Services Center), located at 44/32 Beruniy St., Samarkand, Samarkand Region, Republic of Uzbekistan.

Contact: info@xxcode.app — or through the contact form. We reply by email.

1. Data we collect

We collect only what the Service needs in order to work.

• Account data — email address, password (stored only as a salted hash, never in readable form), full name and, optionally, your institution.
• Professional profile — the specialties, sub-specialty tags, keyword watchlist, experience level and article filters you choose. These determine which publications your digests are built from.
• Delivery preferences — format (text or audio), preferred length, content language, and the weekday, time and timezone at which you want your digest.
• Usage data — which digests were generated for you, when you opened them, which you flagged as important or saved, and a count of episodes listened to. Used to run the features themselves, not to profile you.
• Technical data — server logs containing IP address, request time, endpoint and error information, kept for security and debugging.
• Payment data — see section 4. We do not receive or store card numbers.

We do not ask for, and the Service is not designed to receive, patient data or personal health information about third parties. Please do not submit such data to us.

2. Why we use it

• To provide the Service — creating your account, building and delivering digests, rendering audio, and giving you access to your library. Necessary to perform our contract with you.
• To send service email — verification codes, password resets, subscription notices and the scheduled digest you asked for. You can turn the digest email off in settings.
• To keep the Service secure and working — abuse prevention, rate limiting, error diagnosis. Our legitimate interest in operating a reliable service.
• To meet legal and accounting obligations — retaining transaction records for the period required by the law of the Republic of Uzbekistan.

3. Cookies

We use a small number of first-party cookies. There are no advertising or tracking cookies.

• xxcode_token — your session. Set when you sign in, removed when you sign out. Without it you cannot stay signed in.
• xxcode_lang — the interface language you selected.
• xxcode_theme — light or dark appearance.

4. Payments

Subscription payments are processed by an authorized payment service provider. Your card number, expiry date and security code are entered on the provider's secure page and are never sent to or stored by us. We receive only what is needed to manage your subscription: whether a payment succeeded, the amount, the date and a payment reference.

5. Service providers we share data with

Each receives only the data needed for its function and may not use it for its own purposes.

• Hosting and database — hold your account, preferences and digests.
• Object storage (DigitalOcean Spaces) — stores generated audio. Files are private; playback links are short-lived and issued only after we check your entitlement.
• Email delivery (Resend) — receives your email address and message content to deliver verification codes, password resets and digests.
• AI processing (OpenAI) — receives publication abstracts and metadata to produce summaries and audio narration. Your name, email and account identifiers are not sent.
• Literature source (NCBI/PubMed) — queried for publications. No personal data is sent there.

Some providers operate outside the Republic of Uzbekistan, so your data may be processed abroad. We use providers that offer contractual data-protection terms.

We may also disclose data where required by law, to establish or defend legal claims, or to protect the rights and safety of users and the Service.

6. How long we keep it

• Account, profile and digest data — for as long as your account exists.
• After you delete your account — removed from active systems promptly; residual copies may persist in backups for a short rotation period before being overwritten.
• Server logs — a limited period for security and debugging.
• Transaction and invoicing records — for the retention period required by accounting and tax law.

7. Security

Traffic is encrypted in transit. Passwords are stored only as salted hashes. Audio files are stored privately and served through short-lived signed links after an entitlement check. Access to production systems is restricted. No system is perfectly secure, but we will inform you if a breach affects your data and the law requires notice.

8. Your rights

You may:

• access the personal data we hold about you and receive a copy;
• correct inaccurate data — most of it is editable directly in your settings;
• delete your account and the data attached to it;
• withdraw consent to the digest email at any time;
• object to processing based on our legitimate interests.

To exercise any of these, write to us or use the contact form. We respond within 30 days. If you believe we have mishandled your data, you may complain to the competent data-protection authority in the Republic of Uzbekistan.

9. Children

The Service is intended for healthcare professionals and students in the health sciences and is not directed at children under 18. We do not knowingly collect their data; if we learn that we have, we delete it.

10. Changes to this policy

We may update this policy. The effective date at the top always reflects the current version, and material changes are announced by email or in the Service before they take effect.