15X Labs · Trust
Trust & data practices
A plain reading of how the studio treats data, security and the moving parts behind the apps. This page is a summary. The full commitments live in the linked policies.
This page is maintained by 15X Labs to summarise how the studio handles data and security across every app it publishes. It is not an independent audit or certification. Where a claim needs the exact language, the linked policy governs.
What we collect, and why
The default is: as little as possible. Each app asks only for the data it needs to do the job the person opened it for, and every field is disclosed on the store listing and in the privacy policy. Optional analytics are opt in in regions where consent is required.
We do not sell personal information, we do not run behavioural advertising to minors and our apps are intended for adults aged eighteen and over.
Where data lives
- Encrypted in transit with TLS and encrypted at rest by the underlying platforms.
- Regional storage where the platform we use offers it, so data stays close to the person.
- Access to production systems is limited to the small number of people who need it.
The full list of processors and their processing regions is published on the subprocessors page.
Payments
Purchases and subscriptions are handled by Apple and Google. Card numbers never touch our systems. Refunds, price and cancellations follow the rules of the store where the purchase was made. The billing and refunds page explains the flow end to end.
Your rights and how to use them
The rights available depend on where you live, but the request path is the same everywhere. Write to hello@15xlabs.com with a subject line that names what you want. Common ones are "Access", "Correction", "Deletion", "Portability" and "Objection". The privacy policy explains how each is handled and the statutory windows we work to.
Security and incidents
Security disclosures follow the security.txt standard. If we ever have a personal data breach that meets the notification threshold, the privacy policy sets out our commitment to notify supervisory authorities and affected people within the timeframes their law requires.
Subprocessors and integrations
Every third party that processes personal data on our behalf is listed by name, purpose and processing region on the subprocessors page, and material changes appear in the policy updates log.
Business partners
Partners that need a signed data processing addendum can use the standard DPA text, which reflects Article 28 GDPR, the UK IDTA and the EU Standard Contractual Clauses where cross border transfers apply.
Accessibility
Our target for this website and its applications is WCAG 2.2 Level AA conformance. The accessibility page describes the channel for reporting barriers and how we respond.