Privacy policy

Xodus helps people rebuild after incarceration, and helps the officers, case managers, support people and organizations working with them stay on the same plan. Doing that means holding information that is genuinely sensitive — where you live, whether you are on parole, what treatment you need, documents proving you completed a condition. This policy explains what we collect, who can see it, and what we will never do with it.

Who we are

Xodus is operated by LIIVDATA, 1201 North Orange Street, Suite 7065, Wilmington, DE 19801, United States. Where this policy says "we", "us" or "Xodus", it means that company. We are responsible for the personal information described here, and we are the people to contact about it.

This policy covers the Xodus website and the Xodus mobile apps for iOS and Android. The mobile apps show the same service as the website, so everything here applies equally to both.

The four kinds of account

What we hold about you, and who can see it, depends on why you are here. There are four kinds of account, plus administrators who run the platform.

What we collect

Almost everything we hold is information you or your support team typed in. We do not buy personal information, and we do not build a profile of you from other websites.

What we do not collect

• Payment or card details. Xodus is free for people in reentry and there is nothing to buy in the app.
• Your location. The app does not request or track where your device is.
• Advertising identifiers, or any data used for advertising.
• Analytics or usage tracking. There is no analytics or crash-reporting service running in the app.
• Your contacts, photo library, browsing history or search history from outside Xodus. Choosing a photo to upload gives us that photo, not your library.

Health, treatment and criminal justice information

Some of what Xodus holds is more sensitive than ordinary contact details: that you need mental health or drug treatment, that you are under supervision, the conditions of that supervision, and documents about all of it. We treat this as the most protected information in the system.

• It is visible only to you and to the support team connected to your account. It is never public and never part of a listing.
• It is never used for advertising, marketing, or any purpose other than running the service for you.
• It is never sold, rented or licensed to anyone, for any price.
• Partner organizations do not see it. When you apply to a job or contact an organization, they see your application — not your treatment needs or your conditions.

Xodus is not a healthcare provider and gives no medical advice. Information here about treatment describes referrals to organizations that provide it, and your own record of what you have arranged.

Information about other people

Parole officers and case managers can invite someone to Xodus and record information about them, and support people are connected by the person they support. That means we sometimes hold information about you that somebody else entered.

It is still your information and you still have every right described below over it. If you have an account, you can see and correct what is held about you by opening your profile. If someone has entered information about you and you do not have an account, contact us and we will tell you what we hold and remove it if you ask.

If you supervise or support people through Xodus, you are responsible for entering their information accurately and lawfully, and for having whatever authority or consent your role requires.

Who can see your information

• You, always.
• The parole officer or case manager assigned to you, and any support person you are connected with.
• A partner organization or employer, only for an application or enquiry you send them.
• Xodus administrators, who can access accounts to run the platform, investigate a problem or respond to a report. Access is limited to staff who need it for their job.
• Our service providers, listed in the next section, and only to the extent they need it to do their part.

Beyond that we disclose personal information only where the law requires it — a subpoena, warrant or court order — where it is necessary to protect someone from serious harm, or where you have asked us to. If Xodus is ever sold or merged, your information may transfer with it, and we will tell you before that changes anything in this policy.

Service providers

Xodus runs on other companies' infrastructure. Each one receives only what it needs, is contractually bound to handle it for us and not for themselves, and is not permitted to sell it.

Our operations and our providers are in the United States, so if you use Xodus from elsewhere your information is transferred to and stored in the United States.

How the plan and recommendations are generated

Xodus can generate a personalized reentry plan and suggest organizations that fit your situation. That uses an AI service run by OpenAI, so it is worth being precise about what leaves our systems.

What is sent

• Your gender, and the year of your birth — the year only, not the full date
• Your status, risk level, and whether you are on parole
• Your housing status and education
• Your skills, and your work history as job titles and employers
• The categories of help you need or are interested in
• The list of partner organizations we might recommend

What is not sent

• Your name, email address, phone number or home address
• Your date of birth beyond the year
• Any document or photo you have uploaded
• Your Social Security, State ID or birth certificate details — we never hold these

OpenAI processes this on our behalf to answer that one request and is not permitted to use it to train its models. The plan it produces is a suggestion, reviewed by you and your support team — it is not a decision about you, and nothing in Xodus decides your eligibility for anything automatically.

