Xuxly Privacy Policy and U.S. State Privacy Notice

Version 2026-10-25. Effective October 25, 2026.

1. Who is responsible and how to contact us

Nomenas Digital LLC, a New Mexico limited liability company, operates Xuxly and determines how personal information is used for the purposes described here. Our correspondence address is 1209 Mountain Road Pl NE, STE N, Albuquerque, NM 87110, USA. Contact legal@xuxly.com for privacy, access, correction, deletion, and legal inquiries; support@xuxly.com for ordinary support. Our company phone is +1 505 459 3101. We do not operate a public walk-in office at the correspondence address.

This notice covers the Xuxly website, Android application, online catalog, creator and radio workflows, and related account services. It does not govern a third-party radio operator's independent collection, an app store's own activities, or another Nomenas project merely because that project has the same owner.

2. Local music is different from online account data

The Android application can index and play audio files already on your device. Local audio files are not automatically uploaded to Xuxly. Your local music index, local playlists, hidden-item settings, local playback state, preferences, artwork cache, and app-private offline files are stored on the device. Merely giving the app permission to read music does not publish your files or transfer their ownership.

Account-backed features separately process online playlists, favorites, follows, online playback state, and listening activity. Where a feature synchronizes eligible preferences or library state, it must identify the synchronization to you. Sending a file or screenshot to support or deliberately submitting a recording as a Creator is different from local playback.

Android cloud backup and device-transfer backup for Xuxly's app files, databases, and preferences are disabled in the current application. Local data can remain until removed in the app, cleared through device settings, or removed by uninstalling the app. Device and operating-system behavior may affect cached and app-private files. Files saved separately outside app-private storage are not necessarily removed by uninstalling Xuxly.

3. Information we process

A one-way or keyed identifier can still be personal information if it remains linkable to a user or device. It is not automatically anonymous. Raw IP addresses are not fields in the first-party listening-event table, but infrastructure and security providers may process them.

Google Play processes purchases made through the Android purchase flow. Xuxly verifies purchases with Google, binds them to the purchasing Xuxly account using an obfuscated account identifier, and receives purchase tokens, order/subscription identifiers, acknowledgement state, expiry and cancellation information. Google's authenticated real-time notifications and periodic reconciliation keep access in step with the store; a notification alone does not grant Plus. Stripe hosts and processes web checkout and billing management where available. Xuxly receives transaction and subscription identifiers and status information but does not receive or store your full payment-card number. Xuxly does not operate a creator payout system. Do not send passwords, card details, government identifiers, or other unnecessary sensitive information in an ordinary support request.

Content you choose to submit may itself contain personal information. A biography, lyric, profile, photograph, or complaint can disclose information beyond the fields the platform explicitly requests. We do not require information about health, religious beliefs, or similar sensitive matters merely to listen to music.

4. How we use information

We use information to provide the functions you request, authenticate and protect accounts, maintain your online library, deliver catalog media, process creator and radio submissions, communicate relevant service events, operate first-party statistics, investigate misuse, process requests, and establish or defend legal rights.

We use activity and settings for the Service's library and discovery functions and to assess whether listening events should count toward statistics. These figures are not royalty statements or payment records. Security controls may limit an Account or request automatically; you may contact us to seek review of an apparent mistake.

Optional marketing permission is separate from service operation. The current configuration does not connect a marketing-automation provider. A stored marketing choice is not evidence that a campaign has been sent. Any later campaign must follow the applicable permission and unsubscribe requirements.

The Android application includes Google Mobile Ads and Google's User Messaging Platform (UMP) for applicable advertising privacy choices. In the current release, no banner placement is enabled. UMP can request consent information and show a form where required; Mobile Ads can initialize when UMP permits requests. SDK initialization can itself involve device/network identifiers, approximate location, interaction information and diagnostics, even when no banner is displayed. Xuxly also offers Google Identity Services as an optional account sign-in method. Xuxly does not place advertising in Android Auto, interrupt playback with interstitial or app-open ads, or use an external crash-reporting SDK in the current stack.

