XenpenLaw Enforcement Guidelines
Every Xenpen member verifies their identity, and we want our community to stay safe and protected under the law. When a crime involves Xenpen, we help investigators with the records we have, when they give us valid legal process. We also protect our members’ privacy: we don’t give anyone open access to accounts or conversations.
Our principles
- Valid legal process. We disclose member records only in response to legal process that is valid in the place it was issued and that we are required to follow, or in an emergency described below. Requests must be specific: name the account (username, profile link, or transaction ID) and the records and dates sought.
- The process matches the record. In the United States, we follow the Stored Communications Act: basic account records with a subpoena; other non-content records with a court order (18 U.S.C. § 2703(d)); and the content of messages, including photos, videos, voice messages, files, and deleted messages, only with a search warrant.
- We tell members. We notify the member before disclosing their records, unless the law or a court order prohibits it, or notice would create a risk of harm or be counterproductive in an emergency. When a non-disclosure order ends, we notify the member then.
- Narrow requests. We may push back on, or ask to narrow, requests that are unclear, overly broad, or not legally valid.
Records Xenpen may have
| Record | What it includes | Usually needed (US) |
|---|---|---|
| Basic account records | Username, display name, email address, sign-in method, date the account was created, verification status and date, legal name and date of birth from verification, and transaction IDs | Subpoena |
| Activity records | Listings (including expired or removed ones), purchase requests, sales, rentals, hired jobs, bids, reviews, reports, and in-app payment records (amounts, dates, status, and the last 4 digits of payout accounts) | Court order |
| Message records | Who messaged whom and when, without content | Court order |
| Message content | Messages and their photos, videos, voice messages, files, stickers, and shared locations, including copies of messages the sender deleted (kept for 1 year after deletion) | Search warrant |
What Xenpen doesn’t have: images of members’ IDs or selfies (our verification partner, Didit, handles those under its own policies), full card or bank numbers (held by Stripe in the United States and PayMongo in the Philippines), or anything a member deleted outside the retention periods in our Privacy Policy. Requests for those should go to the company that holds them.
Preservation requests
While you obtain legal process, we will preserve the records of a specific account for 90 days when an official requests it (in the US, under 18 U.S.C. § 2703(f)), and for another 90 days if the request is renewed. Preserved records, including deleted messages, are not deleted while the hold lasts. Preserving records is not disclosing them.
Emergencies
If you believe someone is in imminent danger of death or serious physical injury, we may disclose records without legal process when we believe in good faith that it may prevent the harm. Mark the request “Emergency,” describe the emergency and how the records would help, and send it from an official government email address. Every emergency request is reviewed by a person.
Requests from outside the United States
Xenpen operates in the United States and the Philippines. Philippine authorities may send court-issued warrants under the Rule on Cybercrime Warrants (such as a Warrant to Disclose Computer Data) or other legal process valid in the Philippines. For other countries, a Mutual Legal Assistance Treaty request or another process recognized by US law may be required. We may still preserve records and respond to emergencies.
How to submit a request
Email support@xenpen.com with the subject “Law enforcement request” (or “Emergency”) from an official government email address, and include:
- your name, agency, badge or ID number, and a way to reach you;
- the legal process, signed and attached as a PDF (for preservation requests, the request on agency letterhead);
- the Xenpen username, profile link, or transaction ID (such as S-7K3P-9QXM);
- the specific records sought and the date range; and
- any non-disclosure order, if one applies.
We don’t accept requests from private parties for member records. Members and their lawyers who need records for a civil case can ask the member to request their own data through Xenpen Support, or serve legal process on the other party. We may charge reasonable costs where the law allows.
For members
Report crimes to your local police first. If you were scammed or harmed through Xenpen, report the person in the app and contact Xenpen Support with the transaction ID, so our moderators can act and preserve the records investigators may need. See also our Terms and Privacy Policy.