Privacy Policy

Two ways to use xNet — two very different privacy stories

xNet looks the same on the surface whether you run it yourself or let us host it for you, but who can see your data is completely different. Read the part that applies to you.

1. The app on your device, with your own hub (local-first). Used offline, synced peer-to-peer, or connected to a hub you operate — your data stays with you and we collect essentially nothing. No account required.
2. xNet Cloud (our managed, paid hosting). You create an account and we run a dedicated hub for you. To do that, we and our service providers necessarily process some of your information — and for a couple of features you turn on, we process your content in readable form. We are specific about all of it below.

We never sell your data, we don't show ads, and we don't use your content to train our own models.

1. The app and your own hub (local-first)

When you use the desktop or web app on its own, sync peer-to-peer between your devices, or connect to a Hub you host yourself:

• Your data stays on your device — Documents, notes, and files are stored locally in your browser or app
• Peer-to-peer sync — Data goes directly between your devices, not through our servers
• Your identity never leaves your device — Your cryptographic identity (a did:key) and private keys are generated on your device; only you hold them
• No account required — You can use xNet this way without creating an account or giving us your email

On this path we collect essentially nothing. We don't track you, we don't know who you are, and we can't access your content.

2. xNet Cloud — what we collect when you choose it

xNet Cloud is our optional, paid service that runs a dedicated hub for you so it's always on, backed up, and reachable from all your devices. Signing up is a deliberate choice, and it changes what we process. The rest of this policy describes the Cloud path.

What we can and can't see on xNet Cloud

This is the most important thing to understand, so we'll be precise rather than slogan-y:

• Your private keys / data identity: never sent to us. Your data identity is a passkey-backed key that lives on your devices, separate from your billing account. This is why deleting your data is irreversible even for us.
• Content at rest in backups: stored as encrypted, content-addressed blobs in object storage.
• Server-side search: to make your data searchable on your hub, the hub processes your content and builds a search index. For that feature, content is handled in readable form on your hub.
• Managed AI: when you use it, the messages you send are transmitted in readable form to our AI gateway and the model provider you select (see below).

In short: we are local-first and end-to-end where we can be, and explicitly — and disclosed — not, where a feature you opt into requires us to process your content.

Account information

Accounts for xNet Cloud are handled by WorkOS (AuthKit). When you sign up, we collect and store:

• Your email address (required — this is your recoverable billing identity)
• Your name, if you provide it
• An account identifier and basic session metadata (a signed, http-only cookie that keeps you logged in for up to 7 days)

Your billing identity (email, via WorkOS) is deliberately kept separate from your data identity (the passkey on your device). We can help you back into your account by email; we cannot read your data with it.

Payments

Paid plans are processed by Stripe. We do not see or store your full card details — Stripe does. To bill you, we share with Stripe your email, a customer reference, your chosen plan, and the amounts owed. If you use metered features (such as AI beyond your included budget), we send Stripe usage totals — never your content.

Where your data is hosted and stored

When you're on xNet Cloud, your dedicated hub and its data live with our infrastructure providers:

• Compute: your hub runs on Google Cloud Run
• Content & backups: your encrypted content blobs and continuous database backups are stored in Cloudflare R2, isolated to your tenant
• Control-plane records: tenant and billing metadata and AI usage totals are stored in Google Firestore

International transfers. These providers may process data in the United States and other countries. If you are in the EU/UK, your information may be transferred outside your region under appropriate safeguards (such as Standard Contractual Clauses). Enterprise plans can request region pinning (data residency).

See our full list of sub-processors for who does what, what data they receive, and where.

Managed AI

Paid plans include a managed AI gateway. It's off until you use it. When you send a message to the AI:

• Your message content is sent to our gateway provider, OpenRouter, which routes it to the model provider you choose (for example Anthropic, OpenAI, or Google).
• We record only token counts, the model used, and cost for billing — never your prompt or the response text.
• Retention, and whether your inputs are used to improve a model, are governed by OpenRouter's and the model provider's terms. Most providers do not train on API inputs by default. xNet does not currently offer a per-request training opt-out beyond that default, and we will not enable managed AI for you without your action.

xNet's on-device "second brain" embeddings are computed locally on your device and do not leave it.

Integrations you connect

xNet lets you connect external services. These are integrations you set up, and the external service's own privacy terms apply to data exchanged with it:

• Pull connectors (e.g. GitHub, Notion, Airtable, Linear, RSS) bring data into your hub as nodes you control.
• Outbound actions (e.g. Discord, Slack, Telegram, email, webhooks) send data you choose out when your nodes change.
• Inbound webhooks let external services post events into your hub.

The credentials for these integrations (API tokens, webhook secrets) are stored on your hub and are never sent to your browser. We treat connected services as services you choose, not as our sub-processors.

Plugins and the marketplace

Plugins from the marketplace are third-party software. Before a plugin is installed, the app shows you the capabilities it requests (such as which of your data it can read or write, and which hosts it may reach) and asks for your consent. Community plugins run in a sandbox with only the capabilities you grant. We don't receive your content because a plugin is installed; what a plugin does with data you grant it is governed by that plugin author's own terms. See the Marketplace Terms for details.

