Privacy notice

X9 helps people move things forward through simple human handoffs. People use X9 to create tasks, share requests, accept or reject assignments, send updates, submit reports, attach proof, and keep track of what happened.

This Privacy Notice explains how Happy When You Are Happy Ltda., operating X9, collects, uses, shares, stores, and protects personal information when you use the X9 mobile app (Android and iOS), x9.app (including our early-access waitlist), do.x9.app (shared task links), qr.x9.app (QR reporting), and related support channels. It is written in plain language to help you understand what happens with your information. It is not legal advice.

1. The short version

X9 uses personal information to provide the service, verify users, help people coordinate tasks and reports, notify the right people, keep the app secure, and improve the product.

X9 is not built around selling personal data or creating advertising profiles. We do not sell your personal information. We do not use private tasks, reports, photos, audio, location, or bucket content to target advertising.

Some X9 features ask for sensitive permissions, such as contacts, camera, microphone, photos, location, or notifications. These permissions are used only when they are needed for a feature you choose to use. You can control many of these permissions through your device settings.

2. Who is responsible for X9

X9 is operated by Happy When You Are Happy Ltda. Company site: hwyah.com. For privacy questions, requests, or concerns, contact privacy@x9.app or support@x9.app.

For personal use, X9 is usually responsible for deciding how your information is processed. In shared workflows, the situation can be more collaborative. For example, a person, company, team, building, community, or organization may create a bucket, invite people, assign tasks, or collect QR-code reports. In those cases, that owner may also decide why certain task or report information is collected, who can see it, and how the workflow should be managed.

When you participate in a shared task, bucket, or QR-reporting flow, some information you provide may be visible to the person or organization responsible for that workflow.

3. Information we collect

The information X9 collects depends on how you use the service. We try to collect only what is needed to make X9 useful, safe, and reliable.

Account and identity

• Phone number — required to create and sign in to an X9 account (SMS one-time codes via Firebase Authentication). We may store a display name derived from your number until you set a profile name.
• Profile information — optional display name, profile image, language, and settings you choose in the app.
• Device identifiers — Firebase user IDs, push notification tokens (FCM), app version, device type, and security-related signals (such as Play Integrity on Android) used for authentication, notification delivery, and abuse prevention.

Tasks, buckets, and shared work

• Task titles, descriptions, notes, due dates, status, comments, assignments, bucket membership, and activity history you create or that others assign to you.
• Photos, videos, audio recordings, files, and proof of completion you attach to tasks (stored in Firebase Storage).
• Approximate or precise location when you grant permission — for example task location context, QR geofencing, or reports submitted near a place.
• Short links and tokens used to share tasks through WhatsApp or the web executor at do.x9.app.

Contacts

If you grant contacts permission, X9 may use phone numbers from your device contacts to help you find, invite, or assign tasks to people you already know. We do not use your address book for advertising. We do not publish your contacts. Contact names and other personal details from your address book are kept on your device where possible; cloud contact records focus on phone-based linking and assignment.

Marketing site and early access

• If you join early access on x9.app: your verified mobile number (SMS one-time code), your choice about SMS or WhatsApp updates, and attribution data (page visited, referrer, browser language, device type, UTM campaign parameters). We use Firebase Phone Authentication and Google reCAPTCHA to verify numbers and reduce abuse.
• Aggregate analytics on the marketing site (Google Analytics 4). See section 10 for how cookies and analytics work on x9.app.

Technical and diagnostic information

X9 may process browser type, operating system, device type, app version, error logs, diagnostic events, security signals, IP address, approximate region, language, and interaction data such as which parts of the service are used. We use this information to maintain reliability, understand product performance, prevent abuse, and improve X9.

4. Shared links and QR-code reports

X9 sometimes allows people to participate without installing the app, for example through a shared task link or a QR code. When someone uses one of these links, we process the information needed to show the request, receive the response, notify the right person, and keep a useful record of what happened.

