Who we are
Slay is made by XFour IT Limited, trading as XFour Labs ("we", "us"). We are a company registered in England and Wales, number 11776254. Our registered office is 100 Berkshire Place, C/O KT Wells Ltd, Winnersh Triangle, Wokingham, RG41 5RD, United Kingdom. We are the controller of the personal data described here, under UK data protection law (UK GDPR and the Data Protection Act 2018).
Questions about this policy: gdpr@xfour.co.uk.
The short version
Slay lets you log a daily "slay-ness" score and a "genderality" value, keep a private history, and share your latest check-in with friends you choose. It works without an account.
There is no Slay account and no sign-in. Check-ins work with no iCloud at all. If you use Friends, Slay uses your device's iCloud account through Apple CloudKit and creates its own random friend code and encryption keys on your device.
- We do not collect: your name, email or phone number (unless you turn on phone discovery, and then only a hash).
- We do not collect: your check-in scores or genderality, in analytics.
- We do not collect: advertising IDs. Slay has no ads and does not track you across other apps.
What we collect, where it goes, and how long we keep it
| Data | Where it is stored | Why | How long |
|---|---|---|---|
| Check-ins: date, slay-ness score, genderality value, and optional weather and temperature | On your device, and your paired Apple Watch | To show your history, streaks and widgets | Until you delete the check-in or the app |
| Your Friends profile: display name, 6-character friend code, public encryption keys, your "pokes on/off" choice | Apple iCloud (CloudKit public database) | So friends can find you and send you requests | Until you use Delete account in Settings |
| Check-ins you share with friends | Apple iCloud, encrypted so only the chosen friend can read them | To show your latest check-in to the friends you picked | Until you delete your account or stop sharing |
| Friend requests, pokes, reactions and "hype" | Apple iCloud (CloudKit) | To run the social features | Until you delete your account |
| Optional: a salted hash of your phone number | Apple iCloud (CloudKit public database) | So contacts who have your number can find you. Only if you turn this on | Until you turn it off or delete your account |
| Hashes of your contacts' phone numbers (sent as lookups, not stored by us) | Sent to Apple iCloud as a query. Your contact list stays on your device | To find friends already on Slay. Only if you allow Contacts access | Not kept. A list of matches is cached on your device |
| Approximate location, or a city you type | Sent to Apple WeatherKit. Only the weather type and temperature are saved | To note the weather on your check-in. Optional | Location is not saved |
| A one-way code made from your iCloud user ID | Apple iCloud (CloudKit) | To stop the same person claiming a referral reward twice | Kept after account deletion, for fraud prevention. It cannot be turned back into your identity by us |
| Anonymous usage events: app version, days since install, streak length, purchase product and price, friend count, error codes. Tied to a random ID made on your device | PostHog (EU) | To learn which features work and fix problems | Deleted automatically after PostHog's retention period (usually up to 1 year), or sooner if you ask |
In-app purchases
- Streak Restore and Streak Freeze packs (consumable).
- Tip Jar (consumable, optional, unlocks nothing).
- Prices are shown in your local currency in the app and by the App Store at checkout.
Payment is handled by the App Store or Google Play. We never see your card details. We receive only what you bought and whether it is active.
What other people can see
- Anyone using Slay can look up a friend code and see the display name linked to it.
- Friends you accept see your display name and the check-ins you share with them.
- Friends see the pokes, reactions and hype you send them. Hype can be sent anonymously.
Permissions the app asks for
The app asks before it uses any of these. You can say no, or change your mind later in your phone's settings. The rest of the app still works.
| Permission | What it is used for |
|---|---|
| Contacts (optional) | Finds friends already on Slay by matching hashes of phone numbers. Your contact list stays on your device. |
| Location, approximate, when in use (optional) | Notes the weather at your check-in. You can type a city instead. |
| Notifications (optional) | A daily reminder and alerts from your friends. |
Why we use your data (our lawful basis)
| Purpose | Lawful basis |
|---|---|
| Running the app and the Friends features | Contract: to provide the service you asked for |
| Your genderality value | Your explicit consent, given when you choose to log it. It stays on your device unless you share a check-in with a friend |
| Contacts matching and weather | Your consent, through the system permission. You can withdraw it in iOS Settings |
| Anonymous analytics and fraud prevention on referral rewards | Our legitimate interests in improving the app and stopping abuse |
We do not sell your data. We do not use it for advertising. We do not make automated decisions about you that have legal or similar effects.
Sensitive data
Gender expression can reveal sensitive information about you. We treat your genderality value as special category data. It is never sent to analytics. It only leaves your device in encrypted form, to friends you choose.
Service providers
We use these companies to run the app. They may only use your data to provide their service to us.
| Provider | What they do | Location |
|---|---|---|
| Apple (iCloud / CloudKit, WeatherKit, push notifications) | Storage and sync for Friends features, weather, notifications | Apple data centres, which may be outside the UK |
| PostHog | Product analytics (anonymous usage events) | EU (Frankfurt) |
| Apple App Store / Google Play | Takes payment for in-app purchases. We never see your card details | Apple / Google |
Where a provider processes data outside the UK, we rely on UK adequacy regulations (for example for the EU), or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge where the provider is certified.
Deleting your data
- Delete any single check-in in the app.
- Settings → Delete account removes your local data, your Friends profile, your shared check-ins and your encryption keys from iCloud.
- Deleting the app removes everything stored on your device.
- To ask for a copy of your data or any other request, email us. Most of your data is only on your device, so we may not be able to see it.
Children
Slay is not for children under 13. Because it has social features, we recommend it for ages 16 and up. If you think a child has given us personal data, email us and we will delete it.
Security
Data sent between the app and our providers is encrypted in transit. We give access only to the people and systems that need it, and we keep the amount of data we collect small. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data;
- ask us to correct data that is wrong;
- ask us to delete your data;
- object to, or ask us to limit, how we use your data;
- ask for your data in a format you can move to another service;
- withdraw consent at any time, where we rely on consent.
Email gdpr@xfour.co.uk. We will reply within one month. Much of your data may be only on your device, where we cannot see it.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113. We would like the chance to fix it first, so please contact us.
Changes to this policy
When the app changes what it collects, we update this page and the date at the top. If a change is significant, we will also tell you in the app.
Contact
XFour IT Limited, 100 Berkshire Place, C/O KT Wells Ltd, Winnersh Triangle, Wokingham, RG41 5RD, United Kingdom.
Privacy: gdpr@xfour.co.uk · Support: support@xfour.co.uk
Policy based on a review of the app's source code (Slay-app, develop branch) on 29 October 2026.