Cookie Policy
Last updated: June 2026
This policy explains which cookies and similar technologies Xonaplay uses, what they are for, and how you can manage them. Xonaplay is a video hosting platform: you upload a video, we transcode it to adaptive HLS, and we give you an embeddable player and a link to share. For sign-in, the dashboard, and the player to work, we need to store certain information in your browser. We use as few cookies as possible and we do not sell your data.
1. What cookies are
Cookies are small text files that a website stores in your browser when you visit it. They let us remember information between pages and visits, for example that you are already signed in or which language you chose, so you don't have to set it up on every load.
Besides cookies themselves, we use equivalent technologies such as the browser's localStorage and sessionStorage to keep interface preferences (for example, your last library view or your onboarding progress). Throughout this policy, when we say cookies we also mean these local storage technologies.
Cookies can be session cookies (deleted when you close the browser) or persistent (they stay until they expire or until you delete them). They can also be first-party (set by xonaplay.com) or third-party (set by providers we use, such as the payment processor or the CDN).
2. Types of cookies we use
We group cookies into three categories. Strictly necessary cookies cannot be turned off because the service won't work without them; the rest are used to improve your experience or to understand, in aggregate, how the platform is used.
| Name | Purpose | Duration |
|---|---|---|
| xpl_access | Strictly necessary. Your session access token (httpOnly cookie). Authenticates every request to the dashboard and API while you browse. | Session (short-lived, refreshed via the refresh token) |
| xpl_refresh | Strictly necessary. Refresh token (httpOnly cookie). Renews the access token without asking you to sign in again. | Persistent (up to 30 days) |
| xpl_workspace | Strictly necessary. Remembers your active workspace when you belong to more than one organization, so we show the right videos and billing. | Persistent (up to 1 year) |
| xpl_library_view | Preferences. Stores your preferred video library view (grid or list, sorting and filters). | Persistent (up to 1 year) |
| xpl_onboarding | Preferences. Tracks your onboarding progress (which steps you've completed) so we don't show the initial guides again. | Persistent (up to 1 year) |
| xpl_lang | Preferences. Stores your chosen language (es, en, pt) to display the site and the player in that language. | Persistent (up to 1 year) |
| theme | Preferences. Stores your theme preference (light, dark, or automatic) in the interface. | Persistent (up to 1 year) |
| _xpl_analytics | Analytics. Anonymous, aggregated identifier to measure usage, player performance, and errors so we can improve the service. Not used to profile you or for advertising. | Persistent (up to 13 months) |
Names and durations may vary slightly by region and as the product evolves. Strictly necessary cookies are always set; preference and analytics cookies are adjusted based on your consent choices where required by law.
3. Third-party cookies
Some features rely on external providers that may set their own cookies when you interact with them:
- Payment processor: when you subscribe to or manage a Pro or Enterprise plan, our payment processor may use cookies to process the charge securely and prevent fraud. These cookies are governed by that provider's policy.
- CDN and protection (Cloudflare, if applicable): to deliver HLS video and protect the platform, the CDN may use technical security and load-balancing cookies (for example, to mitigate attacks and route traffic). They are necessary for service delivery and security.
- Embedded player: when you embed a Xonaplay video on another site, the player may store minimal technical preferences (such as volume or chosen quality) in the viewer's browser.
We do not use third-party cookies for advertising or cross-site tracking.
4. How to manage cookies
You can control and delete cookies from your browser settings. Keep in mind that if you block strictly necessary cookies, you won't be able to sign in or use the Xonaplay dashboard.
Per-browser guides:
- Google Chrome: Settings → Privacy and security → Cookies and other site data.
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.
- Safari: Preferences → Privacy → Manage Website Data (on iOS, Settings → Safari).
- Microsoft Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.
You can also use private or incognito browsing, which doesn't keep cookies after you close the window.
5. Changes to this policy
We may update this Cookie Policy to reflect changes in the product, in the providers we use, or in applicable regulations. When a change is significant, we will announce it on the site or by email. The last-updated date at the top of this page indicates the current version.
6. Contact
If you have questions about our use of cookies or about your privacy, write to us at [email protected]. For legal matters, you can reach us at [email protected].
Data controller: Xonaplay.