Privacy Notice

1. Who handles your information

XQI Notes (operated by Kairan Feng, Ontario, Canada) is responsible for the information you give us on this site. Contact: support@xqinotes.com.

2. What we collect

What you give us: the email address you enter at checkout; for gift orders, the recipient's email address; the country (Canada or United States), language, currency, and item you select; and your confirmation about age or guardian permission.

What is generated automatically: your order number and status; payment identifiers created by Stripe; transaction and fulfilment event records; and records of download links being issued and used.

What we do not collect: your full card number (Stripe handles that directly and we never see it); your name, address, or phone number (we do not ask for these).

3. Why we process it

To process your order and payment; to deliver what you bought; to verify your order when you contact support; to prevent duplicate charges, fraud, and link abuse; and to keep transaction and consent records in case of a dispute or a legal requirement.

4. Third-party services we use

Stripe: payment processing. Sees your payment details, email, amount.

Supabase: database. Sees orders, email addresses, consent records.

Vercel: website hosting. Sees request logs.

Resend: sending transactional email. Sees recipient address, message content.

Cloudflare: download delivery and file storage. Sees download request records.

Each of these is governed by its own policies. Some of them may operate servers outside Canada, including in the United States.

5. Cookies and browser storage

Purchase cookie (__Host-xqi_purchase): set during checkout so we can recognise your order when you return to the success page. HttpOnly, Secure, SameSite=Lax, and it lasts at most 3 hours. It is necessary to complete a purchase and is not used for advertising or tracking.

Browser local storage: the success page stores up to 20 purchase markers (item code and public order number) in your browser so we can tell you if you already own something. These live in your own browser, we cannot read them, and there is currently no automatic expiry or cleanup — you can remove them at any time by clearing your browser data.

Rate limiting: to prevent abuse we apply a one-way hash to the requesting IP address and use the result as a rate-limit key. We do not store the raw IP. That key is kept for roughly 70 to 610 seconds.

6. What we do not do

We currently use no website analytics (no Google Analytics, Plausible, or similar), no advertising trackers, and we do not sell or rent your information to anyone.

7. Data retention

Order records, email addresses, payment identifiers, consent records, and email delivery records are retained, and we do not currently have an automated deletion or anonymisation process. Short-lived download tokens, access credentials, and replay-protection records are cleaned up automatically once they expire.

If you want your information deleted, email support@xqinotes.com. Note that some transaction records may need to be kept for accounting or legal reasons; we will tell you which in our reply.

8. Your rights

You can ask to see what we hold about you, ask us to correct it, or ask us to delete it where the law allows. Email support@xqinotes.com. We usually reply within 1–2 business days.

9. Changes

We may update this notice. Each order stores the policy version identifier that was in effect when it was placed.