1. Scope and controller
This policy applies to XBurma pages, accounts, engagement features and reports. XBurma determines how information collected directly through those features is used. Third-party media, advertising, consent and analytics providers may separately control data under their own policies.
2. Information collected
- Account data: normalised email address, display name, a one-way password hash, account timestamps and status.
- Session and security data: a signed session cookie, request metadata, rate-limit signals and technical logs used to secure the service.
- Engagement data: likes, reactions, comments and random browser identifiers used to prevent duplicate actions.
- Report data: the content URL or key, selected reason, explanation and any contact information a reporter supplies.
- Consent and preference data: age confirmation and self-hosted regional consent choices stored in the browser.
- Advertising delivery data: Adsterra may receive network, device, approximate-location, cookie, pixel and ad-interaction information when its ads load. Optional XBurma analytics and advertising measurement are processed only when the applicable regional rule and saved choice allow the relevant category.
XBurma does not store raw account passwords.
3. How information is used
Information is used to provide accounts, maintain signed-in sessions, publish comments, remember choices, prevent abuse, respond to reports, secure and debug the service, measure aggregate usage when allowed, fund the service through advertising and comply with valid legal obligations.
4. When information is shared
XBurma may disclose the minimum information needed to infrastructure, security, analytics, advertising and email service providers that support the service. Information may also be disclosed to comply with valid legal process, protect a person from immediate harm, investigate abuse, enforce policies or complete a business reorganisation subject to appropriate safeguards.
The current advertising provider is Adsterra. Its delivery code loads for human production sessions independently of XBurma's optional analytics and advertising-measurement choice, and Adsterra separately controls the information processed by that delivery. Browser cookie and content-blocking controls remain available.
Public comments display the submitted display name and comment text. XBurma does not publish a reporter's contact details as part of a catalogue page.
5. Cookies and similar storage
Necessary storage supports age confirmation, account sessions, duplicate-action prevention and security. Adsterra delivery is active for human production sessions. Optional Google Analytics and advertising measurement are controlled by XBurma's self-hosted regional consent controller. Strict opt-in regions remain default-denied for those optional categories; opt-out regions may enable them with notice until the visitor opts out. Details and typical lifetimes are listed in the Cookie Policy. A first-party, session-only frequency flag stops the contextual Shorts sponsor card from repeating during one browser session even when optional marketing consent is denied.
6. Retention
Account records are kept while the account is active and for a limited period afterward when needed for security, disputes or legal duties. Signed sessions expire after seven days. Comments and moderation records remain until removed or no longer needed. Reports are retained for the time reasonably necessary to investigate, document action, detect repeated abuse and meet legal obligations. Provider logs follow the applicable provider's configured retention schedule.
7. Choices and requests
Visitors can change optional consent through Cookie settings in the footer and can clear age or browser identifiers through browser controls. Depending on applicable law, a person may request access, correction, deletion, restriction, portability or objection, or may appeal a denied privacy request. Send a request to dmca@xburma.app with “Privacy request” in the subject. Identity verification may be required before account-specific information is disclosed or changed.
8. International processing and security
Providers may process information in countries other than the visitor's country. XBurma uses access controls, hashed passwords, signed session cookies, request limits and restricted administrative access, but no internet service can guarantee absolute security.
9. Children
XBurma is not directed to children and does not knowingly permit anyone under 18 to register or use the service. If you believe information from a minor has been collected, report it immediately through the Contact & safety page.