This Privacy Policy explains how Xenora ("we", "us") collects, uses, shares and protects your information when you use:
- Xenora E-sports: the player app (
com.xenora.esports)
- Xenora Studio: the app for group owners and tournament managers (
com.xenora.studio)
- our website xenora-esports.in
together called the "Services". Both apps use the same Xenora account and the same wallet, so this one policy covers both.
By using the Services you agree to this policy. If you do not agree, please do not use the Services.
In short
- We do not sell your personal information.
- We do not collect your location, contacts, SMS, card numbers, Aadhaar or PAN.
- Saved UPI and bank details are stored encrypted.
- You can delete your account in the app or at xenora-esports.in/delete-account.
1Who can use the Services
The Services are only for people aged 18 years and above. We do not knowingly collect information from anyone under 18. If we learn that a user is under 18, we delete their data and suspend the account. Parents or guardians can contact info@xenora-esports.in.
2Information we collect
A. Account and profile
- Username, email address and password (we store only a bcrypt hash, never the password itself)
- If you use "Continue with Google": your Google account ID, name and email
- Phone number (optional; required when you apply to become a manager). We verify it with a one-time code sent by SMS.
- Profile photo and bio, if you add them
- Last login and last seen time
B. Games and tournaments
- Free Fire name and Free Fire ID
- Friends list
- Tournaments you join, your results and rankings
- XP, badges and rewards
C. Wallet and payments
- Wallet balances and transaction history
- Deposits: the amount, the UTR / transaction reference (optional), the payment screenshot you upload, and the IP address used
- Withdrawals: the amount, fee, status and the UPI or bank account you choose
- Saved payment methods: UPI ID and name, or bank name, account holder name, account number, IFSC and branch. These are stored encrypted (AES-256).
We do not collect card numbers, Aadhaar, PAN or date of birth. We do not process payments inside the app: you pay from your own UPI app, and our team checks each deposit by hand.
D. Xenora Studio (managers and group owners)
- Group name, description, logo and Group ID
- Group members and when they joined or left
- Announcements you send to your group
- Your manager application note
- Your manager rating, score, tier and strikes
- Reviews and reports about tournaments and managers
- Tournaments you create: mode, map, entry, prize split, schedule, room details and results
E. Feedback
- Your message, the category you pick, an optional screenshot, and your app version
F. Device and technical data
- Device ID: we never send or store your raw Android ID. The app sends a one-way hash of it, which we use to stop duplicate and fraudulent accounts.
- Push notification token (Firebase Cloud Messaging) and your platform (Android)
- App version, recorded once per day
- IP addresses: logged for deposits, OTP requests, account activity, website sessions and our admin audit log, as well as normal server logs
- Crash reports: both apps use Firebase Crashlytics. If an app crashes, it sends technical details (device model, Android version, app version and the error) so we can fix it.
We do not collect your location, contacts or SMS messages. For OTP autofill, the apps use Google's SMS User Consent API: you see the single message and choose whether to share the code.
G. App permissions
- Internet and network state: to connect to our servers
- Notifications: to send you tournament, wallet and account alerts
- Camera and photos: only when you choose to take or pick a picture, such as a profile photo, a payment screenshot or a feedback screenshot
3How we use your information
- To create your account, log you in and keep it secure
- To run groups, tournaments, results, rankings, rewards, manager scores, tiers and reviews
- To handle deposits, withdrawals, "Send coins" transfers and manager earnings
- To verify your email and phone number
- To prevent fraud, cheating, duplicate accounts and misuse
- To send OTPs, receipts and alerts about tournaments, your wallet, your group and your account
- To reply to your feedback and support requests
- To fix crashes and improve the Services
- To follow the law and enforce our Terms & Conditions
4Who can see your information
- Any logged-in user can see a group's public profile: its name, Group ID, description, logo, member count, the owner's username and photo, rating, tier and rank. They can also see reviews (reviewer names are partly hidden) and the manager leaderboard.
- Members of a group can see that group's announcements.
- A group's owner or manager can see:
- their member list (username and join date)
- full reviewer names on their reviews
- their own earnings and analytics
- the Free Fire name and ID of players registered in their own tournaments
- Managers never see a player's email, phone number or wallet.
