Privacy Policy

xFlightStick is a browser extension that lets you play Xbox Cloud Gaming with a racing wheel. This policy explains exactly what we collect, why, and your privacy rights.

Who we are

xFlightStick is operated by an individual developer. You can reach us any time at support@xflightstick.com.

What we collect

We collect the minimum we need to sell you a license and let you restore it on any device.

• Your Google account email and a stable Google account identifier — when you sign in through Google to unlock the extension. We store this so you can restore your license on any device without keys or codes.
• Payment status — whether you've paid, and the Stripe customer_id / session_id that let us recover your license if the webhook is delayed. We do not see or store your card number — Stripe handles that entirely on their servers.
• Request IP address — logged briefly at our edge (Cloudflare) for abuse prevention and rate limiting. Typically discarded within 30 days.
• Launch-notification email — if you submit the "Notify me when we launch" form, we store only your email address so we can send you a single notification when the Chrome Web Store listing goes live. We delete the list after that notification is sent. You can ask us to remove your email before launch by emailing support@xflightstick.com.

What we explicitly do not collect

• Your gameplay, inputs, wheel movements, pedal travel, or anything the extension reads from your device while you play. All input translation happens locally in your browser.
• Browsing history or the games you play.
• Device fingerprints, analytics, tracking pixels, or third-party advertising SDKs. There are none.
• Sensitive categories (health, biometrics, political views, etc.).

Why we collect it

• License and unlock — to sell you the license and let you restore it across devices.
• Abuse prevention — edge logs for rate limiting and security.
• Tax and accounting — records we must keep for payments received.
• Launch notifications — only if you voluntarily submit the "Notify me" form.

Who we share with

We use a small number of third parties strictly to run the service. We do not sell your data to anyone.

• Google — OAuth sign-in (you authenticate with Google; Google sees your sign-in, not the extension's use).
• Stripe — payment processing. Stripe is our payment processor and an independent controller of the payment data you give them. See the Stripe Privacy Policy.
• Cloudflare — hosting, CDN and our database (D1). Cloudflare acts as a processor on our behalf.

Where your data lives

License and account data is stored in a Cloudflare D1 database. Cloudflare operates globally; data may be stored and processed in the United States and other countries. Payment data is stored by Stripe under their own safeguards.

How long we keep it

• License records — as long as your account is active, so you can always restore your license. If you ask us to delete it, we will remove identifying fields within 30 days, keeping only the minimum needed for tax records (e.g. payment reference and amount) for the period required by applicable law.
• Edge logs — up to 30 days.

Your rights

You can request access to, correction of, or deletion of your data at any time. Email support@xflightstick.com and we will respond within 30 days.

Children

xFlightStick is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

Changes to this policy

If we change how we handle data we'll update this page and the "Last updated" date. Material changes will be flagged in the extension popup.

Contact

Questions? support@xflightstick.com.