Effective 22 September 2026 · last updated 22 September 2026
1. Who we are
Xfindr is operated by OMNILON (sole proprietorship of Isaac Lelonek), located at 4743 Angie Ct, Powder Springs, GA 30127 (“Xfindr,” “we,” “us,” or “our”).
This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information in connection with xfindr.live and related services. It applies to visitors, registered users, paying customers, individuals appearing in our directory, and people who contact us or submit reports.
For privacy questions or requests, use xfindr.live/privacy/request.
This policy describes our practices; it does not create blanket consent to processing. Where consent or a separate notice is required, we obtain or provide it at the relevant point.
2. Personal information we collect
A. Account and contact information
When you register we store a username, an email address, an account identifier, and the record of which version of our Terms you accepted and when.
Passwords are handled by Amazon Cognito, which holds the credential. Xfindr does not store your password and cannot read it. Where an account is created through Sign in with X, a random password is generated inside Cognito and never shown to anyone.
B. Sign in with X
If you sign in with X, we complete an OAuth 2.0 flow with X using the scopes users.read and tweet.read. From the result we store your X handle, your X user id, your display name, and the email address X supplies, and we mark the handle as verified.
We do not post on your behalf, read your timeline, or request your followers. You can review and revoke the connection in your X account settings.
C. Profile and submitted content
You may supply a display name, an X handle, a biography, an age, gender, ethnicity, sexuality, city, state, country, tags, a profile photograph, and up to five gallery images.
Your profile is public. The fields published are: display name, X handle, biography, gender, age, ethnicity, sexuality, tags, photograph, gallery, like count, and membership emblem. City, state, and country are published as well unless you turn on “hide location” in your profile. Your sign-in username and email address are never published.
Information you choose to publish here may reveal sensitive matters, including aspects of your sex life or sexual orientation. Do not publish information you do not intend to make public.
D. Communications and reports
We process what you send when you contact support, report abuse, appeal a decision, request removal, or make a privacy request, together with the reference we issue for it.
Xfindr has no private messaging feature. There are no direct messages to store or read.
E. Subscription, credit, and transaction information
We store subscription status, the date paid access runs until, credit balances, and the identifiers our payment provider gives us.
Payments are processed by Stripe through Stripe Checkout. Card numbers are entered on Stripe’s own hosted page and are never sent to, seen by, or stored by Xfindr. What we receive and keep is a Stripe customer identifier, a subscription identifier, and the amount and status of a transaction. Stripe processes payment information under its own privacy policy.
F. Device, usage, and technical information
Our servers keep operational logs. These include the IP address of requests that are refused or that touch security-sensitive paths — failed registrations, refused webhooks, refused postbacks, and moderation actions — together with the time and the reason.
We derive no approximate location from your IP address ourselves, and we do not collect precise or device location.
If you press the “use my location” button while editing your profile, your browser contacts ipapi.co directly to look up a city and region from your IP address. That request goes from you to them; Xfindr is not in the middle of it and receives only whatever you then choose to save to your profile. If you never press that button, your browser never contacts them.
G. Age and identity verification
We operate an age gate and require you to confirm that you are eighteen or over. We do not currently use a document-based or biometric age-verification provider, and we do not collect identification documents, facial images, or biometric identifiers.
A confirmation checkbox is a statement of eligibility. It is not proof of age. If age assurance is introduced, this section and the collection notice will be updated before it starts, and any consent that the law requires for that collection will be obtained separately.
H. Public listings about people who never registered
Xfindr publishes directory listings describing public X accounts. A listing may concern somebody who has not registered with Xfindr and has not agreed to anything.
A listing is built from an imported record of a public X account and contains the handle, a display name, a short biography, tags read from that account’s own words, and a link to the profile photograph X is currently serving. The photograph is pointed at, never copied: it is fetched by your browser from X, changes when the account changes it, and disappears when the account is deleted.
Listings are not indexed by search engines, are always marked unclaimed, and always link out to the account they describe.
Anybody listed can have the listing removed. Signing in with X as that handle removes it immediately and needs no Xfindr account; writing to our privacy request form or to info.desk@xfindr.live needs nothing at all.
Public availability does not eliminate applicable privacy rights or authorize unrestricted reuse.
3. How we use personal information
We use the information above to create and administer accounts, authenticate people, publish profiles and listings, run discovery and search, process payments and administer subscriptions and credits, answer support requests and reports, detect and address fraud and abuse, enforce our Terms, keep the service working, and comply with legal obligations.
