Last updated: 21 October 2026
CXY is a reading and writing platform. This policy applies when you visit CXY, create an account, read or publish content, or use other account features. Some operational details—such as the service operator’s legal name, configured data retention periods, and hosting region—are not identified in the application code available for this review. We do not state those details as facts here.
1. Information we collect
Account and sign-in information. CXY supports email and password registration and sign-in through Google. For email registration, you provide an email address, a password, and a name. Password authentication is handled through Supabase Auth; the CXY application sends the password to that service for authentication and does not use it as profile content. If you choose Google sign-in, Google and Supabase process the authentication request. The account information made available to CXY can include your account identifier, email address, name, and provider profile details such as a profile image, depending on what the provider returns.
Profile information. You can add a username, display name, biography, profile photo, cover image, website, and social links. Profile photos and cover images are uploaded to Supabase Storage. The application uses public profile fields to render profile pages and writer details.
Content and activity. CXY processes articles you create, including unpublished drafts and published stories, and comments you submit. The application also uses records for bookmarks, follows, likes, notifications, and reading history. In-app notifications are generated for follow activity, likes and comments on published articles. A notification may include the recipient, actor reference, activity type, related article or comment, text, creation time, and read state; an actor reference can become null if that account is deleted. The notification bell periodically checks for unread records and displays an indicator when any exist. Opening the page does not itself mark notifications as read; choosing “Mark as read” updates the stored read state. Database triggers for these events have been installed and verified, but end-to-end delivery has not been confirmed. The administrator dashboard queries article-view records. The exact fields and retention settings for activity records depend on the connected database configuration.
Technical and support information. Supabase and the infrastructure that serves CXY may process information needed to deliver requests, maintain sessions, protect the service, or diagnose errors. The application repository does not specify a complete server-log inventory or retention period. If you email us, we will receive the information and contact details you include in your message.
2. How we use information
Information is used to create and authenticate accounts; maintain profiles; store and display stories, comments, and profile media; provide reading, writing, bookmarking, following, notification, and history features; generate and display follow, like, and comment notifications; administer the service; respond to support and privacy requests; and help protect the service from misuse. Authorized administrators may access account and content information through administrative tools to operate CXY, review policy concerns, remove content or accounts, protect the service, and address legal requirements. We may also use information where needed to comply with applicable legal requirements.
Administrative tools support removal of articles, comments, and non-admin user accounts. Users may contact CXY with reports or concerns, but the application has no in-app reporting tool, moderation log, account suspension control, or defined response time. Information is processed for these purposes only as supported by the service’s actual features and practices.
3. Public and private information
Published articles and comments are intended to be visible to readers. Profile pages display profile information such as username, display name, biography, profile and cover images, website, social links, and published articles. Do not put private information in a public profile, story, comment, or image.
Drafts are loaded for the signed-in author, while bookmarks, reading history, and notifications are account features. Notification queries are scoped to the signed-in recipient, and the configured Supabase policies restrict notification reads, read-state updates, and deletion to that recipient. Direct client insertion is not intended; trusted database triggers generate the follow, like, and comment events. Account email and password are not included in the profile fields selected for public profile pages. The application’s other access controls also depend on the connected Supabase database policies and storage configuration, which should be reviewed separately. Public image URLs may be accessible to anyone who has the URL.
5. Analytics and service activity
CXY uses Google Analytics 4 (GA4), provided by Google, to measure page views when the NEXT_PUBLIC_GA_MEASUREMENT_ID environment variable is configured for a deployment. Page-view events use a normalized route path; profile names and article slugs are replaced with route labels, and query strings and page titles are not sent as page-view parameters. CXY does not send account identifiers, email addresses, passwords, or contact-form contents in the analytics events implemented by the application.
The Google tag may process information about the browser and page visit and may use cookies or similar technologies as part of its analytics service. Google processes that information under its own terms and privacy practices. The repository does not establish Google-side retention periods, processing locations, or a cookie consent control. CXY also has an article_views data source that the administrator dashboard queries, along with other service records such as likes; the exact fields and retention for those records depend on the database implementation.
6. Service providers and sharing
CXY uses Supabase for authentication, database access, and file storage. Google is an authentication provider when you choose Google sign-in. These services process information as needed to provide their part of the service under their own terms and privacy practices. The deployment’s hosting and email delivery providers are not identifiable from the application code reviewed here.
Information may also be disclosed when necessary to respond to a valid legal request, address security or abuse concerns, protect users or the service, or support a transfer or reorganisation of the service. We do not claim that information is never shared. This code review does not confirm any sale of personal information or a complete list of operational disclosures.
7. Advertising plans
Google AdSense is a possible future service. No AdSense script or active integration was found in the code reviewed for this policy, so advertising cookies or AdSense data collection are not described as active CXY practices. If advertising is introduced, this policy and any required choices or notices will be updated before or when the feature is enabled.
8. Retention and account deletion
The repository does not define general retention periods for accounts, content, activity records, logs, or backups. Information may remain while needed to provide the service and for any applicable operational or legal needs; the actual schedule has not been confirmed in the application code.
When the account-deletion operation migration is applied, the public Delete Account page provides a self-service flow that requires a recent Supabase password or Google sign-in and the exact confirmation phrase. It removes account-linked records through the confirmed user foreign-key relationships, keeps published articles with the author detached where the database permits it, and removes drafts. If an author cannot be detached or a draft has comments by other users, the server stops instead of deleting those records.
Profile images and article images that are not referenced by retained stories are removed from the account’s storage folders. Images still used by articles remain available in the public bucket. A service-role-only operation record supports duplicate protection and retry after partial cleanup; its account link is cleared after completion. An interrupted operation may retain this record until it is retried or resolved. Backup handling and any copies retained by third-party services follow their own retention rules.
9. Your choices and privacy requests
You can edit profile details and social links in profile settings, choose what to publish, and sign out. You may ask us to provide access to, correct, or delete information associated with your account by emailing contactcxy@syllox.in. We may need to verify that a request relates to you. The process, scope, and timing of requests depend on the applicable law and the systems holding the information; no fixed response period is specified in the application.
10. Children’s privacy
CXY is not designed specifically for children, and the application code does not establish an age-verification process or an age-specific consent flow. If you believe a child has provided personal information in a way that should not have occurred, contact us so we can review the request.
11. Security
CXY uses Supabase authentication and server-side checks for account access and certain administrative operations. No system can be described as completely secure, and this repository does not establish a security certification or guarantee. Protect your sign-in details and contact us if you believe your account has been accessed without permission.
12. International processing
Supabase, Google, and other infrastructure providers may process information in locations where they or their service providers operate. The configured Supabase region and the hosting provider’s processing locations are not specified in the repository. Contact us if you need details about a particular deployment.
13. Changes to this policy
We may revise this policy as CXY and its data practices change. The “Last updated” date at the top will indicate the latest revision. Where a change requires notice under applicable law, we will provide notice using an appropriate channel.
14. Contact us
For privacy questions or requests, email contactcxy@syllox.in.
The application repository does not identify the legal name or address of the CXY service operator. That operator information should be supplied by the owner where required.