Legal

Privacy Policy

Last updated 12 November 2026

This Privacy Policy explains what personal information X-Ray Index (“we”, “us”), a New Zealand business, collects when you use xrayindex.com and our related services (the “Service”), how we use it, who we share it with, and the choices you have.

1. Information we collect

Account information. Your email address and a password (stored only as a secure hash by our authentication provider). If you sign in with an email link, we only store your email address.

Subscription and billing. Your plan, billing interval, subscription status, renewal and trial dates, and payment references from our payment processors (for example a Stripe customer ID or a NOWPayments invoice and payment ID). We do not receive or store your full card number or your crypto wallet’s private keys.

Preferences and activity in the Service. The assets and signals you choose for email alerts, a record of which alerts we sent you, and referral information (your invite code, who invited you, and bonus time earned).

Technical information. Our hosting provider processes standard request data such as IP address, browser type and the pages requested, to deliver and protect the Service. We don’t use advertising or third-party analytics trackers.

Information you send us. If you email us, we keep the message and your contact details to respond.

2. How we use it

• to create and secure your account and sign you in;
• to provide the dashboard, signals and email alerts you’ve chosen;
• to process payments, manage subscriptions and trials, and send billing and renewal emails;
• to run the referral programme and apply bonus time;
• to prevent fraud and abuse, such as repeated free trials or fake referrals;
• to operate, troubleshoot and improve the Service;
• to comply with legal, tax and accounting obligations.

We don’t sell your personal information, and we don’t send marketing emails unless you have asked to receive them.

3. Cookies and local storage

We use only what the Service needs to work:

• a sign-in cookie (xr_at) and your browser’s local storage to keep you signed in;
• local storage to remember an invite code for up to 30 days when you open a referral link.

We don’t use advertising, tracking or analytics cookies. Payment pages hosted by Stripe or NOWPayments may set their own cookies under their own policies.

4. Who we share it with

We share personal information only with service providers that help us run the Service, under agreements that limit their use of it:

• Supabase: database and user authentication (data hosted in Sydney, Australia);
• Cloudflare: website hosting, content delivery and security;
• Stripe: card payments, subscriptions and the billing portal;
• NOWPayments: crypto payments and invoices;
• Resend: sending account, billing and alert emails.

We may also disclose information if required by law, to protect our rights or users, or as part of a sale or reorganisation of the business, in which case this policy will continue to apply.

5. International transfers

We are based in New Zealand, and our providers store and process data outside New Zealand, including in Australia and the United States. Where we send personal information overseas, we take reasonable steps to make sure the provider protects it in a way that is comparable to the New Zealand Privacy Act 2020, for example through contractual safeguards such as standard contractual clauses.

6. How long we keep it

We keep account and preference data while your account is open. When you close your account we delete or anonymise your personal information within 90 days, except billing and transaction records, which we keep for as long as tax and accounting laws require (generally up to 7 years).

7. Security

We use encryption in transit (HTTPS), hashed passwords, access controls that keep paid market data and your account data on the server side, and signed verification of payment notifications. No system is perfectly secure, so please use a strong, unique password.

8. Your rights

Depending on where you live, you may have the right to access, correct, export or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can update your alert preferences on your account page at any time. For anything else, email [email protected] and we will respond within 20 working days. If you are unhappy with our response, you can complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz, or to the privacy regulator where you live.

9. Children

The Service is not intended for anyone under 18, and we don’t knowingly collect personal information from children.

10. Changes to this policy

We may update this policy. We will post the new version here with a new “Last updated” date and notify subscribers by email of material changes.

11. Contact

Privacy questions or requests: [email protected].