On the website, optional Google Analytics starts only after you select Allow analytics. Rejecting it sends no analytics request to Google. Measurement is limited to public catalogue and application-presentation pages; account, administration, checkout, personal library/history, search, profiles and playlists are excluded. We strip query strings and fragments, send only the referrer origin and a generic page title, and do not set a Xuxly User-ID. Google Signals, advertising personalization and enhanced automatic interaction measurement are disabled. Google still receives ordinary network/browser information when you allow its tag; this is pseudonymous measurement, not a claim of anonymity. You may reject or withdraw through Privacy choices on catalogue pages, also reachable at Privacy choices. Withdrawal stops subsequent measurement and removes the integration's Analytics cookies in that browser; it does not erase events already sent. See the Cookie and Storage Notice and Google's information about partner sites.

We do not sell personal information for money and do not use your listening history to create outside advertising audiences. Depending on the jurisdiction and the advertising choices available to you, Google's processing for personalized or targeted ads may be treated as a sale, sharing, or targeted advertising under a privacy law. Where required, Xuxly uses UMP to request a choice before requesting ads and provides an in-app route to revisit that choice. Plus and qualifying lifetime-support Accounts are excluded from Xuxly ad placements; this does not mean all consent or advertising SDK initialization is disabled for those Accounts.

5. Public information and your choices

Artist and station pages, published releases, associated media, and other information you deliberately publish are public. Listener profiles, listening activity, collections, follows, and shareable playlists are exposed according to the public/private choices offered for those features. A private collection is not included in public search merely because you have an Account.

Published artwork and other public page assets can be retrieved through public URLs. Catalog audio uses authorized, time-limited delivery grants and download controls. These controls do not guarantee that a listener cannot retain or copy audio. Search engines, other users, and third parties may copy or retain public material. Changing a setting or withdrawing publication does not guarantee removal from every external cache, saved copy, or search result. We can act on the systems we control and send appropriate deletion or purge instructions to relevant providers.

Do not place another person's private contact details, confidential documents, or information you are not authorized to disclose in a public field. Use the private legal-reporting channel for sensitive evidence.

6. Who receives information

Infrastructure and operational providers. We use the following current providers or infrastructure, with access appropriate to their role:

• OVHcloud / OVH US infrastructure: application and database hosting and related system operations. The server's public allocation is U.S. West/Oregon; an exact facility and backup location have not been independently verified in the technical inventory.
• Cloudflare: DNS, security/access and tunnel services, R2 media storage, CDN delivery, and incoming email routing. Access identity processing applies to the protected tester/administrator environment where that feature is used.
• Resend: delivery of transactional account email, such as address verification and password-reset messages. This involves recipient addresses, message content and delivery information.
• Mailbox infrastructure identified as Jellyfish Systems: receives mail forwarded to the Nomenas destination mailbox. The contracting legal entity, actual mailbox region, and any underlying Namecheap contractual role require confirmation.
• Stripe: hosted checkout, payment processing, subscription and billing-portal functions, fraud prevention, receipts and transaction records. Stripe processes payment credentials under its own role and terms; Xuxly receives identifiers and payment status needed to grant and reconcile benefits.
• Google Play and Google Cloud Pub/Sub: Android purchase processing, server-side purchase verification and acknowledgement, subscription management, and authenticated purchase-status notifications. Google independently processes store account and payment information under its own policies.
• Google Analytics: optional public-website measurement after consent, as described above. Google processes network/browser data and pseudonymous identifiers under its applicable data-processing terms and policies. This web integration is separate from Google sign-in, Play purchases and Android advertising.
• Google AdMob / Google Mobile Ads and User Messaging Platform: advertising SDK operation, diagnostics, advertising measurement, fraud/security controls and privacy-choice handling in the Android application, including initialization as described above. Processing depends on the user's location, device settings, available identifiers and consent choices.
• Google Identity Services: optional Google account authentication. Xuxly validates Google's signed ID token for the configured Xuxly client, requires Google's verified-email assertion for registration or linking, and uses Google's stable account subject as the identity key. Xuxly does not request or store your Google password or an OAuth client secret for this flow.
• Authorized Nomenas personnel and operator-controlled workstations: administration, support, deployment records, and retained configuration or database evidence where applicable. Access must be restricted to legitimate business needs.

