Privacy Policy

Ximos operates under a data minimization and zero-surveillance-profiling architecture. We only process data that you, as the authenticated parent or guardian, explicitly request or schedule through the parent dashboard:

• Live Hardware Streams (Screen, Camera, Surrounding Audio): Real-time screen projection, front camera, rear camera, and one-way ambient audio streams are transmitted via encrypted WebRTC hardware channels. These streams are handled transiently in RAM and are never recorded or saved unless you explicitly tap "Record" or schedule an automated capture in your Cloud Vault.
• Vault Media (Photos, Audios, Videos): Captured photos, ambient audio recordings, and video clips requested by the parent are encrypted and transmitted directly to your personal cloud storage database.
• Location Data (Parent-Triggered, In-Flight Only): When you trigger a location fetch from the parent app or dashboard, the child device returns one payload containing latitude, longitude, accuracy, provider, and timestamp. This payload is relayed through an encrypted WebSocket directly to your connected parent session and is not retained on our servers beyond the in-flight broadcast. There is no background location collection, no location history table, and no location trail per device.
• Device Telemetry & Hardware Metadata: To ensure accurate remote touch mapping, battery monitoring, and anti-fraud verification (preventing referral abuse), the app collects minimal non-identifying telemetry including: device manufacturer, model, screen resolution, operating system version, battery level, charging state, and network connectivity status.

Ximos is designed exclusively for legal guardians monitoring minor children under their legal custody or for personal emergency protection on user-owned devices.

Persistent Notification: Ximos abides by Android platform security guidelines by maintaining a visible, non-dismissable notification in the Android notification drawer whenever the service is actively communicating with the parent portal.

Icon visibility, disclosed directly: XimosKid shows its own name and icon in the device's app list by default. A parent can optionally hide the launcher icon; when hidden, the persistent notification above remains in place regardless, and a hidden dial code can restore the icon from the child's device at any time. We document this trade-off in full, including what it does and does not guarantee, in our Trust Center — a notification is only a meaningful signal if it's read, and we'd rather say that plainly than oversell it here.

Any attempt to deploy Ximos for unauthorized surveillance, stalking of spouses or adults, employee tracking without formal consent, or corporate espionage constitutes a direct violation of our Terms of Use and applicable state, federal, and international wiretap legislation.

We implement stringent data lifecycle controls to safeguard your family's personal moments:

• Transient Data Disposal: Real-time screen broadcasts, camera previews, audio bytes, and location payloads are streamed directly peer-to-peer or relayed in-flight, and are immediately discarded from memory once the active session or fetch terminates.
• Cloud Vault 30 + 7 Policy: Photos, video clips, and audio files saved to your cloud vault are retained for a maximum period of 30 calendar days, then moved to a 7-day trash window, then permanently purged by server cron jobs. Users are responsible for exporting or downloading important evidence or memories prior to expiration.
• End-to-End Encryption: Sensitive media, telemetry, and location payloads are encrypted in transit using TLS 1.3 cryptographic protocols and authenticated with unique pairing tokens.
• Location — Zero Server Retention: Location payloads are never written to a database, never logged, and are not retrievable after the fetch completes.

Location is a sensitive data type, so it gets its own section rather than being folded into the general telemetry description.

• Triggered, never continuous: the parent taps refresh in the Ximos app or dashboard. No polling, no scheduled background fetches, no location trail.
• Two-stage fetch on the child device: the last-known cached location is uploaded immediately, and a fresh high-accuracy GPS fix is requested in parallel. Both are sent; the server uses the freshest timestamp.
• Automatic fallback chain when GPS is unavailable: Fused GPS (3–20 m) → Network Provider via Wi-Fi BSSID + cell tower (20–100 m) → last-known from any enabled provider → IP-based geolocation (5–50 km, city-level only).
• Honest tagging: each uploaded location is tagged with its provider and an isFallback boolean so the parent app can visually indicate how reliable the data is — accurate marker vs. approximate marker — rather than pretending every reading is equally precise.
• Delivery path: relayed over the same encrypted Cloudflare Workers WebSocket used for stream signaling and usage data, in a per-user Durable Object room keyed to uid + deviceKey. The JWT is verified server-side against Google's public JWKS before any broadcast.
• Map rendering: the parent app uses a free OpenStreetMap-based map (Esri World Street, Esri World Imagery satellite, or classic OSM) with a one-tap "Open in Google Maps" button. No Google Maps API key is required, and no location is sent to Google in order to render the map.
• GPS auto-enable disclosure: when GPS is off on the kid device, XimosKid's Accessibility Service auto-clicks the system location-enable dialog's accept button in the user's language (English, Bengali, Hindi, and others). This only runs during a parent-triggered fetch — never in the background.

Ximos is a privacy-first utility. We do not sell, rent, monetize, or trade your personal data, media streams, location payloads, or telemetry with any third-party marketing agencies, advertisers, or data brokers.

Our web applications and remote monitoring interfaces do not utilize tracking cookies, behavioral ad pixels, or session recording scripts. All communications are direct API calls between the authenticated parent dashboard and the child client service.

To provide legitimate parental controls, device protection, and safety telemetry, Ximos requests specific Android permissions. Below is a full disclosure of each permission and its exact operational purpose:

Ximos is designed with the principles of the Children's Online Privacy Protection Act (COPPA) and General Data Protection Regulation (GDPR Article 8) in mind. We have not sought a third-party certification of formal compliance, and we'd rather say that directly than claim a status we can't point to an auditor for.

• Parental Authorization: Data processing is initiated solely under the direct affirmative consent and configuration of the child's legal parent or court-appointed guardian.
• No Commercial Profiling: Under no circumstances is child telemetry, activity logs, location data, or media utilized for behavioral advertising, credit profiling, or demographic sales.
• Right to Erasure: Parents can review, export, or permanently delete stored vault media and their account's data at any time via account deletion or the vault's delete controls in the parent dashboard. Account deletion is permanent — see Retention & Deletion for the exact flow.

If you have any questions, compliance requests, or wish to exercise your data rights regarding your Ximos account, please contact our Data Protection Team at:

General Support: [email protected]
Security Disclosure: [email protected]
Web Portal: https://ximosapp.com
Trust Center: Architecture, permissions, and independent scan results