Get Started

Privacy Policy

Last updated: June 5, 2026

This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and the rights you have. We follow privacy best practices aligned with the EU General Data Protection Regulation (GDPR) and similar frameworks worldwide. If anything below is unclear, email us at [email protected].

1. Who we are

X Reset (xreset.org) is a self-help platform for adults who want to quit pornography. We are not a healthcare provider, therapist, or medical service. The service is intended for users aged 18 and over; we do not knowingly collect information from minors.

Contact: [email protected]

2. Information we collect

We collect only what we need to run the service:

  • Account information: name and email address (entered directly or via Google sign-in).
  • Assessment responses: answers to the onboarding quiz, used to personalize your reset and calculate your habit score.
  • DNS activity logs: if you install the X Reset DNS profile on your device, our DNS proxy resolves every domain your device looks up while the profile is active — this is how DNS resolution works at the operating-system level and cannot be partial. Domains that match our adult-content blocklist trigger a relapse event tied to your pact; all other domains are processed without being attributed to your identity in our audit logs (the in-memory stream that drives relapse detection retains them only long enough for the consumer to act, then they are discarded). We never sell, share, or use this data for advertising or profiling. You can uninstall the profile at any time to stop all DNS logging — see /uninstall.
  • Payment details: if you opt into the financial self-binding pact, payment information is collected and stored by Stripe. We never see or store your card number.
  • Technical data: IP address, browser, device, and pages viewed. Used to operate the site, detect abuse, and (with your consent) understand usage patterns.

3. Why we collect it (purpose)

Each category is used only for the purpose it was collected:

  • To create and maintain your account.
  • To display your daily progress, streak, and reset status.
  • To process payments under the financial pact you opted into.
  • To send transactional emails about your account and progress.
  • To detect abuse, debug issues, and keep the service secure.
  • With your analytics consent, to measure how the site is used so we can improve it.

We do not sell your personal information. We do not use it to build advertising profiles.

4. Sensitivity of the data

We recognise that information about pornography use, recovery, and related habits is sensitive. We are a self-help service, not a healthcare provider, so this is not "health data" in the regulated sense — but we treat it with stronger-than-default safeguards anyway: encrypted in transit and at rest, strict internal access, and no use for advertising or profiling.

5. Who we share it with (third parties)

We use a small number of trusted providers to operate the service. Each receives only the data they need:

  • Stripe — payment processing for the optional financial pact.
  • Google (Sign-In) — if you choose to log in with Google.
  • Google reCAPTCHA — bot detection on forms.
  • Inspectlet — session replay (mouse moves, clicks, and pages visited) used to debug UX issues. Inspectlet only runs if you accept analytics cookies.
  • Hosting and email infrastructure providers — to deliver the service and account emails.

We do not share your data with anyone else except where required by law.

6. Cross-border data transfer

Some of the providers above (including Stripe, Google, and Inspectlet) process data in the United States and other countries. We rely on the contractual data-protection commitments in our agreements with each provider — including Standard Contractual Clauses where applicable — to ensure your information receives protection comparable to your home country's laws.

7. Data security

We use TLS encryption in transit, encryption at rest for sensitive fields, hardened cloud infrastructure, access controls, and audit logging. Only authorised personnel can access production systems and only for maintenance and debugging.

8. How long we keep it

We keep personal information only for as long as we need it for the purposes above. When you delete your account, your personal data and DNS logs are permanently removed from our active systems within 30 days. Limited transactional records (e.g. invoices) may be retained where required by tax or accounting law.

9. Your rights

You have the right to:

  • Access the personal information we hold about you.
  • Request correction if anything is wrong.
  • Withdraw consent for optional processing (e.g. analytics cookies) at any time.
  • Delete your account and associated data.
  • Object or restrict certain processing of your data.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

11. Privacy breaches

If a serious privacy breach occurs, we will notify affected users as soon as practicable and any relevant regulatory authority where required by law.

12. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the "Last updated" date at the top. Continued use of the service after updates means you accept the new policy.

13. Contact

For any privacy question, email us at [email protected]. If you are based in a jurisdiction with a data protection authority (e.g. EU/EEA, UK), you may also lodge a complaint with your local regulator.

Your trust is core to what we're building. If anything here needs to change, tell us.