Privacy

What xoxd.ai collects, and what it does not.

This site

xoxd.ai is a static build. It has no server runtime, no database and no user accounts.
This site sets no cookies of its own and runs no tracking pixel. After a page has painted, it loads two telemetry scripts, described below. The footer's disclosed same-origin Cloudflare trace request supplies the visitor details shown on the page.
Your colour mode and theme choice stay in your own browser storage. They are never sent anywhere.
The footer makes a same-origin request to Cloudflare's /cdn-cgi/trace endpoint and displays the exact IP address and country from Cloudflare request metadata. It derives the browser name and major version locally. The component uses no storage, sends no analytics event and makes no third-party location request. Cloudflare receives the ordinary network metadata for the page and trace requests as this site's edge provider.

The first script is the Grafana Faro Web SDK. It records page load timings, script errors and page load traces. With each record it sends the page path, the browser name and version, the operating system, the language, the viewport size, the user agent string and a random session id that lives in this tab only. It does not record what you type, and the site never sets a user identity.
The second script is Cloudflare's Web Analytics beacon. Cloudflare's documentation says it counts page views and visits and measures page load time and Core Web Vitals, grouped by country, page path, referring site, device type, browser and operating system. The same documentation says it does not collect or use personal data and does not track you across sites.
The Grafana script posts its records to rum.xoxd.ai, a receiver on the GloriousFlywheel cluster. The receiver accepts posts from xoxd.ai and glorious.build only and stores the records in the cluster's log and trace stores. The stored record carries no IP address. The Cloudflare beacon loads from static.cloudflareinsights.com and posts its counts to cloudflareinsights.com, a Cloudflare address.
The Grafana records are kept for seven days and then deleted. Cloudflare keeps the Web Analytics counts in its dashboard; its documentation states no retention period for them.
To opt out of both scripts, turn on Global Privacy Control or Do Not Track in your browser. Neither script then loads and nothing is sent.

The enquiry form on the services page collects what you type: the offer you ask about, your organization, what you need, your team size and your email address.
A proof-of-work check runs in your browser before the form sends. It is arithmetic, not a cookie. If the check is unavailable, the form still sends.
A submission goes to forms.xoxd.ai, the intake service on the GloriousFlywheel cluster. The service delivers it as one email to us. The email carries your answers and the network address (IP) the request came from.
It is not added to a mailing list, not shared with anyone else and not used to profile you. The reply comes to the address you gave.

Submissions live in our mailbox. There is no other copy, because there is no database behind this site. Write to [email protected] and we delete yours.