Namecheap is the domain registrar for Xuxly. That role does not make it the operator of the current Xuxly application database or active DNS service. Providers may generate their own security, reliability, and administrative records under their applicable contracts and legal duties.

Radio streams. When your client connects to an external radio stream, its operator and streaming host can receive the network information needed for the connection, such as IP address and client/request information. They may process information under their own policies. A station may include advertising in its own programming independently of Xuxly's Android banner system. Playing a station is not a transfer of your Account to that station.

Reports and legal matters. We may share information reasonably necessary to investigate a report, obtain professional advice, respond to valid legal process, protect rights or security, or pursue a claim. A DMCA counter-notice is forwarded to the original claimant as required by that process. We may also share relevant notice details with the affected uploader. We do not promise anonymity where lawful notice handling requires identification.

Business changes. Information may be disclosed or transferred in connection with a genuine merger, acquisition, restructuring, financing review, or transfer of the relevant business, subject to appropriate confidentiality and applicable privacy requirements. Such a transaction does not authorize ignoring this notice or mandatory law.

At your direction. We may disclose material when you choose a public setting, send a support request, authorize a sharing function, or otherwise direct a specific disclosure. That permission does not automatically extend to unrelated uses.

7. Processing locations

The application host is in the United States, with a U.S.-West/Oregon network allocation. Cloudflare R2 uses provider-managed placement; a location hint is not proof of one country or a particular physical facility. Cloudflare uses global networks, and storage, delivery caches, access security, and email routing may involve processing in multiple countries. Google, Stripe and email providers may also process information in countries where they or their service providers operate.

The country of a server is not necessarily the country of backups, administrative access, or email storage.

Our market orientation does not mean all processing occurs in the United States. Where applicable law requires safeguards for an international transfer, those requirements must be satisfied; using Xuxly is not a blanket waiver of them. Contact legal@xuxly.com for information about applicable safeguards.

8. Retention and account deletion

We determine retention by the function served, whether the Account or Content remains active, security and dispute needs, evidence of permissions, legal requirements, and the operation of defined backup cycles. Retention for legal defense is limited to relevant records, not a reason to keep every listening event indefinitely.

We retain each category only for the period reasonably necessary for the purposes below, subject to legal obligations, disputes, security needs, and ordinary backup rotation.

An Account deletion request immediately hides the listener profile and records a 30-day cancellation/grace period. After that period, an authorized operator completes the verified request through a tracked erasure process. It removes the account profile, browser and app sessions, linked Google sign-in identity, personal online library, playback history, personal listening records, preferences, notifications and applicable personal profile/playlist images. Failed image or CDN cleanup remains pending and is not recorded as completed deletion. A statutory request must be handled within its applicable deadline; an optional recovery period cannot extend that deadline without a lawful basis.

Where specific creator-rights, payment, copyright-case or moderation evidence must survive, the operator records its retention basis and a next review date no more than one year away. Such evidence may be linked to a restricted pseudonymous reference with no sign-in, password, account profile, contact email or personal biography. This is not a claim that retained legal documents are anonymous. They remain restricted personal data where they can identify a person. The review date is a deadline to reassess necessity, not a blanket permission to keep every record for a year.

Creators choose whether account deletion leaves their music available or also starts a separate ordinary 30-day withdrawal notice. Music does not disappear immediately. Urgent rights or safety action remains separate. Account deletion also does not itself cancel an external Google Play or Stripe subscription. Manage the subscription with the provider before closing the account, or contact support for help.

For new creator agreement acceptances, upload rights declarations, release creation/publication requests and account-deletion content choices, we retain restricted legal evidence tied to the specific release: the authenticated creator's verified identity/contact details where available, actual request IP address, time, browser/app user-agent, rights/terms versions, exact legal-document versions and available submission/content hashes. These records document permissions and support rights disputes, security and legal claims; they are not public analytics or advertising data. They survive account deletion subject to the documented necessity review and any applicable legal hold. We do not invent IP history for earlier releases where it was not recorded.

Some relevant records may be retained after account closure for legal claims, security, proof of content rights and consents, compliance with an order, or another valid exception. Public use must stop where required even if a restricted evidence copy remains. Backups must not be restored in a way that silently reinstates previously completed deletion requests.

