Cookie Policy
Last updated:
What this site stores in your browser, and why. The inventory below reflects the code as it is today.
1. Who is responsible
XPublish Ltd, a company registered in England and Wales (company number14995538), registered office Unit 12A, Brickfields Industrial Estate, Finway Road, Hemel Hempstead, Hertfordshire, HP2 7QA, United Kingdom, runs X-Live Books and decides which cookies it uses. Questions:hello@xpublish.io, or hello@xpublish.io. How we handle personal data in general is in the Privacy Policy.
2. Cookies this site sets
A cookie is a small text entry a website stores in your browser. This site sets the following, and no others.
| Name | Set by | Purpose | Duration | Category |
|---|---|---|---|---|
| __Host-xlive-auth (and its .0 / .1 parts) | Supabase Auth, our sign-in provider | Keeps you signed in (session and refresh token), on the one site address you signed in on. | Up to 400 days, renewed while you use the site | Essential |
| __Host-xlive-auth-code-verifier | Supabase Auth | Completes a sign-in link or one-time code. | During sign-in only | Essential |
| NEXT_LOCALE | X-Live Books (author CMS language switcher) | Remembers the language you chose in the author CMS. | 1 year | Functional |
| xlive-reader-lang | X-Live Books (reader) | Remembers the language you chose in the reader. | 1 year | Functional |
| paige_hint | X-Live Books (the Ask Paige help button) | Remembers that you dismissed Paige's greeting balloon, so it is not shown again. | 180 days | Functional |
| xlive-ref | X-Live Books (personal referral links, /r/…) | Set only if you accept marketing cookies. Remembers which personal referral link you followed so the person who invited you is credited. It holds only the code, the link channel and the time of the click. | 60 days | Marketing |
| xlive-did | X-Live Books (your referral page) | Set when you open your own referral page. A random identifier: we store only a one-way hash of it, so an author who signs up from the same browser as the person who invited them is not credited as a referral. It holds no account id or email. | 2 years | Essential (fraud prevention) |
| xlive-consent | X-Live Books (this cookie notice) | Remembers that you have seen this notice, and — when choices are offered — the choices you made, with the date. | 6 months | Functional |
All of these are first-party cookies. The sign-in cookies (__Host-xlive-auth) are host-only: each one belongs to the one site address you signed in on, and no other xpublish.io address can read it. The preference cookies are shared across xpublish.io and its subdomains (or kept to the single host you are on, where the site answers on another address). None of them is used for advertising or analytics.
3. What this site does not set
No advertising cookies and no analytics cookies. Fonts are served from this site. If that changes, this page and the cookie notice will change with it, and you will be asked before any such cookie is set.
If something breaks in your browser, an error report is sent to Sentry, our error-monitoring provider, in the EU. It carries the error, the page address without its query string and your browser and device type, and no account id, email or IP address. Sentry sets no cookie and stores nothing in your browser.
On book sale pages and on our own website we measure, with our own code and without cookies or anything stored in your browser, where visitors click and how far they scroll (the page element and the position on it, the device type and the time); we record no IP address, nothing you type and no screen recording, and nothing at all if your browser sends Do Not Track or Global Privacy Control.
4. Browser storage that is not a cookie
The reader and the author CMS also keep a few things in your browser's local storage so they can pick up where you left off.
| What is stored | Where | How long |
|---|---|---|
| Reading position and reading settings, per book (xlive-live-…, xlive-reader-font / size / mode) | Reader | Until you clear your browser data |
| Purchase unlock cache for a book you bought (xlive-unlocked-…: the email you used at checkout; xlive-session-…: the checkout reference, removed once your purchase is linked to your account) | Reader | Until you clear your browser data; the checkout reference is removed automatically |
| Language choice (xlive-reader-language, cms-locale) | Reader, author CMS | Until you clear your browser data |
| Share-prompt and sign-in helpers (xlive-reader-shared-…, xlive-reader-otp-login and similar) | Reader | Some for the browser session only; others until you clear your browser data |
| Author preferences (xlive-tts-voice, share-link tags per book) | Author CMS | Until you clear your browser data |
| Uploads in progress, so an interrupted chapter audio or video upload can be continued after a reload (xlive.resumable-uploads.v1: the file’s name and size, and how much of it was uploaded; no file content) | Author CMS | Until the upload finishes or is cancelled. An entry older than a day can no longer be continued, and is removed the next time the chapter editor opens |
| Books saved for offline reading: the text, the cover and the audio and video we host for each book you choose to save (xlive-offline-…), and the files the app needs to open without a connection (xlive-shell-…). YouTube and Vimeo videos are never saved | Reader | Until you remove the book, sign out, or another account signs in on that browser. All saved books are deleted the next time you open the reader after the feature is switched off |
| That you dismissed the “Add to Home Screen” card, so it is not shown again on this device (xlive-pwa-install-dismissed) | Reader | 30 days |
These entries live in your browser's local storage or its offline cache, not in cookies. They stay on your device and are not sent to a server by themselves.
5. Counting visits to shared passages, without a cookie
When a reader shares a passage and someone opens their link, we count that visit once so the reader can earn a reward the author offers. We do this without a cookie and without storing anything in your browser, so it works whether or not you accept optional cookies.
To recognise the same visitor twice we store a one-way, keyed hash of your IP address and browser type, never the address itself. It cannot be turned back into your address, and we erase it after 30 days; what stays is only the count. Automated visitors (link previews, crawlers) and the person who shared the link are not counted.
6. Content from other providers
When an author embeds a YouTube or Vimeo video in a chapter, the video player is loaded from that provider when you open that chapter, and the provider may set its own cookies under its own policy. The same applies to a video an author links from another website.
Book files, cover images and sign-in are delivered through Supabase, the infrastructure provider this site runs on.
The sign-up, sign-in, one-time-code and password-reset forms load Cloudflare Turnstile, which checks that the request comes from a person rather than a bot. Cloudflare's script runs on those forms only, collects signals about your browser and device for that check, and is covered by Cloudflare's own privacy policy.
Payments are made on Stripe's own pages. When an author upgrades a plan and the bank asks for extra confirmation, Stripe's script is loaded on this site to show that step, and Stripe may set its own fraud-prevention cookies under its own policy.
7. Your choices
Today the notice only informs you, because nothing non-essential is set. You can reopen it at any time from “Cookie settings” in the page footer. When the site offers choices, you will be able to accept or reject each category, and your choice will be stored for six months in the xlive-consent cookie. You can also delete cookies from your browser settings at any time; doing so signs you out and forgets your language.
8. Changes to this page
When the cookies this site uses change, we update this page before the change goes live, and the cookie notice asks again where your choice is needed.
© 2026 XPublish Ltd. All rights reserved.