Your data

Privacy Policy

Last updated: August 25, 2026

Xwedoc is a digital vault service that lets you create one or more spaces — Family or Organization — to store, organize, and share documents with other people. These documents often include identity papers, birth certificates, medical records, or property deeds: sensitive personal data. This policy explains what data is collected, why, who can access it, how long it is kept, and what rights each person can exercise.

Service publisher: Gouré Bi Bikoré Marc Samuel, sole trader (SIREN 103 719 738), 3 rue des Sources, 91400 Orsay, France. See full details in our legal notice. Data protection contact: xwedoc@gmail.com.

1. Data collected

No data is collected beyond what is necessary for the service to function:

Category	Data concerned
Account	First name, last name, email, phone, country, password (never stored in plain text), optional profile photo, ID document type and number if provided
Space (family or organization)	Space name, city, country, relationship or role of each member
Documents	The file itself (PDF, JPG, PNG), its name, category, an optional description, an optional expiry date
Access log	Who viewed, edited, or shared which document, and when — logged on every plan, viewable on plans that include access history
Security	Last login date, two-factor authentication secret if enabled (encrypted), session tokens

Xwedoc displays no advertising and collects no data for advertising or profiling purposes.

2. Why this data is collected

To create and secure the user account (email, password, two-factor authentication).
To enable storage, organization, and controlled sharing of documents within a space.
To send reminders before a document expires (ID card, passport, residence permit…).
To keep an access history for traceability, on plans that include it.
To enable a transfer of space ownership to another member, initiated by the owner.

3. Who has access to your data

You, and the members of your space to whom you have explicitly granted access to a given document — by default, a document is only visible to the person who added it and the space owner.
The service publisher, technically, for hosting and maintenance — without viewing the content of your documents outside of a strictly necessary technical intervention or a legal obligation.
No commercial third party. Your data is never sold, rented, or shared for advertising purposes.

Temporary sharing by link. An owner can create a share link valid for 24 hours, viewable without a Xwedoc account by anyone with the link. This link can be revoked at any time before it naturally expires.

4. Technical subprocessors

Certain operations are entrusted to technical providers, strictly to the extent necessary for the service:

Hetzner Online GmbH (Germany) — application server hosting.
Cloudflare, Inc. (United States) — storage of uploaded files (Cloudflare R2).
Brevo — sending transactional emails (invitations, password resets).
Anthropic (United States) — analysis of a document when you voluntarily use the smart scanner or the AI assistant.
Stripe (United States) — subscription payments, once activated.
Firebase (Google) and Apple — mobile push notifications.

5. Retention period

Data is kept as long as the account remains active. Deleting an account results in the deletion of data specific to it; documents belonging to a space shared with other members remain subject to that space's ownership rules. The exact retention period after deletion and the fate of backups have yet to be specified.

6. Security measures

What is in place today:

Passwords are hashed (bcrypt) — never stored or viewable in plain text, including by the publisher.
Sessions are authenticated by token (JWT), with automatic expiry.
Two-factor authentication (TOTP) is available on plans that include it.
Each document applies individual per-member access control: no access is granted by default.
Temporary share links expire automatically after 24 hours and can be revoked before their deadline.

In the interest of honesty: files are not yet encrypted at rest in storage, and no automated content check is performed on added files before storage. These are works in progress, not finished guarantees.

7. Your rights

In accordance with applicable regulations (including the GDPR for European Union residents), you have the following rights over your personal data:

Access: obtain a copy of data concerning you.
Rectification: correct inaccurate or incomplete data.
Erasure: request the deletion of your account and the data specific to it.
Portability: retrieve your documents in a reusable format (.zip export, already available on plans that include it).
Objection and restriction of processing, in cases provided for by law.
Complaint to the data protection authority competent for your country of residence (e.g. CNIL in France).

To exercise these rights: xwedoc@gmail.com.

8. International transfers

Xwedoc serves users located in several countries (notably Côte d'Ivoire, France, Canada, Belgium, and the United States), often members of the same family space spread across several continents. Data may therefore be accessed by members located in countries different from the one where it is hosted.

9. Cookies and local storage

This showcase site uses no tracking cookie or advertising tracker. The app uses the device's local storage (localStorage) to keep your login session and certain preferences. Details are available in ourcookie policy.

10. Minors

Xwedoc does not create a standalone user account for a minor. Documents concerning a child are stored by a parent or legal guardian, the account holder, as part of their parental responsibility.

11. Data breach

In the event of a personal data breach likely to result in a risk to the rights and freedoms of the users concerned, the publisher commits to notifying the competent authority and the affected users within the timeframes required by applicable regulations.

12. Changes

This policy may be updated to reflect the actual evolution of the app or legal obligations. Any substantial change will be communicated before it takes effect.