Documents and photos you upload

Files you upload are stored in access-controlled storage, not on the public web. Reading one requires a link that Xodus generates for a signed-in person who is allowed to see it, and that link expires. Nothing about a file name or address makes it findable by guessing.

One exception, so it is clear: images a partner organization uploads for its own public listing — a logo or a photo of a facility — are published deliberately, because the listing is meant to be seen. Personal documents are never stored that way.

You can remove a file you uploaded by replacing or deleting it in the app, and everything you uploaded is deleted when you delete your account.

Email, text messages and notifications

We email you for reasons tied to your account: sign-in links, password resets, invitations, meeting notices and confirmations such as a deletion receipt. We may send text-message reminders about meetings to the phone number on your profile.

We do not run a marketing mailing list and we do not send promotional email. You cannot opt out of the messages needed to operate your account — a password reset, or notice of a change to this policy — but you can turn off meeting reminders by removing your phone number from your profile, or ask us to stop sending them.

Cookies and staying signed in

When you sign in, Xodus sets a cookie so you stay signed in. It holds a signed session identifier, nothing about you. It lasts until it expires or you sign out, and signing out or resetting your password ends it.

That, plus what your browser needs to load the pages, is all. There are no advertising cookies, no third-party trackers, no analytics scripts and no social-media plugins on Xodus. Because we do not track you across other websites, there is nothing here for a Do Not Track or Global Privacy Control signal to turn off.

How long we keep it

We keep your information for as long as your account is open, because the service is a record of your progress and that record is the point. We do not delete your plan or your completed conditions on a timer.

When you delete your account, the deletion happens immediately — see the next section. Two things outlive it, deliberately:

• Resource listings and job postings you published stay visible, because other people rely on them, but they are no longer linked to you.
• If you supervised or supported people on Xodus, their records are not deleted with your account — that is their information, not yours. They are detached from you and await reassignment.

We may also keep a limited record where the law requires it, or where we need it to resolve a dispute or enforce our terms.

Deleting your account

You can delete your account yourself, from inside the app, without asking us. It is on the same profile page for every kind of account.

Before you confirm, Xodus shows you exactly what will be deleted and what will be kept. Deletion is immediate and permanent — there is no grace period and no undo. Your profile, plan, conditions, meetings, applications and uploaded files are removed, your sessions end, and we email you a receipt. If you are the last administrator of the platform, deletion is refused, because it would leave nobody able to run it.

Your choices and your rights

• See what we hold. Most of it is on your profile. For a full copy, email us from the address on your account.
• Correct it. Edit your profile directly, or ask your case manager to fix something they entered.
• Delete it. Use Delete Account, above, or ask us to do it.
• Object or complain. Tell us and we will look into it.

Depending on where you live you may have additional rights — to a portable copy of your data, to limit how we use sensitive information, or to appeal a decision we make about a request. We honour these requests regardless of where you live rather than checking your state first. We will not treat you differently for exercising any of them; nothing in Xodus is withheld from people who ask about their privacy.

We answer requests within 30 days. We may need to confirm who you are before acting on one, so that nobody else can request your information.

How we protect it

Practical measures rather than promises:

• Everything travels over an encrypted connection (HTTPS/TLS). The apps refuse unencrypted connections to the service.
• Passwords are stored as one-way hashes. Nobody at Xodus can read your password, and we will never ask you for it.
• What you can see is enforced by your role on every request, on the server — not hidden in the interface.
• Uploaded files sit in access-controlled storage reached only through short-lived links issued to someone allowed to see them.
• Resetting your password signs out every session, so a session someone else holds stops working.
• Staff access is limited to people who need it for their job.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal information we will tell you and the relevant authorities as the law requires. If you find a security problem, email us — we would rather hear it from you.

Children

Xodus is built for adults and for young people working with a supervising agency. It is not directed at children under 13 and we do not knowingly collect their information. If we learn that we have, we will delete it. If you believe a child has given us information, contact us and we will remove it.

Changes to this policy

When we change this policy we update the date at the top and post the new version here. If a change materially affects how we use your information, we will email the address on your account before it takes effect, so that you can decide whether to continue using Xodus.

Contact us

Questions about this policy, or about your information, go to a person who can act on them:

• Email: info@xodus-pre.com
• Phone: 718-501-9230
• Mail: Xodus, 1201 North Orange Street, Suite 7065, Wilmington, DE 19801, United States

If you have raised something with us and are not satisfied with how we handled it, tell us and we will escalate it internally before you have to go anywhere else.