Last updated: October 21, 2026
This policy explains what x/pat collects, why, who it's shared with and the choices you have. Short version: we collect what we need to run a community app, we don't sell your data, and you can export or delete it whenever you like.
x/pat is a mobile app for digital nomads and expats, operated by Xpat LLC ("x/pat", "we", "us"). We are the data controller for the personal data described here.
Xpat LLC, 5900 Balcones Dr, Suite 100, Austin, TX 78731.
Contact for anything privacy-related: hello@xpat.social.
This policy covers the x/pat app for iOS and Android and the website xpat.social.
Automated emails from x/pat, such as sign-in codes and notifications, come from noreply@xpat.social. That address doesn't accept replies; write to hello@xpat.social instead.
| Data | When | Why |
|---|---|---|
| Email address | When you sign up (6-digit email code, Sign in with Apple or Google). x/pat has no passwords | Your account and sign-in; contacting you about your account |
| Date of birth | At sign-up | To check you meet the minimum age. Stored with your account |
| Profile: name, username, photo, bio, tagline, home city, nationality, languages, skills, work type, travel style, countries visited, next destination, status | When you fill it in | Your public profile, shown to other users |
| Your current city ("in town" status) and online / last-seen status | When you set your city and while you use the app | Shown to other users so people in the same city can find each other |
| Precise location | Only if you allow location access | Used on your device to center the map and show what's near you. It is sent to us only as the pin of a spot you add, which you can move before saving. Places you pick on the map (a spot, an event or a neighborhood rating) are saved with that content. We never show other users your device location |
| Content you create: spots, posts, photos, comments, votes, saves, check-ins, events and RSVPs, travel plans, neighborhood ratings, connections | When you post or interact | To run the service. Most of it is visible to other users. A check-in shows signed-in users that you're at that spot for 4 hours |
| Messages in city chats and direct messages | When you send them | To deliver them. City chats are visible to members of that chat |
| Reports, blocks and feedback | When you report, block or send feedback or a survey | Safety, moderation and support |
| Usage data: screens viewed, features used, taps on partner links, app version, device model and OS, approximate location derived from IP address | Only if you turn on usage analytics (off until you do) | Understanding how the app is used so we can improve it. Linked to your user ID, not your email |
| Crash and performance data: error details, device model, OS and app version | Only if you turn on crash reports (off until you do): when something goes wrong, and a sample of normal sessions | Finding and fixing bugs. Not linked to your account |
| Push notification token | If you allow notifications | Sending you notifications |
| Your privacy choices: whether you turned analytics and crash reports on or off, and when | When you choose | Respecting and proving your choice |
We do not collect your contacts or address book, phone number, payment details, health data, audio, or browsing history outside the app. We do not use advertising identifiers, show ads from ad networks, sell your data or share it with data brokers.
Text and photos you post (spots, posts, chat and direct messages, profile photos) are checked automatically for content such as harassment, hate, sexual content, violence or self-harm, using our own filters and OpenAI's moderation service. Content that is flagged may be blocked or hidden, and you will be told why. A person reviews reports and appeals. We do not make decisions with legal or similarly significant effects about you solely by automated means.
We are based in the United States and our providers store data in the USA. If you use x/pat from the EU, UK, Thailand, Mexico or elsewhere, your data is transferred to the USA. We rely on our providers' data processing agreements and the European Commission's Standard Contractual Clauses (or equivalent safeguards) for these transfers. All data is encrypted in transit (TLS).
Depending on where you live (for example under the GDPR, UK GDPR, Thailand's PDPA, Mexico's LFPDPPP or US state laws such as California's CCPA), you may also have the right to object to or restrict processing, withdraw consent, and complain to your data protection authority. Email hello@xpat.social and we will respond within 30 days. If we turn down a request, we'll explain why, and you can reply to ask us to look again.
We don't sell personal data, and we don't share it for targeted (cross-context behavioral) advertising, as those terms are used in US state laws such as California's CCPA and the Texas Data Privacy and Security Act. We don't use advertising IDs or ad networks, and this website sets no cookies or trackers. That includes sensitive data such as precise location, which we use only with your permission and never sell.
Global Privacy Control: because there is no sale or targeted advertising to switch off, we treat every user and visitor as opted out, whether or not your browser or device sends a GPC signal. If that ever changes, we will honor GPC and update this policy first.
x/pat is for adults. You must be at least 18 to create an account. Sign-up asks for your date of birth and blocks anyone under 18. We don't knowingly collect personal data from anyone under 18. If we learn that someone under 18 has an account, we close it and delete their data. If you believe a minor is using x/pat, contact hello@xpat.social.
See also our Child Safety Standards.
We use encryption in transit, access controls and row-level security in our database, and we limit who can access personal data. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
We will post changes here and update the date at the top. For significant changes we will notify you in the app.
Xpat LLC (x/pat) · xpat.social · hello@xpat.social