- Other players can see public details such as your username, profile photo, level, badges and leaderboard rank.
- Xenora admins can see all data, so that they can run and protect the Services.
5Who we share information with
We do not sell your personal information. We share data only with services that help us run Xenora:
| Service | What it receives | Why |
|---|
| Hostinger (VPS, Kuala Lumpur, Malaysia) | All data stored by the Services | Server and database hosting |
| Our own email server | Your email address, OTPs, receipts | Sending emails |
| Renflair | Your phone number and the OTP | Sending SMS verification codes |
| Firebase Cloud Messaging (Google) | Push token and notification text | Sending notifications |
| Firebase Crashlytics (Google) | Crash and device details | Fixing app crashes |
| Google Sign-In | Your Google ID, name and email | Logging in with Google |
| Telegram | Internal alerts to our team (may include user ID, username and amount). Public posts on the Xenora channel (tournament posts and result images with player and team names) | Running the Services and announcing results |
We may also share data:
- when the law, a court or a government authority requires it
- to protect our users, our rights or the Services from fraud or abuse
- if Xenora is merged, sold or restructured. We will tell you if this happens.
6Where your data is stored
Your data is stored on servers in Kuala Lumpur, Malaysia (Hostinger). We protect this transfer in line with Indian data protection law.
7Security
- All traffic between the apps and our servers uses HTTPS only. HTTP is redirected and HSTS is turned on.
- Passwords are hashed with bcrypt.
- OTPs are stored hashed.
- Saved UPI and bank details are encrypted at rest (AES-256).
- Login tokens on your phone are kept in the device's secure storage.
- Only authorised staff can access personal data.
No system is 100% secure. Please keep your password private and protect your phone.
8Wallet facts you should know
- 1 coin = ₹1.
- Deposits are made by manual UPI and approved by our team. Each UTR can be used only once.
- Can be withdrawn: winning balance, and manager balance (for managers).
- Cannot be withdrawn: deposit balance and bonus coins. Bonus coins can expire.
- Coins you receive through "Send coins" go into your deposit balance.
- Withdrawals go to your UPI or bank account. Our team pays them by hand, usually within 24–48 hours. A withdrawal fee applies, as shown in the app.
- Players can withdraw only after depositing a minimum total amount, which is shown in the app.
Full wallet rules are in our Terms and Refund Policy.
9How long we keep data
- Active accounts: while your account is active.
- Admin audit log: 365 days.
- Deleted accounts: see Section 10.
- Wallet records (transactions, deposits and withdrawals): up to 8 years, for tax, accounting and fraud prevention. After account deletion they are kept without your name.
10Deleting your account
You can delete your Xenora account, which covers both Xenora E-sports and Xenora Studio:
When you request deletion:
- You are logged out on all devices right away.
- Your personal data is erased after 30 days. If you log in again within these 30 days, the deletion is cancelled.
- You cannot delete your account while you have any of these: winning or manager balance, a pending withdrawal, a deposit under review, or an upcoming tournament (as a player, or in your group as a manager). Withdraw or finish these first.
- Any deposit balance and bonus coins are lost. The app warns you before this happens.
- If you own a group, the group is closed, and its members can join another group straight away.
After 30 days, we erase:
- your name, email, phone number, photo and bio
- your Google link
- your Free Fire name and ID. In past results you are shown as "Deleted player".
- saved UPI and bank details
- device tokens, notifications, friends and feedback
We also remove your IP addresses from your deposits and activity log.
What we keep, without your name (linked only to an internal user ID):
- wallet transactions, deposits and withdrawals, for up to 8 years (tax, accounting and fraud prevention)
- old tournament results and ratings
- an anonymous device hash, to prevent fraud
11Your rights
You can ask us to:
- show you the data we hold about you
- correct it (you can also edit your profile in the app)
- delete it
- stop non-essential messages (you can also turn off notifications in your phone settings)
Write to info@xenora-esports.in. We reply within 30 days and may first ask you to confirm your identity.
12Changes to this policy
We may update this policy when our Services or the law change. We will change the "Last updated" date. For important changes, we will tell you in the app or by email.
13Contact us