• On do.x9.app, someone opening a task link may sign in with a phone number or use a limited anonymous session to accept, reject, comment on, submit proof for, or complete a task.
• On qr.x9.app, people can submit reports (photos, notes, audio, optional location) into a bucket without installing the app. Submissions may be held for owner review before entering a workflow. Optional follow-up links let submitters check status.

Information submitted through shared links or QR codes may become visible to the task owner, bucket owner, assigned people, reviewers, or other participants who need access to manage the workflow. If you are submitting information through a link or QR code, only include information that is relevant to that task or report.

5. Optional AI assistance

X9 may offer optional AI-assisted features, such as helping turn a voice note into a task title, summary, or description. These features are designed to reduce typing and make it easier to capture what needs to happen.

When you actively use an AI feature, X9 may process the audio, transcript, text, or context you provide for that feature. We may send this information through our secure backend to trusted AI service providers, including Google Gemini, so the requested suggestion can be generated.

AI assistance is optional. You can review, edit, or discard suggestions before saving them. We do not sell AI interaction data, and we do not use your private task, report, audio, transcript, photo, location, or bucket content for third-party advertising.

6. How we use information

• Create and verify accounts, sync tasks and buckets, and deliver push notifications about assignments and updates.
• Enable shared workflows, task sharing, QR intake, moderation, and web executor flows you or bucket owners initiate.
• Process reports, support attachments, and help people accept or complete tasks.
• Provide optional AI assistance from audio or text you submit.
• Operate the marketing site, measure aggregate interest, and manage early-access invitations.
• Answer support requests, prevent fraud or abuse, fix technical problems, and comply with legal obligations.
• Use security and diagnostic information to detect suspicious activity, prevent spam, avoid unauthorized access, and keep X9 reliable.

7. Legal reasons for using information

Where privacy laws such as the GDPR, UK GDPR, LGPD, or similar laws apply, we rely on recognized legal reasons to process personal information.

Much of the processing is necessary to provide the X9 service you choose to use. For example, we need your phone number to verify your account, and we need task content to show a task to the right person. Some processing is based on your consent, such as optional device permissions, SMS or WhatsApp marketing messages where you opt in, and cookie choices where our banner is shown. Some processing is based on our legitimate interest in keeping X9 secure, preventing abuse, improving the product, and responding to support requests. In some cases, we may need to process or keep limited information to comply with legal obligations or protect rights, safety, and legal claims.

When processing is based on consent, you can withdraw that consent. This may limit features that depend on the permission or information.

8. Who can see or receive information

X9 does not sell your personal information.

We share information only when it is needed to provide, protect, or operate the service. Trusted processors that help us run X9 include:

• Google Firebase (Authentication, Cloud Firestore, Cloud Storage, Cloud Messaging, Cloud Functions)
• Google Maps and location services (when you use location features)
• Google Gemini (optional audio-to-text and task drafting, via our backend)
• Google Analytics 4 (marketing site analytics)
• Hosting, SMS, and email providers for the marketing site and related communications

These providers process data under our instructions and their own terms. Some may process data in countries other than yours; we use appropriate safeguards where required by law.

Information may also be shared with other X9 users when that is part of the workflow. If someone assigns you a task, participates in a bucket with you, reviews a report, receives your comment, or needs to see proof of completion, X9 shows the relevant information to that person or group.

If a company, team, building, community, or other organization manages a bucket or QR-reporting workflow, the owner or authorized reviewers of that workflow may see submissions, task status, comments, attachments, location context, and other information needed to manage the process.

We may also disclose information if required by law, legal process, or public authorities, or if we believe disclosure is necessary to protect X9, our users, other people, rights, safety, or security.

What we don’t do

• Sell or rent your personal data.
• Run third-party advertising trackers inside the X9 app.
• Use bucket or task contents for third-party advertising.
• Publish your private tasks in search engines.
• Link early-access waitlist data to your product account without a clear connection you initiated (for example signing up with the same phone).

