Location in XOM is coarse and declared, not sensed. The platform stores a country on the user record and matches advertising against named geographies. There is no device geolocation in the reviewed codebase — no call to the browser geolocation API anywhere in the application, library or utility code.
01Where location is stored
The user document carries a small demographic block alongside identity and role fields: country, date of birth and gender, described in the platform architecture as demographics for ad analytics. Country is a nullable string and is initialised to null when a user document is created, so it is populated later — during registration or profile completion — rather than inferred at signup.
Those fields sit next to the platform's consent flags for privacy policy and terms acceptance, which is the right adjacency: they exist because they are used for targeting and analytics, and that use is what consent covers.
02Where location is used
Advertising is the primary consumer. Every ad creative carries a targeting block of user types, interests and geographies, and the ad engine filters candidate creatives against a user profile at serve time, alongside interests, engagement rate and follower count. In the ad manager interface, geographies is entered as a comma-separated text field, with "global" or a region list such as "US, EU, UK" as the conventional values. Because the field is free text rather than a fixed enumeration, consistency depends on operator discipline.
A second consumer is eligibility. The shared platform authentication matrix records that when a user submits an XP or mission action, the policy check evaluates mission eligibility by region, age and licence before allowing participation — so region can gate access to an event, not only the ads shown alongside it.
03What this is not
Three things a reader may expect are absent. There is no continuous position tracking: nothing in the client requests the device's location. There is no place-based content surface: the feed is tuned by algorithm and by thirty-four industry verticals, not by proximity. And there is no mapping layer in the application — the country value is a string on a record, not a coordinate.
Anyone documenting or extending this area should treat the current model as declared-country plus operator-defined region tags, and specify a permission, accuracy and retention model before anything finer-grained is introduced.