Privacy policy

1. About the app and its operator

XCosmo is an app for working with network configurations on Android and Windows. It imports your subscription or configuration, connects to the selected server, and applies rules for websites and apps. Only traffic specified by your settings passes through that server; other connections may go directly or be blocked.

The app and its data processing are operated by Individual Entrepreneur Vitaliy Vyacheslavovich Racheev (the “XCosmo Administration”). For questions about data processing and deletion, contact racheev.dev@gmail.com.

This policy applies to the XCosmo app and the xcosmo.app website. Subscriptions may be provided by the XCosmo Administration or partner providers. The providers of your subscription, selected server, and external services may have their own data processing terms.

2. Data required for operation

XCosmo processes the following information depending on the feature you use.

Device and access

The device identifier (HWID), the subscription domain and its technical hash, platform, architecture, operating system information, and app version and build. XCosmo servers use this information to register the device, check access, link authorized subscriptions, and deliver settings and updates. On Android, the identifier is usually based on Android ID; on Windows, it is based on system identifiers. Fallback values are also provided. The identifier is not anonymous and does not necessarily change after reinstallation.

Subscription

During import and updates, the provider receives the full request URL, including any access key in the link, the app version, language, and information about the operating system and device model. The device identifier is sent when sending it is enabled or when the subscription parameters require it. XCosmo management servers receive the subscription domain, not its full private URL, in the registration request. When an authorized address change or a fallback address is used, the request is sent to the corresponding subscription server.

Subscription service account

If you follow a link from the app to the XCosmo Administration's subscription service website, your email is used for registration and sign-in with a one-time code. Pressing Start in its Telegram bot creates a user profile for that service. This is not registration on the informational xcosmo.app website. You can request deletion of your subscription service website account or bot profile and associated data using the instructions in section 5. Accounts created with independent providers are subject to their policies.

Technical events

XCosmo servers receive information about registration and access checks, connection status, receipt and execution of service commands, as well as the identifier, time, and status of delivery, display, and clicks for service notifications. This information is linked to the device and used to operate features, diagnose issues, and monitor delivery. Communication may continue in the background, and queued events may be sent after network access is restored.

Connection

The app processes network packets, destination addresses, and available domain names to apply rules. Selected servers, domain name resolution services, and availability-check endpoints receive the requests relevant to them. They see the source IP address determined by the route. Access to content depends on encryption and configuration. The client does not send the full packet stream or a complete browsing history to XCosmo management servers; this does not mean that parties involved in the connection keep no technical logs.

App list

On Android, app names, icons, and package names are read on the device to select routes for individual apps. The app does not send the full list to XCosmo management servers. The package names of individual selected apps may appear in local logs and in a report you choose to share.

Camera, images, and clipboard

QR codes are recognized on the device. The app does not upload original camera frames or the selected image to XCosmo servers; audio recording is not used for scanning. If a code contains a subscription link, importing it sends a request to the provider. Clipboard text is used when you choose to paste or import it.

Support requests and reports

When you contact support, the XCosmo Administration receives your email address, message, and any attachments you send. A report is generated at your request and may contain the device identifier, versions, IP addresses, domains, and diagnostic messages. You choose the recipient. Review the report before sending it; do not publish secret links, keys, or passwords.

3. Who receives the data

Data is received by the XCosmo Administration and the infrastructure that supports the app: hosting services, nodes that deliver settings and update files, fallback network endpoints, and the support email service. Delivery nodes may process network metadata, the subscription domain, and authorization data for service requests; their involvement is not limited to downloading publicly available files.

Other recipients include the selected subscription provider, connection server operators, domain name resolution services, and availability-check services. The recipients depend on your configuration and authorized service endpoints. Support data is also processed by Google's email infrastructure when you send a message to the Gmail address provided.

The XCosmo management server is hosted in the Netherlands. This does not mean that all connection servers, infrastructure nodes, and email services are located in that country. Services you select and infrastructure services may process data in other countries.

When you follow a link to an external website or Telegram, that service's terms apply. Some links in the app allow you to purchase a subscription; purchase information is received by the seller and the payment service it uses. This policy does not replace their policies. XCosmo does not promise identical retention periods or protection measures across all providers.

4. Storage and protection

Subscriptions, configurations, settings, local logs, queues, and technical data are saved in the app's storage on your device. Local recovery copies may also exist. Android system backup of app data is disabled.

Protected operating system facilities are used for certain secrets. This does not mean that every file, subscription, or log is additionally encrypted by the app itself. Do not give others access to your device, backups, or private links.