Website analytics

For xnet.fyi we use Plausible Analytics, a privacy-respecting, cookieless, open-source analytics tool, to understand how people find and use our site and documentation:

• Page views and referrers (no cookies, no personal data)
• General geographic region (country level, derived from IP — the raw IP is never stored)
• Browser and device type (for compatibility testing)

Because no personal data or persistent identifiers are collected, no consent banner is required. We don't use tracking cookies, fingerprinting, or any cross-site tracking.

Crash reporting and diagnostics

The web and hosted app can report crashes so we can fix what breaks. There are two separate ways this happens, and both are off unless you choose them — manage them under Settings → Privacy & Diagnostics.

Automatic crash reports are opt-in and off by default. When enabled, reports are scrubbed of personal data (paths, emails, IPs, tokens) before they leave your device, contain code-level diagnostics rather than your documents, and carry no unique identifier. They go to your own hub first: when your app is connected to a hub, crash reports land in that hub's private inbox — your infrastructure, your data — and never reach us. Only the hosted demo, running without a hub, sends them to our own first-party endpoint instead.

“Report a problem” is a one-off report you send deliberately. You write what went wrong, and before anything is sent you see the exact contents — recent diagnostic logs, coarse system info (browser and OS family only), and your description, all scrubbed — and can remove any part of it. Because you send it explicitly, it works even when automatic reporting is off.

Escalating to us is always a separate choice. Deployment owners can send an individual report to xNet (after previewing the exact payload), opt in to sharing anonymous crash counts (never contents), or grant our support identity time-boxed, revocable read access to their diagnostics workspace — each switch is independent and off by default.

Reports we receive land in a private queue and are kept only as long as needed to resolve the issue. Self-hosted builds send nothing to xNet — their crash reports stay on their own hub. (We do not use a third-party error service such as Sentry; the code keeps a dormant seam for one, unused.)

What we don't do

• We don't sell your data — Never have, never will
• We don't show ads — xNet is open source and supported by Cloud subscriptions
• We don't track you across the web — No third-party trackers
• We don't read your content for our own purposes — Server-side features you enable process your content only to provide that feature to you
• We don't use your content to train our own models — and we log AI usage, not your prompts

Data security

xNet uses strong cryptography throughout:

• Ed25519 for digital signatures
• XChaCha20-Poly1305 for encryption
• BLAKE3 for hashing and content addressing
• TLS/SSL for all network connections

Your cryptographic identity (DID:key) is generated on your device and never leaves it. Only you have access to your private keys.

Data retention and deletion

For xNet Cloud:

• While your subscription is active, we retain your hub and its backups so the service works.
• If you cancel or payment lapses, your hub is suspended and your encrypted backup is retained for a grace window so you can re-subscribe or export. After the grace window, it is deleted.
• If you choose "Delete my data," we destroy your hub and its backups. This is explicit and irreversible — because your content is keyed to an identity only you hold, we cannot recover it for you afterward.
• Account and billing records (held by WorkOS and Stripe) may be retained as required for legal, tax, and accounting purposes.
• Diagnostics and short-lived metadata (such as device-grant codes and connection logs) expire on short timers.

Your rights

On the local-first path you already have most data rights by default — your data is on your device, you can export it any time, and you delete it by removing the app or clearing storage.

For data we process on xNet Cloud, you can:

• Access & portability — Export your data from the app or dashboard at any time
• Deletion — Delete your data and account from the dashboard
• Correction — Edit your data directly, and update account details via WorkOS
• Object / restrict / complain — Where the GDPR, UK GDPR, CCPA/CPRA, or similar laws apply, you may exercise the corresponding rights, including lodging a complaint with your local authority

To make a request about data associated with your account or hub, contact privacy@xnet.fyi.

Self-hosting

You can run your own Hub on your own infrastructure. When self-hosting:

• Your data never touches our servers
• You control all logs and retention
• You're responsible for your own security and backups

See our Hub setup guide for instructions.

Children's privacy

xNet Cloud is not directed at children. We do not knowingly create accounts for, or collect personal information from, children under 16 (or the minimum age of digital consent in your country). If you believe a child has provided us personal information, contact us and we'll delete it.

Sub-processors

We rely on a small set of third parties to run xNet Cloud (such as WorkOS, Stripe, Google Cloud, Cloudflare, and OpenRouter). The local-first app and self-hosted hubs use none of them. See the current sub-processor list for who they are, what they receive, and where they operate.

Changes to this policy

We may update this policy occasionally. When we do, we'll update the date at the top and post a notice on our website. For significant changes affecting xNet Cloud, we'll provide more prominent notice, and where appropriate notify account holders by email.

You can track all changes in our GitHub repository.

Contact us

Questions about privacy? Reach out:

• Email: privacy@xnet.fyi
• GitHub: Open an issue