At XS//SASS, accessible from our website, protecting consumer data privacy is a core priority. This Privacy Policy document details the specific types of information collected and recorded by our platform and outlines exactly how we utilize it.
We collect data from you through standard retail checkout mechanisms and interactive entertainment portals:
Your information is processed strictly for transactional fulfillment, security compliance, and platform operations:
Like standard e-commerce networks, our website uses "Cookies" to store session logs, user preferences, and specific landing configurations. These are deployed to customize your browser experience, remember your e-commerce cart, and preserve your active digital subject narrative state across distinct visitor sessions.
We use two kinds of tracking. They are controlled separately, and you can change either at any time.
What it is for. Measuring visits, page views, product views, add-to-cart, checkout starts and purchases, so we can see how the site is used. We have not linked this property to Google Ads, Google signals is switched off, and our pages tell Google's tag not to use this data for advertising features.
When it is on. If you visit from the United States, Google Analytics is on by default and you can turn it off at any time. That default is our operating choice for visitors in the United States; it is not your consent, and we do not describe it as consent. If you visit from anywhere else, or we cannot determine your country, Google Analytics stays off unless you accept it.
What Google receives from your browser. While it is on, Google's tag sends Google the pages you view and the actions listed above, the address of the page, technical details of your browser and device, and Google's own first-party cookie identifiers (_ga and _ga_YBCPX18KXG). Google receives your IP address as part of the connection and uses it to estimate a general location.
What our server sends Google when an order is paid. Only if Google Analytics was on in your browser when you started checkout, our server sends Google one purchase record. It contains: the order number; the value of the goods after discounts; the currency; the tax and shipping amounts; any discount code used; for each item, its product variant number, product name, option (such as size), unit price and quantity; and the two Google cookie identifiers from that visit, where your browser had them, so the purchase is counted with the visit. It contains no name, email address, postal address or phone number.
What it is for. Measuring activity on our storefront so we can measure and improve our advertising on Meta platforms (Facebook and Instagram).
When it is on. Only after you accept it. This is the same everywhere. The Meta Pixel does not load and sends nothing before that.
What Meta receives from your browser. While it is on, the Meta Pixel sends Meta page views, product views, add-to-cart and checkout starts, with the product identifiers and prices involved, the address of the page, technical details of your browser and device, and Meta's own first-party cookie identifiers (_fbp and _fbc). Meta receives your IP address as part of the connection.
What our server sends Meta when an order is paid. Only if you had accepted advertising tracking when you started checkout, our server sends Meta one purchase record. It contains: your email address after it has been put through the SHA-256 hashing function; the order identifier; the order total; the currency; the product identifiers and quantities; the number of items; the time of the order; and our website address. Hashing hides the address from anyone who simply reads the record, but it does not make it anonymous: Meta can compare the hash with the hashes of email addresses it already holds and so match the purchase to a Meta account. We send no name, postal address, phone number or IP address in this record.
Changing your choices. A notice appears on your first visit with the options "Accept all," "Decline all" and "Choose," where "Choose" shows separate switches for Analytics and Advertising. The "Tracking preferences" link in the footer of every page that uses tracking reopens those switches whenever you like. Your choices are stored in your browser, so they apply to that browser on that device. A choice you made before the two switches were separated still applies to both.
Turning tracking off. Turning a switch off stops that kind of tracking in that browser from then on, and makes a reasonable effort to remove its cookies. It cannot erase information that was already sent.
If you turn tracking off after starting a checkout. The permission for a purchase report is attached to your checkout at the moment you start it. If you then turn a switch off in the same browser, we record that and do not send the corresponding purchase report for that checkout. We cannot make that connection if you change your choice in a different browser or on a different device, or after clearing this site's data from your browser; in those cases a purchase you complete from a checkout you had already started may still be reported. A report that has already been sent cannot be recalled.
Browser privacy signals. If your browser sends a Global Privacy Control or Do Not Track signal, both kinds of tracking are off in that browser, whatever choices are stored.
How we determine your country. Our hosting provider, Netlify, estimates the country from the IP address of your connection. Netlify processes your IP address in order to deliver the site to you, as any hosting provider does, and may record it in its own logs under its own policies. For the tracking decision, the only thing we keep is the two-letter country code, held in your browser for the current tab. At checkout our server reads the country from Netlify again rather than relying on your browser. Estimating a country from an IP address is not always accurate, for example when a VPN is in use.
Our own devices. Tracking is switched off automatically on preview and internal hosts. Appending ?ga-off to a page address switches Analytics off for that browser (?ga-on switches it back), and ?meta-off does the same for the Meta Pixel (?meta-on switches it back).
We do not sell, trade, or rent personal identities to third-party brokers. We share necessary operational data exclusively with:
The administrative, surveillance, tracking, and operational text elements presented within the "Dissident Index," "Subject Profiles," and "BSASS" gameplay logs are completely fabricated narrative assets created strictly for civilian entertainment purposes. They do not mirror real-world consumer profiling, financial scoring, or surveillance activity.
Another priority is adding protection for children using the internet. We do not knowingly collect any Personal Identifiable Information from children under the age of 13. If you suspect your child provided this tracking metadata on our platform, contact us immediately and we will promptly purge it from our servers.
For any legal inquiries regarding data handling, or to exercise your rights to review, modify, or completely delete your personal information, please submit an official request to our support inbox: support@xssass.com.