Privacy policy

Last updated: 2026-05-10

xinteraction is operated by Heather Huang as a sole proprietor. This policy describes what data we collect, why, and how to access or delete it. Direct questions to heathermhuang@gmail.com.

What we collect

• Email address — used as your account identity and to deliver one-time sign-in links.
• BYOK API keys — your Anthropic / OpenAI keys, stored encrypted-at-rest with a server-side master key. Never logged in plaintext.
• Workspace data — projects, conversations, generated artifacts, preview comments, deployment metadata. Stored in our SQLite database to provide the service.
• Usage metadata — timestamps and counts of agent runs for quota enforcement and abuse prevention.
• Billing data — if you subscribe, your Stripe customer ID and subscription status. Stripe stores the actual payment method; we never see your card.
• Server logs — IP address, user-agent, and request path are kept in transient access logs for diagnostic and abuse-mitigation purposes (typically 30 days).

What we do with it

To run the service: authenticate you, route your runs through your own BYOK key, render previews, persist your projects, enforce quotas, and bill you (if you subscribe). Aggregate metrics may be used to improve the product. We do not sell or rent personal data, and we do not use your prompts or artifacts to train any AI model.

Third-party processors

• Anthropic — your prompts are sent to Anthropic's API via your own BYOK key. Anthropic's privacy policy applies to those requests.
• Stripe — handles all payment processing if you subscribe to Pro.
• Resend — delivers transactional email (sign-in links, receipts).
• Render — hosts the daemon and database (Singapore region).
• Cloudflare — fronts the application and marketing site.

Your rights

From Settings → Billing → Account you can:

• Download your data as a JSON export (GDPR Article 15 / 20).
• Delete your account permanently (GDPR Article 17). All workspace data is removed; Stripe records are retained as required by tax/financial law.

For requests we don't currently surface in the UI (rectification, restriction, objection), email heathermhuang@gmail.com and we'll respond within 30 days.

Retention

Your account and workspace data persist until you delete your account. Server access logs roll over after 30 days. Stripe billing records are retained for the period required by tax authorities (typically 7 years).

Cookies

We set a single first-party session cookie (od_session) when you sign in. No advertising, analytics, or tracking cookies.

Changes

If we update this policy in a way that materially affects how we handle your data, we'll email all active users before the change takes effect.