9. International processing

X9 is operated from Brazil and uses service providers that may process information in other countries. This may include countries where our cloud, infrastructure, analytics, communication, support, or AI providers operate.

When information is processed internationally, we use reasonable safeguards required by applicable law. These may include contractual protections, provider security commitments, and other legally recognized mechanisms for international data transfers.

10. Cookies and website analytics

The X9 app is not designed around third-party advertising trackers.

On x9.app, we use essential cookies (for example to remember your language preference) and Google Analytics 4 to understand aggregate traffic — pages visited, approximate region, browser type, device type, language, referring pages, and campaign parameters.

Today, analytics may load on your first visit.If our cookie banner is shown, you can choose “Essential only” to disable analytics for that browser. You can also manage cookies through your browser settings or by clearing site data for x9.app.

The early-access waitlist uses Firebase Phone Authentication, which may use Google reCAPTCHA to reduce abuse.

11. How long we keep information

We keep personal information only as long as needed for the purposes described in this notice.

Account information is generally kept while your account is active. Task, bucket, report, comment, and attachment information is generally kept while it is needed for the workflow, the owner’s records, user history, support, security, or legal reasons. Support messages and diagnostic records may be kept as long as needed to resolve issues and maintain reliable service. Security, abuse-prevention, and legal records may be kept longer when necessary to protect users, X9, or others.

When you delete your account or request deletion, we delete or anonymize personal information associated with your account unless we need to keep limited information for legal, security, fraud-prevention, dispute-resolution, backup, or legitimate operational reasons. Backups may retain deleted information for a limited period before they are overwritten. Aggregated analytics may be kept longer in non-identifying form.

In shared workflows, some records may remain visible to bucket owners or other participants if they are part of a shared task, report, or operational history. We try to balance deletion requests with the need to preserve records that other people or organizations may rely on.

12. Account deletion

You can request account deletion by contacting privacy@x9.app or support@x9.app. Where available, you may also delete your account from in-app settings.

To protect your account, we may need to verify that the request really comes from you. After deletion, we delete or anonymize personal information associated with your account, subject to the retention limits explained above.

13. Security

We use reasonable technical and organizational measures to protect personal information. This includes encryption in transit, access controls, authentication protections, cloud security controls, restricted access to production systems, monitoring, and measures designed to prevent abuse or unauthorized access.

No digital service can be guaranteed to be completely secure. You can help protect your account by keeping your phone and phone number secure, using device-level protections, and contacting us if you suspect unauthorized access.

14. Your choices and rights

• Permissions — camera, microphone, contacts, location, notifications, and media access are optional except where a feature requires them. You can change many of these in device settings or X9 Settings → Permissions.
• Marketing cookies — on x9.app, use the cookie banner (when shown) to limit analytics for that browser.
• Access, correction, deletion — contact privacy@x9.app or support@x9.app from an address we have on file, or with the phone number on your account. We will verify your request and respond without undue delay.
• Brazil (LGPD) — you may have rights to confirm processing, access, correct, anonymize, block, delete, or port data, withdraw consent, and lodge a complaint with the national data protection authority.
• EEA / UK (GDPR) — you may have additional rights to object, restrict processing, or lodge a complaint with your local supervisory authority.

15. Children

X9 is not directed to children under 13 or to anyone below the minimum age required in their country to use digital services without parental approval. We do not knowingly collect personal information from children. If you believe a child has provided personal information to X9, contact us and we will take appropriate steps to delete it.

16. Changes to this notice

We may update this Privacy Notice as X9 evolves. If we make material changes, we will provide reasonable notice through the app, this page, or (for early-access contacts) by SMS, WhatsApp, or email where we have your contact information. The “Last updated” date at the top shows when this notice was last changed.

17. Contact

For privacy questions, requests, or concerns, contact us at:

• privacy@x9.app
• support@x9.app

Happy When You Are Happy Ltda.
hwyah.com