1. Scope and controller
This policy applies to XBurma pages, accounts, engagement features and reports. XBurma determines how information collected directly through those features is used. Third-party media, consent and analytics providers may separately control data under their own policies.
2. Information collected
- Account data: normalised email address, display name, a one-way password hash, account timestamps and status.
- Session and security data: a signed session cookie, request metadata, rate-limit signals and technical logs used to secure the service.
- Engagement data: likes, reactions, comments and random browser identifiers used to prevent duplicate actions.
- Report data: the content URL or key, selected reason, explanation and any contact information a reporter supplies.
- Consent and preference data: age confirmation and self-hosted regional consent choices stored in the browser.
- Analytics data: Google Analytics may receive page, traffic-source, device and approximate-location information only when the applicable regional rule and saved choice allow analytics.
XBurma does not store raw account passwords.
3. How information is used
Information is used to provide accounts, maintain signed-in sessions, publish comments, remember choices, prevent abuse, respond to reports, secure and debug the service, measure aggregate usage when allowed and comply with valid legal obligations.
4. When information is shared
XBurma may disclose the minimum information needed to infrastructure, security, analytics and email service providers that support the service. Information may also be disclosed to comply with valid legal process, protect a person from immediate harm, investigate abuse, enforce policies or complete a business reorganisation subject to appropriate safeguards.
Public comments display the submitted display name and comment text. XBurma does not publish a reporter's contact details as part of a catalogue page.
5. Cookies and similar storage
Necessary storage supports age confirmation, account sessions, duplicate-action prevention and security. Optional Google Analytics is controlled by XBurma's self-hosted regional consent controller. Strict opt-in regions remain default-denied; opt-out regions may enable analytics with notice until the visitor opts out. No advertising provider is currently configured. Details and typical lifetimes are listed in the Cookie Policy.
6. Retention
Account records are kept while the account is active and for a limited period afterward when needed for security, disputes or legal duties. Signed sessions expire after seven days. Comments and moderation records remain until removed or no longer needed. Reports are retained for the time reasonably necessary to investigate, document action, detect repeated abuse and meet legal obligations. Provider logs follow the applicable provider's configured retention schedule.
7. Choices and requests
Visitors can change optional consent through Cookie settings in the footer and can clear age or browser identifiers through browser controls. Depending on applicable law, a person may request access, correction, deletion, restriction, portability or objection, or may appeal a denied privacy request. Send a request to dmca@xburma.app with “Privacy request” in the subject. Identity verification may be required before account-specific information is disclosed or changed.
8. International processing and security
Providers may process information in countries other than the visitor's country. XBurma uses access controls, hashed passwords, signed session cookies, request limits and restricted administrative access, but no internet service can guarantee absolute security.
9. Children
XBurma is not directed to children and does not knowingly permit anyone under 18 to register or use the service. If you believe information from a minor has been collected, report it immediately through the Contact & safety page.