Privacy

Updated October 18, 2026. This notice describes the XO Talk application.

Profile and gameplay

XO Talk stores your player identifier, chosen name, country, profile picture, virtual coin balance, game history, ranking statistics, friend relationships and messages. Country is a profile choice; it is not precise device location. Basic online status is shown to other players. Friends can exchange messages; messages are stored on the server and are not end-to-end encrypted.

To measure current online participation, the app sends foreground session heartbeats with your player identifier and a random session identifier. The server uses its own timestamps, excludes expired sessions, and shows aggregate country and gameplay activity counts only to the authorized operator. Session records are scheduled for automatic deletion after one day; deletion may be delayed by the database TTL service.

Message notifications

With notification permission, XO Talk uses Firebase Cloud Messaging to deliver friend message alerts. The server stores your device messaging token associated with your player account and sends the sender name, message preview and conversation identifiers through Firebase Cloud Messaging. Message text is hidden on the lock screen by default, subject to your Android settings. You can disable notifications in Android settings. The app suppresses alerts for the conversation currently open and clears local notifications when you sign out. Device tokens last refreshed more than 30 days ago are excluded from delivery.

Friends and live status

Players can find public profiles by name prefix or friend code and send friend requests and short-lived game invitations. Firebase Realtime Database tracks foreground device connections for online/offline status. Accepted friends can read each other's live connection status; access is revoked when a friendship is removed or blocked. Connection entries are removed on backgrounding or disconnect, subject to network detection delays. The existing operator online counter remains separate.

Sign-in and recovery

When you link an available social account, the server verifies that provider's account identifier and associates it with your XO Talk player profile. Your social password is handled by the sign-in provider. XO Talk does not request TikTok posting permissions, videos, contacts or private messages. Only basic profile access is requested for account verification. Provider tokens are used for verification and are not included in the Android application.

Photos and voice

Profile pictures are processed using Google Cloud image moderation before being accepted. Approved pictures are visible to other players. Voice chat uses Agora when you join a voice channel. Microphone permission is required to transmit your voice. XO Talk does not implement voice recording.

Service providers

Firebase and Google Cloud handle account authentication, application data and server processing. Agora handles real-time voice transmission. TikTok, Google or other available sign-in providers process the account authorization you choose. Those providers apply their own privacy policies. Infrastructure may process data outside your country.

Analytics and crash diagnostics

XO Talk uses Google Analytics for Firebase to measure game starts and finishes (game mode, result and duration), virtual coin spending and earnings (amount and feature or source), and microphone mute or unmute changes. These custom events do not include chat text, voice recordings, email addresses or profile names. The Firebase SDK may also process app instance identifiers, device and app information, session activity and approximate location derived from network information. We do not set your email address or player ID as an Analytics user ID.

Firebase Crashlytics collects crash and diagnostic information, such as app version, device and operating system information, stack traces and relevant Analytics breadcrumbs, to help fix defects. The Unity exception bridge excludes exception messages and strips local source paths. Analytics is linked with AdMob for advertising revenue reporting and with Google Play for in-app purchase and subscription revenue reporting when those purchases are available. Virtual coin events represent in-game currency and are not logged as monetary revenue. See Firebase privacy information.

Advertising and rewards

XO Talk uses Google AdMob to show banner ads and optional rewarded ads. The Google Mobile Ads SDK may process advertising identifiers, IP address, device and app information, diagnostics and ad interactions for ad delivery, measurement and fraud prevention, subject to your consent choices where required. Google's User Messaging Platform presents applicable consent messages. When required, you can revisit ad privacy choices in the app's Privacy and account screen. See Google's advertising privacy information.

Rewarded ads are optional. Completing an eligible ad earns 10 virtual coins, at most once every two hours per XO Talk account. A random reward ticket and your player identifier are sent to Google for server-side verification. The server stores the verified transaction identifier, reward time and coin credit to prevent duplicate rewards. Closing an ad before earning its reward does not grant coins. Virtual coins cannot be redeemed for money.

Coin purchases

Google Play handles coin purchases and payment details. XO Talk receives the product identifier, purchase token, purchase state and an obfuscated game-account identifier. The server verifies completed purchases with Google Play before crediting virtual coins, records a hash of the purchase token with the product, quantity, account and delivery status to prevent duplicate credits, and consumes the product after delivery so it can be purchased again. Card information is not handled by the XO Talk server. Google Play determines the displayed local price. Virtual coins cannot be redeemed for money.

Player safety

You can report a player from the chat menu or the voice settings inside a match. Reports contain your account identifier, the reported player identifier, the description you enter, the game and room context where applicable, and app/device diagnostic information. Reports are stored for operator review and are not public. Blocking a player prevents further friend communication. In a match, blocking also turns off incoming voice for that match.

Your choices

You can change your profile, decline microphone permission, leave voice chat and block players. Linking a social account is required before buying coins; otherwise it is optional, but an unlinked guest account may be unrecoverable after the app's local data is removed. To request access, correction or deletion of your XO Talk data, contact the support address below with your player ID. Do not send passwords or login tokens. Records are retained while needed to operate the account; deletion requests may require ownership verification and may have limited retention exceptions for security or applicable obligations.

Contact: carlos.williams@touchstonetelevision.com. See account deletion instructions.