Ranking. The order profiles appear in is decided by whether a placement was paid for and when, then by signup time. Unclaimed listings are ordered by a fixed hash of the handle. Nothing you read, search, or click affects what you are shown.
Analytics. Xfindr uses no third-party analytics. There is no analytics script, no pixel, and no advertising tag on the site.
Artificial intelligence. No user content or personal information is sent to an AI provider, and nothing here is used to train a model.
We will provide additional notice and obtain consent where required before using information for a materially different purpose.
4. Sensitive information
What you publish on an adult site can reveal sensitive matters, including sexual orientation and sex-life information. The profile fields for gender, sexuality, ethnicity, and tags are all optional; a profile works without any of them.
We process this information to publish the profile you asked us to publish, and for the safety and enforcement purposes described above. We do not use it for advertising, and we do not disclose it to advertisers.
We do not treat registration as explicit consent to processing that legally requires separate, specific consent.
5. Public information and search engines
Profiles and listings are served with noindex, so search engines are asked not to list them. The home page, tag pages, and the terms and privacy pages are indexable; profiles and listings are not.
That is a request to search engines, not a guarantee. Anything published can still be viewed, copied, screenshotted, or archived by people who see it, and removing something from Xfindr does not remove copies held elsewhere.
6. When we disclose information
A. Service providers
These are the providers the service actually uses, and what each one receives:
- Amazon Web Services — hosting, the database that holds accounts, listings and sessions, and the bucket that holds uploaded images. Receives everything the service stores.
- Amazon Cognito (AWS) — usernames, email addresses and passwords for authentication.
- Stripe — payment processing. Receives payment details directly from you; returns identifiers and transaction status to us.
- Cloudflare Turnstile — the challenge on the registration form, to keep automated signups out. Receives the challenge interaction from your browser.
- Zoho Mail — sends support confirmation emails. Receives the address and the message we send.
- X (x.com) — Sign in with X, and the lookup that fills in listing photographs. Your browser also loads listing photographs from
pbs.twimg.com; we send no referrer with those requests. - Google Fonts and cdnjs.cloudflare.com — typefaces and the image-cropping library used on the registration and profile pages. Your browser contacts them directly when a page loads, which discloses your IP address to them.
- ipapi.co — only when you press “use my location,” and only from your browser, as described above.
Providers receive access appropriate to their function. Some, particularly the payment provider, also process information independently for their own legal and fraud-prevention obligations.
B. Other users and public audiences
We disclose information according to your publication choices and the visibility described in Section 2C.
C. Legal compliance and safety
We may disclose information where reasonably necessary and legally permitted to comply with valid legal process, meet mandatory reporting duties, investigate unlawful activity, protect a person from harm, address fraud or security incidents, or establish or defend legal claims.
D. Business transactions
Information may be disclosed in connection with a merger, acquisition, financing, restructuring, bankruptcy, or sale of assets, subject to appropriate protections and applicable notice and consent requirements.
E. At your direction
We may disclose information when you specifically request or authorize it.
7. Sale, advertising, and cross-site tracking
Xfindr does not sell personal information, does not share it for cross-context behavioural advertising, and does not disclose it for targeted advertising. There is no advertising pixel, no tracking tag, and no data broker relationship.
If offer-based promotions are enabled, pressing an offer link sends you to a third-party network with a randomly generated click token that identifies the click and nothing about you. The network then tells us whether that click converted. Your identity, email address, and profile are not sent.
Because we do not sell or share as those terms are defined, there is no opt-out link to provide. If that ever changes, this section and an opt-out will be published before it does.
8. Cookies and similar technologies
Xfindr sets one cookie and uses no tracking technologies.
- Session cookie — essential. It holds your sign-in session and the age confirmation for the visit. It is
HttpOnly,SameSite=Lax, markedSecurein production, and expires after one hour of inactivity. The session record behind it is stored in our database and expires on the same clock.
There are no analytics cookies, advertising cookies, or third-party pixels to consent to or refuse. Because we operate no optional tracking, there is no cookie banner and nothing to opt out of; we honour opt-out preference signals including Global Privacy Control by having nothing for them to disable.
Your browser does load fonts and one JavaScript library from the third parties named in Section 6A, which discloses your IP address to them. They are not used for tracking by us.
Disabling the session cookie will prevent signing in.
9. Retention and deletion
What the system does today:
- Sessions — expire after one hour of inactivity and are deleted automatically.
