XBLink

XBLink Privacy Policy

Effective 20 October 2026

1. Introduction

This policy explains what the XBLink app for Android (package com.xblink.app, "the app") does with your information. XBLink is an independent app published on Google Play by its developer ("we", "us"). It lets you stream games from your own console and from cloud gaming to your phone, tablet or TV.

The same policy is shown in the app under Settings → About → Privacy policy.

2. Summary

• The app has no analytics, no ads and no crash reporting.
• Everything the app stores stays on your device.
• We do not sell your information or share it for advertising.
• Our only server is the XBLink Pro check. It is used only if you buy XBLink Pro, and it keeps nothing but one-way hashes of your purchase and installs.

3. Information the app handles

3.1 Your Microsoft account

You sign in with Microsoft in your browser or with a code. The app receives sign-in tokens from Microsoft and stores them on your device, encrypted with a key held by Android's keystore. Your password never reaches the app. Signing out removes that account's tokens and cached data.

3.2 What is sent to Microsoft

To run your sessions, the app sends Microsoft's services:

• your account's Xbox user ID and gamertag (through your sign-in tokens);
• a random ID created when the app was installed;
• basic device details: make, model, Android version, screen size, language and time zone.

Microsoft's own privacy statement covers what Microsoft does with them.

3.3 Your friends

The Profile tab shows the gamertags, pictures, gamerscores and online status of the people you follow, as Microsoft provides them. The app keeps them in memory only while it runs and never writes them to storage. To look up their names and status, it sends their Xbox user IDs back to Microsoft and nowhere else. Signing out clears them.

3.4 Data saved on your device

To open quickly, the app keeps a copy of your own profile, games, achievements and time played, the cloud game library and game artwork in its cache on your device. The cache is refreshed regularly, deleted when you sign out, and never backed up.

3.5 ReShade effects

ReShade files you import stay on your device and are left out of cloud backups. Your ReShade presets are included in Android's backup like your other settings. The effects run on your device only; nothing about them is sent anywhere.

3.6 Microphone

The app uses the microphone only when you turn it on during a stream, and only after you allow it. Audio goes to your console or the cloud session for voice chat and is not recorded by the app.

3.7 Diagnostic logs

The app keeps a diagnostic log on your device. It leaves the device only when you choose Share log.

4. Services the app communicates with

The app connects only to the services below, and only for the purpose shown.

The policies of Microsoft and Google cover what those companies do with the information they receive.

5. XBLink Pro purchases

XBLink Pro is bought through Google Play. Google handles the payment; the app never sees your payment details.

To confirm a purchase, the app sends the XBLink Pro server:

• the purchase token Google Play gave the app;
• a random install ID, made from a key that never leaves your device;
• a Google Play Integrity token that says whether this copy of the app came from Google Play.

The server asks Google whether the purchase is real and sends back a signed confirmation (a pass, valid for 30 days) that the app keeps on your device.

One purchase works on up to 5 devices. To enforce this, the server stores only one-way hashes of the purchase token and of those install IDs, with the time each install last checked. It deletes them 30 days after the purchase's last check. It stores nothing else.

6. Storage, retention and deletion

• On your device: sign-in tokens, settings, cached profile and game data, imported ReShade files and logs stay on your device until you sign out, clear the app's data or uninstall it.
• On our server: only the one-way hashes described in section 5, deleted 30 days after a purchase's last check.
• Backups: Android may back up your settings, including ReShade presets. Sign-in tokens, the install ID, logs, cached data and imported ReShade files are excluded.

See Delete your data for the steps.

7. Security

Sign-in tokens are encrypted with a key held by Android's keystore, and the install ID comes from a keystore key that never leaves your device. Traffic to Microsoft, Google and the XBLink Pro server uses HTTPS, and the stream itself is encrypted by WebRTC (DTLS-SRTP). No method of storage or transmission is perfectly secure, but we keep what the app holds to the minimum it needs.

8. Children

The app is not directed at children under 13, and we do not knowingly collect information from them. Xbox family settings on your Microsoft account still apply when you use the app.

9. Your choices and rights

• Sign out of any account at any time to remove its tokens and cached data from your device.
• Microphone access is off until you turn it on in a stream, and you can revoke it in Android settings.
• Logs are shared only when you choose Share log.
• Microsoft account data (profile, friends, gaming history) is controlled by Microsoft; use Microsoft's privacy dashboard to see or delete it.
• Pro purchase data on our server can be deleted on request (see Delete your data). Depending on where you live (for example the EU, UK or California), you may also have rights to access, correct or delete your data, which you can exercise the same way.

10. Changes and contact

If the app's handling of information changes, we will update this policy and its effective date, and the app will show the new version.

For questions or requests about this policy, email owenbuilds@proton.me.