Privacy Policy

This Privacy Policy explains how XRadar, Inc. (“XRadar,” “we,” “us,” or “our”) collects, uses, shares, and safeguards information when you use the XRadar mobile application and related services (collectively, the “Service”).

By accessing or using the Service, you acknowledge and agree to the practices described in this Privacy Policy.

1. Information We Collect

A. Information You Provide

We collect limited information you voluntarily provide, including:

• Email address (used for authentication and account access if you choose to sign in)
• Authentication credentials via:
  • Email-based password-less login
  • Google Sign-In
  • Sign in with Apple

We do not require users to provide their name.

Signing in is optional for most features. When you do not sign in, XRadar identifies you by a device identifier (see §1.B).

B. Information Collected Automatically

When you use the Service, we may automatically collect:

• Device information (device type, operating system, app version)
• A persistent device identifier generated when the app is first launched, which may survive reinstalling the app, used to recognize your device, secure the Service, enforce usage limits, and analyze usage
• Usage data (feature interactions, timestamps, navigation flows)
• Precise location data while the app is open, to support real-time transit features and directions; and, while a turn-by-turn navigation session you have started is active, in the background until you end the route or close the app

When you start turn-by-turn navigation, XRadar continues to receive your location in the background so that directions keep updating while your screen is off or you switch apps. Background collection stops when you end the route or close the app. You can withdraw location access at any time in your device settings; doing so disables navigation and live-arrival features.

C. Former XRadar+ Subscribers

XRadar previously offered a paid subscription, XRadar+, billed through Stripe. XRadar+ is no longer offered and no subscription renews or is charged. XRadar never stored full payment card numbers. For former subscribers we retain limited billing records received from Stripe — subscription status, billing history, purchase and cancellation timestamps, and billing region and currency — for as long as needed for accounting, tax, and dispute purposes, after which they are deleted.

D. Service Providers, Analytics & Diagnostics

We rely on the following third parties to operate the Service. Each processes data under its own privacy policy.

• Supabase and Amazon Web Services — hosting, database, and file storage
• Google Maps Platform — maps and directions (both apps)
• OneSignal — push notification delivery (iOS). Class-alert notifications include the course names you have entered.
• Mixpanel — product analytics (iOS only)
• Statsig — feature flags and experimentation (iOS)
• Sentry - crash reporting and error diagnostics
• Apple and Google — sign-in, when you choose those methods
• OpenAI and Sightengine — Marketplace content moderation (see §1.E)
• Stripe — legacy billing records for former XRadar+ subscribers only

E. Marketplace & Community Board Data

When you create a post on the XRadar Marketplace & Community Board, we collect the following information:

• Post content, including title, description, and category selection
• Images uploaded as part of a post
• Pricing information (if applicable)
• Event date and time (if applicable)
• Campus location tag (if provided)
• Preferred contact method (e.g., iMessage, Instagram, email)

Images are uploaded to and stored on XRadar’s servers. Posts are publicly visible to all authenticated XRadar users.

XRadar uses automated content screening, including third-party artificial intelligence services, on Marketplace posts. Screening is designed to run before a post is published, but XRadar does not guarantee that every post is screened or that screening detects every violation. These systems analyze content to detect potentially prohibited material, including but not limited to drugs, weapons, alcohol, nudity, sexual content, hate speech, harassment, threats, and personally identifiable information. The categories screened for are described in our Terms of Service.

Post content (text and images) may be transmitted to the following third-party services for content moderation purposes:

• OpenAI (text moderation)
• Sightengine (image moderation)

These third-party processors operate under their own privacy policies. XRadar transmits only the minimum data necessary for content screening and does not share user account information with these services.

XRadar stores your preferred contact method to display on your Marketplace posts but does not transmit messages on behalf of users and does not facilitate or monitor communications between users.

2. How We Use Information

We use collected information to:

• Provide, operate, and maintain the Service
• Authenticate users and manage accounts
• Provide walking and turn-by-turn directions
• Deliver merchant discounts and enforce per-user and per-business redemption limits
• Send class schedule alerts you set up
• Deliver real-time transportation features
• Send optional push notifications
• Improve functionality, performance, and reliability
• Conduct internal analytics and product optimization
• Measure engagement with sponsored content and offers
• Generate business insights and reporting
• Comply with legal and regulatory obligations
• Process, screen, and publish Marketplace posts
• Detect and prevent prohibited, fraudulent, or harmful content on the Marketplace
• Retain Marketplace posts for platform integrity, moderation, and analytics
• Facilitate user-to-user discovery through public Marketplace postings

3. Anonymous & Aggregated Data

XRadar may generate and use fully anonymized and aggregated data derived from user activity, including offer and redemption-related trends.

How this data is handled:

• Data is aggregated across groups of users
• All direct and indirect identifiers are removed
• Data cannot reasonably be used to identify any individual
• Aggregation thresholds are applied to prevent re-identification

How this data is shared:

XRadar may share anonymous, aggregated insights with business partners (such as participating merchants), including metrics such as:

• Total redemptions
• Conversion rates
• Time-of-day or day-of-week trends
• General usage patterns

Businesses never receive user-level data, personal data, email addresses, or device identifiers.

4. Personalized Features

Users may choose to favorite routes or customize app preferences.

