Privacy Policy

Who we are and what CxCave does

CxCave (“CxCave”, “we”, “us”) is an independent website at cxcave.com for contact center professionals. It publishes release intelligence about contact center platforms such as Genesys Cloud, Amazon Connect, Webex Contact Center, NICE CXone and Five9, curated from official vendor sources, and a free Build Library of official implementation resources.

This policy explains how we handle personal information when you read the website and when you create or use an optional CxCave account, including when you sign in with Google. Release notes, platform pages and the Build Library are public and can be read without an account.

Personal information we collect

We collect only what we need to run the website and accounts:

• Account information: your email address, a password if you register with email (handled as described below), and the display name and avatar image URL you choose to provide.
• Google profile information: if you choose Google Sign-In, the basic profile details described in the next section.
• Account and security records: account creation and last sign-in times, whether your email address is verified, which sign-in method you use, and, for active sessions and security events, the IP address and browser user agent used to sign in.
• Usage and device information: pages viewed, interactions, referring page, approximate location derived from IP address, browser, device and operating system, collected by our analytics provider and by our hosting provider’s request logs.
• Messages you send us: the content of any email you send and your email address, so we can reply.

We do not ask for payment details, phone numbers, postal addresses, government identifiers or other sensitive categories of information.

Information received through Google Sign-In

Google Sign-In is an optional way to sign in. CxCave uses it only to authenticate you and to create or manage your CxCave account. When you choose “Continue with Google”, Google asks for your permission and then shares the following with CxCave:

• your Google account identifier (a unique number that lets us recognize you the next time you sign in);
• your email address and whether Google has verified it;
• your name; and
• the URL of your Google profile picture.

We never receive your Google password. If you already have a CxCave account with the same verified email address, Google Sign-In may be linked to that account so you can use either method.

Google OAuth scopes and how Google data is used

CxCave requests only Google’s standard sign-in scopes:

• openid to confirm your identity;
• email (userinfo.email) to see your primary email address; and
• profile (userinfo.profile) to see basic profile information such as your name and profile picture.

CxCave does not request access to Gmail, Google Drive, Google Contacts, Google Calendar, YouTube or any other Google service, and cannot read, send or change any data in your Google account.

We use Google profile data only to:

• sign you in and keep your account secure;
• create your CxCave account and profile;
• prefill your display name and avatar, which you can change at any time; and
• contact you about your account, for example about sign-in or security.

We do not sell Google user data, use it for advertising, use it to train artificial intelligence or machine learning models, or share it with anyone except the service providers described below that are needed to operate sign-in. Google issues a short-lived access token during sign-in; CxCave does not store that token in its database and does not use it to call any Google API.

CxCave’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Authentication and account management

Accounts are free and optional. You can register with an email address and password or with Google. Email registrations must confirm their address through a verification link before signing in, and you can reset a forgotten password by email.

Passwords are processed by our authentication provider, Supabase, and stored only as a one-way cryptographic hash; CxCave cannot see your password. When you sign in, we set first-party cookies on cxcave.com that hold your session tokens so you stay signed in across visits. Signing out ends the session on our servers and removes those cookies from your browser. Sign-in uses industry-standard OAuth 2.0 with PKCE, and redirects back to CxCave are restricted to our own pages.

We use your email address for essential account messages such as verification, password reset and security notices. We do not send marketing email without your consent.

Saved resources and future game data

Your account currently stores only your profile (display name and avatar URL). The dashboard shows planned features that are not yet available: saved release notes, saved blueprints, learning progress and game achievements.

When those features launch, we will store the items you choose to save, your learning progress, and game scores and achievements in our database, linked to your account and visible only to you unless a feature clearly says otherwise. We will update this policy before collecting any new type of information, and this data will be deleted when your account is deleted.

Supabase storage and data processing

CxCave uses Supabase to provide authentication and the database that holds account and profile information. Our Supabase project is hosted in the United States (AWS us-east-1 region). Supabase processes this information on our behalf to authenticate users, send account emails, keep sessions secure and store account data.

