Privacy policy

This Privacy Policy describes what data Xylora (https://get.xylora.net, bot @xylora_bot, and the Telegram mini-app) processes, why, and how it is protected when you use the VPN service.

1. Operator

The personal data operator is the Xylora service (“operator”). Contact the operator via чат поддержки в Кабинете или поддержку в Telegram-боте @xylora_bot (https://t.me/xylora_bot?startapp=support).

2. Data we process

• Account: email address, password hash (if password sign-in).
• Telegram sign-in: Telegram ID, name, username, profile photo URL — as provided by Telegram.
• Google sign-in: Google account id, email, and name.
• Technical: IP address, device and app info (model, OS, app version, device id if sent by the app), subscription connection times, traffic volume.
• Payments: amount, plan, status and order id, email for receipts, bank service ids (including saved-card id for auto-renewal). Full card data is processed by JSC TBank and is not passed to the operator.
• Support: message text and attached files.

The operator does not collect or store browsing history or the contents of traffic you send through the VPN.

3. Purposes

• registration, sign-in, and linking sign-in methods;
• performing the Terms: access, period, traffic and device accounting;
• payments, auto-renewal, and receipts;
• service notices: expiry, payment results, service changes;
• support replies;
• abuse prevention and security;
• legal compliance.

4. Legal bases

Processing is necessary to perform the agreement with the User and to meet legal duties. Marketing messages are sent only with consent and can be turned off via the email link or Dashboard settings.

5. Retention

• account data — while the account exists, and up to 30 days after a deletion request;
• device and connection technical data — no longer than 60 days after the last connection, unless needed for a specific support case;
• payment records — 5 years for accounting;
• support threads — 1 year after closing.

6. Recipients

Data is shared only as needed to run the service:

• JSC TBank — payments and auto-renewal;
• Telegram — bot message delivery (if you sign in with Telegram);
• Resend (USA) — email delivery;
• hosting providers that run the service;
• public authorities — when required by law.

Some processors are outside Russia; cross-border transfer follows applicable law.

7. Security

Site traffic uses HTTPS, passwords are stored hashed, server access keys are encrypted, and database access is limited to the operator. Organizational and technical measures are applied to protect data.

8. Cookies and local storage

The site stores a sign-in token and UI settings in the browser — required for the Dashboard. On public pages we use Umami on our servers (no cookies, no stored IP), Google Analytics (Google LLC), and Ahrefs Web Analytics for anonymized visit metrics; Google Analytics may use cookies. We do not use ad pixels. If the browser allows scripts, anonymized page sessions (clicks and scroll) may be recorded to improve the UI; passwords and marked input fields are blocked.

9. Your rights

You may request information about processing, correction, blocking or deletion of your data, withdraw consent, and complain to a supervisory authority or court. Send requests via чат поддержки в Кабинете или поддержку в Telegram-боте @xylora_bot (https://t.me/xylora_bot?startapp=support); we respond within 10 business days. Deleting the account ends access to the service.

10. Changes

A new version is published on this page and takes effect on publication. The current revision date is shown above.