Controller and scope
The operator identified in the XXL Finds Imprint is responsible for the personal data described here.
This policy covers the XXL Finds Android application, public website, accounts and support services.
Privacy requests can be submitted through the in-app Support area or this website's Contact page.
Account and public profile data
An account may include an email address, secure password hash or connected sign-in provider,
verification state, username, display name, biography, avatar, account status and sign-in times.
Public profile details, published Finds and published Quick Checks are visible to other users. Email,
password data, Saved Finds, blocks, support tickets and security information are not public.
Feature and community data
We process data a user chooses to provide through Finds, Quick Checks, image uploads, votes, reports,
blocked accounts, support tickets, Price Tracker entries and Order Tracker entries. Signed-in Saved
Finds are stored with the account. Some functions, including collections, Size Notes, recent searches
and unfinished drafts, currently remain on the device unless stated otherwise in the app.
App device, notification and usage data
The Android app creates a random installation identifier; it is not the Android hardware identifier.
We may process it with app version, platform, notification preferences, push token, product interactions
and limited crash or performance information. Google Firebase Cloud Messaging supports push delivery,
and Google Firebase Crashlytics supports release crash diagnosis.
External links
When users leave XXL Finds through an external product link, the third-party website's own privacy
policy applies. XXL Finds does not control the privacy practices of third-party sellers,
marketplaces, platforms or external websites.
Support, contact and removal requests
Contact and in-app Support requests are stored as tickets. Depending on the request, we process name,
email, company or role, message content, product URLs, proof of rights or authorization, ticket status
and replies so the matter can be reviewed, documented and resolved.
No order, payment or shipping data
XXL Finds does not process product orders, payments, shipping addresses, returns, refunds or
warranty claims. These actions happen only on third-party websites.
Server logs, cookies and local storage
We use minimal browser cookies for saved finds, votes and preferences. Preferences may be stored
in local storage, such as theme and cookie choices. We may also process basic technical data such
as device/browser information and server logs for security, abuse prevention and service operation.
Google Analytics
With your consent, XXL Finds uses Google Analytics to understand page visits and improve the website.
The Google tag starts with analytics storage denied. Analytics cookies and page-view measurement are only
enabled after you allow Analytics in the cookie settings. Advertising storage, advertising user data and
ad personalization remain disabled. You can withdraw consent at any time through Cookie settings in the footer.
Service providers and international processing
We use infrastructure and database hosting, Cloudflare for network services and image storage, Google
Firebase for push delivery and crash reporting, and Resend for account verification and password-reset
emails. Some providers may process data outside the European Economic Area under an adequacy decision,
approved contractual safeguards or another lawful mechanism.
Image safety and moderation
Find and Quick Check images are automatically screened for potentially unsafe content. Flagged uploads
and user reports may be reviewed by authorized administrators to protect the service and its users.
Legal bases and retention
Data is processed as needed to provide requested services, based on consent for optional functions,
to comply with legal duties, and for legitimate interests in security, moderation and reliable operation.
Account data is generally kept while the account is active. Feed-interaction events are removed after
90 days, and Firebase Crashlytics generally retains crash reports for approximately 90 days. Support,
moderation and audit data is kept only as long as reasonably needed for the matter and legal duties.
Account deletion and local data
Account deletion can be initiated in the Android app under Settings and Account, or through the
Account Deletion page on this website. Deletion revokes sessions, deletes account-bound Saved Finds,
Order Tracker entries, Quick Check votes and verification or reset records, and removes identifying
profile data. Authored public content may remain linked to a de-identified account where legally
permitted. Local and installation-based data, including Price Tracker entries, must be removed separately.
Your rights and choices
Subject to applicable law, you may request access, correction, deletion, restriction, portability or
object to certain processing. You may withdraw consent and complain to your competent data-protection
authority. We may verify identity before acting on a request. Website cookie choices can be changed in
the footer or removed through browser storage controls.
Security and contact
We use encrypted transport, secure password hashing, access controls, expiring sessions, rate limits and
restricted administrative access. No system can be completely secure. For privacy questions or rights
requests, use the in-app Support area or Contact page. Operator details are provided in the Imprint.