- Accounts and profiles — kept until the account is closed or deletion is requested.
- Uploaded images — deleted from storage when you remove them or when an account is removed.
- Removed listings — a record that the listing was removed is kept so that a future import cannot bring it back. The listing itself stops being published immediately.
- Support tickets, reports and moderation notes — kept so that a decision can be reviewed and a repeat problem recognised.
- Billing records — kept as required for tax and accounting.
- Operational logs — kept for security and troubleshooting.
[RETENTION PERIODS: SET A SPECIFIC PERIOD OR CRITERION FOR ACCOUNTS, SUPPORT AND MODERATION RECORDS, BILLING RECORDS, LOGS AND BACKUPS.]
We may retain limited information after account closure where necessary to meet legal obligations, prevent fraud or ban evasion, resolve disputes, or preserve evidence. Such retention remains proportionate and lawful. Account termination does not eliminate privacy rights, and a deletion request does not require destruction of information we are legally obliged or entitled to keep; where an exception applies we will say so.
10. Security
Passwords are held by Amazon Cognito and never by us. Traffic is served over HTTPS only. Session cookies are HttpOnly and expire on an idle clock. The application sets a content security policy, and payment card details never reach our servers.
No system can guarantee absolute security. We will respond to personal-information incidents and provide notifications where required by law.
Use a unique password, protect your devices, and report a suspected compromise to info.desk@xfindr.live.
11. Your choices and rights
Depending on where you live and which law applies, you may have the right to know what we process, to get a copy, to correct it, to have it deleted, to receive it in a portable form, to withdraw consent, to object to or restrict processing, to opt out of sale or targeted advertising, to limit uses of sensitive information, to appeal a refusal, and to complain to a regulator.
Make a request at xfindr.live/privacy/request. You do not need an account, and people who appear in the directory without ever registering can use the same form.
We may ask for information reasonably necessary to verify identity or authority, and no more than that. We respond within the deadlines the applicable law sets, and we will not discriminate or retaliate against you for exercising a privacy right.
[PRIVACY RIGHTS APPLICABILITY: CONFIRM WITH COUNSEL WHICH STATE OR NATIONAL PRIVACY LAWS APPLY TO THIS BUSINESS, AND COMPLETE THE CATEGORY, DISCLOSURE AND RETENTION SUMMARIES THOSE LAWS REQUIRE.]
12. Children
Xfindr is for adults of at least eighteen. Minors may not register, use accounts, or submit content.
If we learn that an account belongs to a minor we will restrict it and handle the associated information as the law requires. If you believe a minor is using Xfindr or is depicted in prohibited material, contact info.desk@xfindr.live. Do not attach the material; send the location.
13. Automated moderation and decisions
Two automated checks run without a person: the registration challenge, which decides whether a signup attempt looks automated, and the tag matcher, which reads an imported account’s own words to decide which categories a listing appears under. A prohibited-content filter refuses to list an account whose own words match it.
No account is suspended, banned, or have its content removed automatically. Those decisions are made by a person. Every tag on a listing records the words it was read from, so it can be checked and argued with.
To ask a person to look at an automated outcome, use xfindr.live/report.
14. Where information is processed
Information is stored and processed in the United States, in Amazon Web Services’ us-east-1 region. Our other providers may process information elsewhere under their own terms.
[INTERNATIONAL TRANSFERS: IF USERS IN THE UK OR EEA ARE ACCEPTED, IDENTIFY THE CONTROLLER, THE LEGAL BASES, ANY REQUIRED REPRESENTATIVE, AND THE TRANSFER MECHANISM RELIED ON.]
15. Marketing
We send transactional email only: support confirmations and messages about your account. There is no marketing list, and the optional marketing checkbox at signup is honoured by not sending anything until one exists.
16. Third-party services
Links to third-party websites and platforms are provided for discovery. Those services process information under their own policies. This policy does not govern what you give directly to another service.
17. Changes
We may update this policy. We will update the date and provide additional notice or obtain consent where required. Posting a revised policy does not by itself authorize a materially incompatible new use of information already collected.
18. Contact
- Operator
- OMNILON
- Mailing address
- 4743 Angie Ct, Powder Springs, GA 30127
- Privacy requests
- xfindr.live/privacy/request
- Safety reports
- xfindr.live/report
- Listing removal
- xfindr.live/report
- Intimate-image removal
- xfindr.live/removal