We do not remotely erase ordinary music files from your device. Account deletion and the continuing validity of a personal Download License are separate matters. Users may clear their own browser storage and local app data as explained in the Cookie and Storage Notice.

9. Your privacy requests

You may contact legal@xuxly.com to request access, a copy, correction, deletion, or review of the way we handle your information. Include the Account email or public ID, the request, and a reliable reply method. Do not send a password or unnecessary identity document. Available account settings may provide a direct way to make some changes.

We may seek proportionate information to verify identity and authority before disclosing or deleting protected data. An authorized representative may need to establish permission. Verification information is used for that purpose and necessary security records, not unrelated marketing. You do not need to create a new Account to send a privacy request.

Applicable law determines which rights, exceptions, response periods, extensions, appeal rights, and complaint routes apply. If we cannot grant a request in full, we will explain the relevant reason to the extent legally permitted. You may request reconsideration at legal@xuxly.com, using "Privacy appeal" in the subject. A statutory complaint or appeal need not wait for an informal process where law allows otherwise. We will not unlawfully discriminate against you for exercising a privacy right.

Requests sent to legal@xuxly.com are tracked and handled through a proportionate identity-check and manual or account-based process.

10. Additional U.S. state notice

Where a state privacy law applies to Nomenas and the relevant processing, residents may have rights to confirm and access processing, obtain a portable copy, correct inaccuracies, delete information, and opt out of defined sales, targeted advertising, or certain consequential profiling. Some laws provide a right to appeal a refusal or complain to the appropriate state regulator. Rights are subject to the particular law's scope, exceptions, and verification rules; the existence of this notice is not a representation that every statute applies to every visitor.

For California terminology, the data described above may include identifiers; account/customer-record information; internet or other electronic-network activity; audio, visual, or similar information; creator/professional information; and service-derived preferences. Information is obtained directly from you, through your use, or from authorized submitters, infrastructure, reporters, and authorities as described above. The purposes, recipients, and retention criteria are provided in the corresponding sections of this notice.

Nomenas does not sell personal information for money and does not use sensitive personal information for advertising or a purpose requiring an opt-out or limitation beyond the necessary service/security uses described here. Google mobile-ad disclosures may constitute sharing or targeted advertising under some state laws; the relevant choices are described above. We do not infer a person's health, religion, or similar sensitive characteristics for advertising from their music choices.

The Xuxly website does not currently run behavioral advertising, so a browser Global Privacy Control or Do Not Track signal does not alter a web-advertising practice. Mobile advertising choices are presented through the app and UMP where required. If applicable law requires another recognized signal or request mechanism to control covered advertising processing, we will honor it. Functional authentication, requested playback, and security processing are not automatically disabled by an advertising opt-out.

The categories and practices above describe the current Xuxly Service. Other Nomenas services are governed by their own notices.

11. Children

Online Accounts are for people who are at least 18 and meet the Terms' capacity requirements. Xuxly is not designed as a child-directed online service, and we do not knowingly collect children's personal information in violation of applicable law. A contractual age statement is not a substitute for handling actual knowledge that a user is a child.

A parent or guardian who believes a child has supplied information may contact legal@xuxly.com. We will review the matter, restrict the affected account or processing where appropriate, and handle deletion or other action as required. The fact that the subject matter is music does not by itself eliminate children's privacy rules.

12. Security

We use technical and organizational measures appropriate to the Service, including account controls, restricted administrative access, separation of private submissions from public media, short-lived access grants for private paths, and abuse limits. No measure guarantees absolute security. Hiding an Account, expiring a signed URL, and deleting stored data are distinct actions.

Report a suspected security or privacy issue to legal@xuxly.com with enough information for us to investigate, without sending unrelated private data or publicly disclosing credentials. We will handle incidents and legally required notifications according to the applicable obligations.

13. Changes

We will update this notice when material practices change and state the new effective date. Material changes will be communicated through a suitable website/app notice or other appropriate means. A new advertising, analytics, email, payment, or identity provider must be reflected before the new processing begins where notice or consent is required. A change to this notice does not retroactively authorize an incompatible use or replace consent where consent is legally required.