Database access is protected by row-level security policies so that a signed-in person can read and change only their own profile. Administrative credentials are kept on our servers and are never sent to your browser.

PostHog analytics and cookies

CxCave uses PostHog, a product analytics service hosted in the United States, to understand which content is useful, improve navigation and find errors. PostHog may collect:

• page views, time on page, clicks and interactions, and filters or links you use;
• session replays that record how pages are used (with form inputs masked) and heatmaps of where visitors click;
• browser errors, console messages and performance measurements; and
• IP address, approximate location, browser, device, operating system and referring page.

We do not send your name, email address or Google profile data to PostHog as part of your analytics profile, and the account menu, sign-in, profile and dashboard pages are excluded from click capture and session replay. Session replays are retained for 30 days.

Cookies and browser storage. CxCave uses:

• Essential authentication cookies (names beginning with sb-), set only when you sign in. They keep you signed in and are removed when you sign out. Without them you cannot stay signed in, but public content remains available.
• Analytics cookies and local storage (names beginning with ph_), set by PostHog to recognize a returning browser and group activity into sessions.

You can block or delete cookies and local storage in your browser settings, or use a content blocker to stop analytics; the public site keeps working.

Service providers and data sharing

We do not sell or rent personal information, and we do not share it for cross-context behavioral advertising. We share information only with service providers that help us operate CxCave, and only as needed for the services they provide:

• Supabase: authentication, account database and account emails.
• Google: identity verification when you choose Google Sign-In.
• Vercel: website hosting and delivery, which involves processing request data such as IP address, browser and requested pages (Vercel privacy policy).
• PostHog: product analytics, as described above.
• Email delivery provider: sending verification, password reset and security emails.

We may also disclose information if required by law or to protect the safety, rights or security of CxCave, its users or others. These providers may process information in the United States.

Data security

We protect information with encrypted HTTPS connections, hashed passwords, OAuth 2.0 with PKCE, database row-level security, server-only administrative credentials, and least-privilege access for our own monitoring. Search engines are instructed not to index account pages. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; please use a unique password and sign out on shared devices. If we learn of a security incident affecting your personal information, we will notify you as required by law.

Data retention

• Account and profile data is kept while your account exists and is deleted when the account is deleted.
• Session replays are kept for 30 days. Other analytics data is kept according to our PostHog retention settings.
• Security and request logs kept by Supabase and Vercel are retained for limited periods under their retention schedules.
• Backups maintained by our providers may contain deleted data until they are overwritten in the normal course.
• Emails you send us are kept as long as needed to respond and keep a record of the request.

Account and data deletion

You can delete your CxCave account and its associated data at any time. Email thahmid.zuberi@royalztech.com from the email address on your account with the subject “Delete my CxCave account”. We will verify the request, delete your account and profile (which removes your Google-derived name, email and avatar URL from our database), and confirm by email.

You can also request deletion of analytics data associated with your browser, or of any other personal information we hold, at the same address. If you signed in with Google, you can remove CxCave’s access at any time from your Google Account third-party connections page; this stops future Google sign-ins but does not by itself delete your CxCave account.

Your privacy rights

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent where processing is based on consent. You can correct your display name and avatar directly in your account. To make any other request, email thahmid.zuberi@royalztech.com. We may need to verify your identity before acting, we will respond within the time required by applicable law, and we will not discriminate against you for exercising your rights. You may also have the right to complain to your local data protection authority.

Children

CxCave is intended for professionals and is not directed to children. You must be at least 16 years old to create an account. We do not knowingly collect personal information from children under 16; if you believe a child has created an account, contact us and we will delete it.

Contact, effective date and updates

For privacy questions, data requests or account deletion, contact thahmid.zuberi@royalztech.com.

This policy is effective as of October 26, 2026. If we change how we handle personal information, including when new account features launch, we will update this page and the date above before the change takes effect, and will notify account holders by email or on the site for significant changes. See also our Terms of Use.