What we keep. What we don’t.

What X Card collects

• Your public X profile. When you confirm your X account we store your X user id, handle, display name and profile photo. That is what your circle sees.
• Your circles. Circle names, who is in them, invitations, and the shared balance address on Robinhood Chain.
• Transactions you submit. Transaction hashes and the wallet addresses involved, so a deposit shows under your name. These are already public on Robinhood Chain.
• Connection details. Your IP address is used for rate limiting while you use the site. It is not kept in our database.

What X Card never touches

• Your X password. Sign-in happens on x.com; we never see it.
• Your posts, direct messages, followers or who you follow. We only ask X for read access to your public profile.
• X access tokens. The token X issues at sign-in is used once to read your profile, then revoked. We do not store it.
• Advertising or analytics trackers. There are none on this site.

Cookies

Two cookies, both HttpOnly: a session cookie that keeps you signed in for 30 days, and a sign-in cookie that lives for 10 minutes while X confirms your account. Signing out deletes the session.

Where your data lives

Data is stored with Cloudflare (Workers and D1) and served over HTTPS. Circle wallet keys are encrypted at rest and never returned by the app.

Removing your data

Message @xcardmoney from the X account you signed in with and we will delete your profile and memberships. Transactions recorded on Robinhood Chain are public and cannot be removed. You can also revoke X Card’s access at any time under Apps and sessions in your X settings.

Independence

X Card is an independent project. It is not affiliated with, endorsed by, or operated by X Corp. or X Money.