• Favorite routes are stored locally on your device and are not sent to XRadar.
• Your selected campus and transit agency, and whether you have granted location permission, are stored on XRadar’s servers and associated with your device identifier (and your account, if signed in) so they persist across sessions and devices.

5. Advertising & Sponsored Content

XRadar may display sponsored listings or promotional content within the Discover tab or other areas of the Service.

• XRadar does not sell personal data
• Sponsored content is displayed contextually
• Advertising partners do not receive user-level personal information

6. Push Notifications

Push notifications are optional and can be enabled or disabled at any time through device settings.

Notifications may include:

• Bus arrival alerts
• Class schedule alerts, if you add your schedule
• Service updates
• App-related announcements

Notifications are delivered through OneSignal. Class alerts include the course names you entered; this content is transmitted to OneSignal in order to send the notification.

XRadar does not send third-party marketing notifications without user consent.

7. Data Sharing & Disclosure

We may share information in the following limited circumstances:

• With service providers who help operate the Service (hosting and database infrastructure, maps, push notifications, analytics, crash reporting, feature flags, and legacy billing records), listed in §1.D
• With business partners, but only in anonymous and aggregated form
• With third-party content moderation services (OpenAI, Sightengine) to screen Marketplace posts for prohibited content. Only post text and images are shared; no user account data is transmitted
• For legal compliance or to respond to lawful requests
• To protect rights, safety, or security
• In connection with a corporate transaction (e.g., merger or acquisition)

XRadar does not sell personal information.

8. Data Retention

We retain personal data only as long as necessary to:

• Provide the Service
• Meet legal and regulatory requirements
• Resolve disputes

De-identified and aggregated data may be retained indefinitely for analytics, reporting, and business intelligence purposes, even if a user deletes their account.

Marketplace Data Retention

Marketplace posts are visible to signed-in users until they expire, are deleted by the poster, or are removed by XRadar. Each post is given an expiry date when it is published; XRadar may change the default posting period from time to time. Expired and removed posts are retained by XRadar for platform integrity, moderation, analytics, legal compliance, and dispute resolution purposes.

Posts that are rejected by automated content screening are stored separately for administrative review and platform safety purposes and are retained only as long as needed for those purposes.

Users may delete their own Marketplace posts at any time while the post is live. Upon deletion, the post is removed from public view and marked as deleted. See §9.C for what deletion removes.

9. Your Rights & Choices

Depending on your location, you may have rights regarding your personal data. XRadar is committed to honoring these rights in accordance with applicable law.

A. General Rights

All users may:

• Access, correct, or request deletion of personal data
• Withdraw consent for optional features (such as push notifications or location access)
• Opt out of certain analytics where applicable
• Delete individual Marketplace posts at any time

California residents may exercise rights under the California Consumer Privacy Act as amended by the CPRA, including the right to know what personal data is collected and how long it is retained, the right to correct or delete it, the right to opt out of the sale or sharing of personal data, the right to limit the use of sensitive personal information such as precise geolocation, and the right not to be discriminated against for exercising these rights. XRadar does not sell or share personal information for cross-context behavioral advertising.

B. Your Data Rights (EEA/UK Users)

Users located in the European Economic Area or the United Kingdom have the following rights under the General Data Protection Regulation (GDPR):

• The right to access personal data we hold about you
• The right to rectification of inaccurate or incomplete personal data
• The right to erasure (“right to be forgotten”) of your personal data
• The right to restrict processing of your personal data
• The right to object to processing of your personal data
• The right to data portability (receiving your data in a structured, commonly used format)

C. Account Deletion

You may request deletion of your account at any time using the account deletion feature in the XRadar app settings or by emailing info@thexradar.com.

Upon a verified deletion request, XRadar will, within thirty (30) days:

• Delete your account information and authentication records, and revoke your Sign in with Apple token if you used it
• Remove your Marketplace posts from public view and mark them as deleted
• Delete the text, contact details, and images of your Marketplace posts from XRadar’s active storage
• Delete post report records associated with your account

XRadar does not currently send deletion requests to its third-party service providers on your behalf. Data those providers hold (for example, crash reports at Sentry or analytics events at Mixpanel) is retained and deleted under their own policies. You may contact them directly, or ask us for help doing so.

Certain data may be retained beyond the 30-day period where required by law, to comply with legal obligations, or for the establishment, exercise, or defense of legal claims. De-identified and aggregated data that cannot reasonably be used to identify you may be retained indefinitely for analytics and reporting purposes.

D. Exercising Your Rights

To exercise any of the rights described above, contact us at:

Email: info@thexradar.com

We will respond to verified requests within thirty (30) days. We may request additional information to verify your identity before processing your request. There is no fee for exercising your data rights unless requests are manifestly unfounded or excessive.

10. Data Security

We use reasonable administrative, technical, and physical safeguards to protect information.

No system is completely secure, and we cannot guarantee absolute security.

11. Children's Privacy

XRadar is not intended for children under 13 years of age. The Marketplace & Community Board, which publishes your photos, campus, and chosen contact method to other users, is available only to users who are at least 18 years old.

We do not knowingly collect personal information from children under 13, and we do not knowingly publish Marketplace posts from users under 18. If you believe we have, contact info@thexradar.com and we will remove it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated through the Service or our website. Continued use of the Service constitutes acceptance of the revised policy.