Privacy policy
XGate keeps as little about you as it can, and none of it is what you did on your Mac. This page sets out what the service holds, why it holds it, for how long, and who can see it.
Last updated 9 October 2026.
Who we are
Itch Studio Limited, registered in England and Wales, company number 14729010. Email: support@itch.studio. We are the controller of the personal data described on this page.
What XGate is
XGate is a program on your Mac. It closes the sites and apps you choose except in the windows you set, and it keeps administrator access off except on request. The blocking happens on the Mac itself. The service at xgateguard.com exists for two reasons: so that a person you chose, your Guardian, can hold the keys and answer your requests from wherever they are, and so that your rules follow you from one Mac to the next.
What the service holds about a Member
A Member is a person whose Mac runs XGate. For a Member the service holds:
- your name as you gave it, your email address, and the name and version of each Mac;
- your rules: the sets with their sites, apps and categories, their hours, limits and waiting periods, the admin rule and the breaks rule;
- counts and events: that a set opened or was refused, admin windows and the reason you gave for each, breaks taken and missed, rules changed, tampering seen. Each event is a line of a few words;
- the names and icons of the apps installed on the Mac, so that a set can be built from a picker on your Guardian's page;
- a summary of the accounts on the Mac at hand-over: their names, whether each is an administrator, and whether FileVault is on;
- the weekly report your Guardian receives, when you have asked for a copy.
What it holds about a Guardian
A Guardian is the person a Member chose to hold the keys. For a Guardian the service holds your name, your email address, a hash of your password, the secret for two-step sign-in if you turned it on, and the subscription for notifications on your phone if you turned that on. A Guardian is never shown a page visited, a screenshot or a keystroke, because the service never has them.
The keys
When setup on a Mac creates the Guardian account, its password (and the FileVault recovery key, when one is made) passes through the service to the Guardian's page. The service holds each only until the Guardian has written it down and typed it back, and deletes it then. A password the Guardian chooses for themselves is encrypted in their browser before it is sent, and the service never has it in a readable form. When XGate itself is the Guardian, the keys stay on the Mac, readable only by the system, and the service holds none.
What it never holds
The pages you visit, your searches, the content of anything you read or write, screenshots, keystrokes, or your location. Site names are resolved on the Mac itself. The block lists the Mac uses are fetched by the Mac from their publishers on GitHub, whose servers see the Mac's address in the way any download does.
On an iPhone with the XGate profile installed and the Blocklist on, the iPhone looks up site names through Cloudflare's 1.1.1.1 for Families, which refuses adult sites. Those lookups go from the iPhone to Cloudflare and never to us; Cloudflare's privacy commitments for 1.1.1.1 apply to them.
Payments
Plus is paid through Stripe. The service holds Stripe's identifier for you and the state of the subscription: whether it is paid, when it renews or ends, and a record of each payment event. Your card details go to Stripe and never to us, and Stripe's own privacy policy applies to what Stripe holds.
Why we hold it
We hold this data to provide the service you asked for, which is the contract between us: the rules, the Guardian's page, the requests and the plan. We send the emails that say XGate has stopped or been tampered with in our legitimate interest and in yours, because the product's promise is that such things are seen. We send notifications to a Guardian's phone with their consent, which they can withdraw on their page at any time.
Where it is held, and for how long
The service runs on Amazon Web Services in Ireland, and sends its emails through Amazon's email service. Events and payment records are kept for 400 days and then removed. A Mac that has left XGate stays on the record as a retired entry, for the Guardian's history, until the account is deleted. You can delete your account from your page once no Mac of yours is running XGate, and everything above goes with it, apart from the payment ledger, which we are required by law to keep.
Who can see it
Your Guardian sees what the role page describes: counts, set names, openings and refusals, the reasons you typed, and the keys once. Staff at Itch Studio Limited can see accounts, plans, Macs and events in order to run the service and answer support, and can never see a key. Our processors are Amazon Web Services, for hosting and email, and Stripe, for payments. Nothing is sold, nothing is used for advertising, and there is no analytics script on these pages. The site sets one cookie, for your session.
Your rights
Under UK data protection law you can ask for a copy of what we hold about you, have it corrected, have it deleted, and object to or restrict its use. Signed in, you can see every record the service holds about you in plain words and download the lot at /member/records, and delete the account from your page. For anything else write to support@itch.studio and we will answer within a month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Adults only
XGate is for adults choosing rules for their own Macs. It is not for use by or on anyone under 18, and we do not knowingly hold data about anyone under 18.
Changes to this policy
When this policy changes, the date at the top changes with it, and we tell you by email before a change that affects you takes effect.