Privacy Policy

            Wexio collects only what it needs to run. We do not sell your data, serve ads, or share your information with third parties.
        

This Privacy Policy explains what information Wexio collects when you use the platform, how it is stored, and who can see it. By using Wexio you agree to this policy.

1 What We Collect

Data	Why it's collected	Who can see it
Username	Identifies your account	All logged-in users
Password (hashed)	Authenticates you on login	Nobody — stored as a one-way bcrypt hash
Account creation date	Shown on your profile	All logged-in users
Posts & comments	Core content of the platform	All logged-in users
Likes	Engagement tracking per post	Post authors see counts; individual likes are not publicly displayed
Bio & profile picture	Profile personalisation	All logged-in users
Friend list	Social graph	Visible on your profile (hidden friends are excluded)
Direct messages	Private communication	Only you and the recipient
Notifications	Alert you to activity	Only you
Public pastes (Wexipaste)	Content sharing	All logged-in users
Private pastes (Wexipaste)	Personal note storage	Only you
Block & ignore lists	User safety controls	Only you
IP address (login attempts)	Rate limiting failed logins	Nobody — used only for security, not linked to your profile

We do not collect your email address, phone number, real name, location, or any payment information.

2 How Data Is Stored

All user data is stored in JSON files on the server. There is no external database. Files containing your data include:

users.json — username, hashed password, follower/following lists, join date
posts.json — all posts with author, content, and timestamp
comments.json — all comments
likes.json — like relationships per post
messages.json — all direct messages
notifications.json — notification records
bios.json — user bios
friends.json / friend_requests.json — social graph
blocks.json / ignores.json — safety controls
pfps/ — uploaded profile pictures
wexipaste/pastes.json — all Wexipaste entries

These files are stored in a private/ directory that is blocked from direct web access by server configuration. They are only accessible to the server-side PHP code that runs the platform.

We do not make backups. If data is lost due to a server failure, it cannot be recovered.

3 Sessions & Cookies

When you log in, Wexio creates a PHP session and stores a session cookie in your browser to keep you logged in while you browse the site.

The session is destroyed when you log out. Sessions are regenerated on login to prevent session fixation attacks.

Wexio does not use tracking cookies, analytics cookies, or any third-party cookies.

4 Who Can See Your Content

Public content (posts, comments, profile, public pastes, follower/following counts) is visible to anyone who is logged in to Wexio.

Private content (DMs, private pastes, block/ignore lists, notifications) is visible only to you.

If you block a user, your posts will not appear in their feed and their posts will not appear in yours. Block lists are not visible to the blocked user or to other users.

Ignored users are hidden from your friends-based views. Ignore lists are private to you.

5 Data Sharing

We do not sell, rent, or share your personal data with any third parties, advertisers, or data brokers. Ever.

Wexio does not integrate any third-party analytics, advertising, or tracking services. There are no external scripts, fonts, or CDN requests — everything is served from the Wexio server itself.

6 Deleting Your Data

You can delete your account at any time from your Profile → Danger Zone. Deleting your account permanently removes:

Your username and password hash
All posts and comments you wrote
Your bio and profile picture
Your friend relationships and follow relationships
Your notifications

Deletion is immediate and irreversible. We have no way to recover a deleted account.

Note: DMs you sent will remain in the recipient's message history. Likes you made may remain as counts on posts.

7 Security

We take reasonable steps to protect your data:

Passwords are hashed with bcrypt (PHP's password_hash) and never stored in plain text
The private/ data directory is blocked from direct web access
Session IDs are regenerated after login
Login attempts are rate-limited by IP to prevent brute-force attacks
File writes use atomic operations to prevent data corruption
Security headers (X-Frame-Options, X-Content-Type-Options, etc.) are set on all responses

No system is perfectly secure. You are responsible for keeping your password strong and private.

8 Changes to This Policy

We may update this policy from time to time. When we do, the "last updated" date at the top of this page will reflect the change. Continued use of Wexio after a policy update constitutes acceptance of the new policy.