Subscription requests and communication with XCosmo management servers use HTTPS with certificate validation. This rule should not be extended to all user traffic: protection of connections to selected servers and destination websites depends on the protocol and settings.

No fixed automatic deletion period is configured for server-side device records, domain history, technical events, or logs. They may remain after you stop using the app until they are manually deleted. The request procedure is described below. Retention periods at independent providers are governed by their terms.

5. How to delete your account and data

Email racheev.dev@gmail.com with the subject “XCosmo account and data deletion”. State what you want deleted: your account on the XCosmo Administration's subscription service website, your profile in its Telegram bot and associated data, and/or your device data. You may request deletion of device data without deleting your service account.

For a website account, provide your registration email and send your request from it if possible. For a bot profile, provide the bot's name and your username or profile identifier, if available. For device data, provide the identifier from XCosmo settings, if available. If you no longer have access to the app or account, explain the situation; support will agree on a way to verify your request. You do not need to reinstall the app to make a request. Do not send passwords, one-time sign-in codes, full private subscription URLs, or access keys.

After verifying that the request relates to your account, profile, or device, the XCosmo Administration will carry out the requested deletion within 30 calendar days. Deleting a website account or bot profile also deletes its associated user data in services operated by the XCosmo Administration. Device data is deleted from the live database of XCosmo management servers. If applicable law requires a shorter period, that period applies. If some information must be retained by law, the XCosmo Administration will explain the reason, scope, and duration of that retention.

Deleting a bot profile affects only the XCosmo Administration's service: it does not delete your Telegram account. To delete an account and data held by an independent provider, contact that provider.

Requests are processed manually: sending an email does not mean immediate deletion. Deleting a server-side record may require the device to register again the next time you use the app. If you continue using XCosmo, the app may transmit new information.

Deleting a subscription, clearing local logs, or uninstalling the app does not automatically delete data from servers. On Android, you can use the system option to clear the app's data. Deleting local data does not cancel your subscription with its provider.

Contacting XCosmo does not automatically delete records held by an independent provider, email service, or another recipient. Deletion from the live database is also not a promise that all technical copies outside that database will be deleted. In your request, specify separately if your concern involves a support email, a report you sent, or data on a subscription server operated by the XCosmo Administration.

6. Your choices and requests

In the Android app, a separate explanation of data processing and how the connection works is shown before the relevant network features start. Consent requires an explicit action and is saved on the device; Android system permission is requested separately. Simply opening the website does not constitute this consent.

You can turn off the connection, startup launch, and automatic actions, decline camera access, change permissions in system settings, and choose not to send diagnostic reports. Blocking the display of system notifications does not disable service communication with XCosmo servers. Disconnecting a connection also does not stop subscription updates or other enabled network features of the app.

To stop processing associated with further use of the app, stop the connection and automatic background actions, and stop using the app. To delete information already transmitted, submit a separate request. Uninstalling the app does not itself constitute such a request.

You can use the email address provided to request information about the processing of your data, its correction or deletion, to object, or to withdraw consent where consent is the basis for processing. Whether a request can be fulfilled, and any permitted limitations, are determined by applicable law. If necessary, the XCosmo Administration will request further information to verify your request; you may also contact the competent data protection authority.

The app is intended for users aged 16 and over and does not automatically verify age. If local law requires the involvement of a legal representative for a minor to use the service or for their data to be processed, that requirement must be followed. You can contact support with questions about a minor's data.

7. Visiting the website

The xcosmo.app website consists of static pages and does not contain advertising trackers, analytics scripts, registration forms, or its own tracking cookies. Fonts and styling are loaded without contacting external font services. The page language is selected from your browser settings. A manual language choice is passed in the page URL; the website does not save it in cookies or browser storage.

When you visit the website, the web server receives your IP address, the time, the requested path, and technical HTTP headers, such as browser information. This information may be stored in access and error logs for website maintenance and diagnostics. The absence of cookies does not mean the absence of server logs. The contact dialog displays the support email address and lets you copy it. The “Open email app” button opens your selected email service; the website does not send an email automatically.

8. Changes to this policy

The current English version is published at https://xcosmo.app/privacy-en. When the document changes, its date and version number are updated on the page. A material change in processing that requires new consent is not considered accepted merely because the text has been published: the app must separately request the relevant consent.

Version dated 7 September 2026. After publication on the official website, this document applies to the processing described when using the app version to which it corresponds. Questions about this document: racheev.dev@gmail.com.