Privacy Policy

1. Who we are

X Reset (xreset.org) is a self-help platform for adults who want to quit pornography. We are not a healthcare provider, therapist, or medical service. The service is intended for users aged 18 and over; we do not knowingly collect information from minors.

Contact: [email protected]

2. Information we collect

We collect only what we need to run the service:

• Account information: name and email address (entered directly or via Google sign-in).
• Assessment responses: answers to the onboarding quiz, used to personalize your reset and calculate your habit score.
• DNS activity logs: if you install the X Reset DNS profile on your device, our resolver sees every domain your device looks up while the profile is active — this is how DNS works at the operating-system level and cannot be partial. But the match happens inside the resolver, and only a hit is kept: a domain on our adult-content blocklist triggers a relapse event tied to your pact, and we record that domain and the time it happened. Every other domain — your everyday browsing — has its name stripped inside the resolver before anything is written, so it is never stored against you. We do not build a browsing history from your DNS activity; there is nothing to sell, share, or profile. Because this information can reveal intimate details of your life, we treat it as sensitive and process it only with your explicit consent, given when you install the profile. You can uninstall the profile at any time to stop all DNS processing — see /uninstall.
• Payment details: if you opt into the financial self-binding pact, payment information is collected and stored by Stripe. We never see or store your card number.
• Technical data: IP address, browser, device, and pages viewed. Used to operate the site, detect abuse, and (with your consent) understand usage patterns.

3. Why we collect it (purpose)

Each category is used only for the purpose it was collected:

• To create and maintain your account.
• To display your daily progress, streak, and reset status.
• To process payments under the financial pact you opted into.
• To send transactional emails about your account and progress.
• To detect abuse, debug issues, and keep the service secure.
• With your analytics consent, to measure how the site is used so we can improve it.

We do not sell your personal information. We do not use it to build advertising profiles.

4. Sensitivity of the data

We recognise that information about pornography use, recovery, and related habits is sensitive. We are a self-help service, not a healthcare provider, so this is not "health data" in the regulated sense — but we treat it with stronger-than-default safeguards anyway: encrypted in transit and at rest, strict internal access, and no use for advertising or profiling.

5. Who we share it with (third parties)

We use a small number of trusted providers to operate the service. Each receives only the data they need:

• Stripe: payment processing for the optional financial pact.
• Google (Sign-In): if you choose to log in with Google.
• PostHog: product analytics and session replay (mouse moves, clicks, and pages visited, including pages inside your account) used to understand where the product is confusing and fix it. We do not record the assessment, and your DNS hostname is masked out of recordings. PostHog only runs if you accept analytics cookies.
• Google Analytics: aggregate measurement of which pages people visit and where they leave, so we can fix the parts of the site that lose people. It receives page addresses and general device and country information, never your email address or anything you answered in the assessment. Google Analytics only runs if you accept analytics cookies.
• Google Ads: measures whether an ad we paid for led to a sign-up, so we know which ads are worth running. It runs under the same analytics choice as above, and we do not enable ad personalisation, so it is not used to build an advertising profile of you.
• Meta (Facebook and Instagram) Pixel: measures whether an ad we paid for on Facebook or Instagram led to a sign-up or a completed setup, for the same reason. It receives page addresses and general device information, never your email address or anything you answered in the assessment. It only runs if you accept analytics cookies, and we do not upload customer lists or hashed contact details to Meta.
• Hosting and email infrastructure providers: to deliver the service and account emails.

We do not share your data with anyone else except where required by law.

6. Cross-border data transfer

Some of the providers above (including Stripe, Google, Meta, and PostHog) process data in the United States and other countries. We rely on the contractual data-protection commitments in our agreements with each provider — including Standard Contractual Clauses where applicable — to ensure your information receives protection comparable to your home country's laws.

7. Data security

We use TLS encryption in transit, encryption at rest for sensitive fields, hardened cloud infrastructure, access controls, and audit logging. Only authorised personnel can access production systems and only for maintenance and debugging.

8. How long we keep it

We keep personal information only for as long as we need it for the purposes above. When you delete your account, your personal data and DNS logs are permanently removed from our active systems within 30 days. Limited transactional records (e.g. invoices) may be retained where required by tax or accounting law.

9. Your rights

You have the right to:

• Access the personal information we hold about you.
• Request correction if anything is wrong.
• Withdraw consent for optional processing (e.g. analytics cookies) at any time.
• Delete your account and associated data.
• Object or restrict certain processing of your data.

To exercise any of these rights, email [email protected]. We will respond within 30 days.

10. Cookies and tracking

We use two categories of cookies:

• Essential cookies: to maintain your login session, remember preferences, and provide CSRF protection. These are required for the site to function and cannot be turned off.
• Analytics cookies: used by PostHog (product analytics and session replay), Google Analytics (which pages people visit and where they leave), Google Ads, and the Meta Pixel (whether an ad led to a sign-up) to help us understand how the site and the product are used and fix UX issues.

How analytics cookies are handled depends on where you are:

• In the EU/EEA, the UK, and Switzerland, they load only after you opt in through the cookie banner.
• Elsewhere (for example Brazil, Australia, and New Zealand), they load by default on the basis of our legitimate interest in improving the service, and you can opt out at any time.

To opt out or change your choice at any time, use the “Cookie settings” link in the site footer. You can also clear the xreset_cookie_consent cookie in your browser.

11. Privacy breaches

If a serious privacy breach occurs, we will notify affected users as soon as practicable and any relevant regulatory authority where required by law.

12. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the "Last updated" date at the top. Continued use of the service after updates means you accept the new policy.

13. Contact

For any privacy question, email us at [email protected]. If you are based in a jurisdiction with a data protection authority (e.g. EU/EEA, UK), you may also lodge a complaint with your local regulator.