Privacy Policy

1. Scope and contact

This policy covers the xHalo websites, account, and products that link to it. Different features need different information; what we process depends on what you use. Unless stated otherwise, xHalo is responsible for the processing described here.

For privacy questions or requests to access, correct, or delete information, email support@xhalo.co.

2. Information used by different services

Account information includes your email, display name, avatar, language preferences, sign-in method, sessions, and security records.

Writing, AI, and research tools may process drafts, files, images, audio, video, prompts, reference material, and generated results you submit or request. Chat, Mail, and community features also handle messages, attachments, and information needed to send, receive, or publish them. Learning features may store progress, exercise results, and review history, depending on the feature.

Running services may require IP addresses, device and browser details, request times, referral URLs, errors, task status, and usage records. API, CLI, and MCP calls also involve information needed to authenticate and execute requests.

3. How and why information is processed

We use information to deliver requested features, manage accounts and permissions, save and synchronize content, run tasks, measure usage, troubleshoot problems, and protect services. It also supports assistance, service notices, and legal obligations.

Some Image tools can process files locally in your browser. Uploads, cloud generation, storage, and server calls enter the relevant service’s processing flow. Check each feature’s explanation: “local first” does not mean every action is offline or that nothing is uploaded.

Depending on the situation, processing may rely on our contract with you, legitimate security and service interests, legal duties, or consent. Where consent applies, you can withdraw it without affecting earlier lawful processing.

4. Cookies, local storage, and analytics

Essential cookies and browser storage maintain sessions, save language and theme preferences, remember return locations, and protect accounts. You can manage them in your browser; blocking necessary storage may affect sign-in or features.

Some xHalo webpages use Microsoft Clarity for clicks, scrolling, navigation, heatmaps, and session replay. Clarity may use cookies or similar technologies and mask content according to its configuration. Masking and hashing do not necessarily make information anonymous.

Page analytics, stored business content, and operational statistics serve different purposes. For example, Story operation statistics use a limited set of event fields, rather than draft text as event properties. See the provider notices below for analytics data and retention rules.

5. Sign-in and security providers

xHalo uses a shared identity service for sign-in, sessions, and access checks. If you choose Google, Microsoft, or another provider, we receive the account identifiers and necessary profile information it authorizes. The provider also processes information under its own policy.

Cloudflare supplies some infrastructure, security, and Turnstile bot checks. Turnstile processes browser and device signals to distinguish people from automation; Turnstile itself does not read, store, or transmit user communications, form entries, or other page inputs.

6. AI, communications, and other providers

When you use AI generation, speech, retrieval, or external tools, inputs, context, or files needed for the task may be processed by the relevant model or service provider. Material you provide can contain personal or third-party information. Check the processing scope and your authority to submit it. Providers’ data rules vary with the service and their policies.

Sharing through a chat room, email, community, or blog makes information available to members, recipients, or visitors within the chosen audience. Sending or publishing is different from keeping content in a private workspace.

We also share information as needed for infrastructure, authentication, storage, analytics, communications, and support; at your direction; for workspace administration; or for legal and safety requirements. We do not sell private workspace content. Providers should process it within their agreed role and with appropriate safeguards.

7. International processing

xHalo and its providers may process information in countries other than yours. Where required, we use recognized contractual or legal safeguards for international transfers and consider the sensitivity of the data and provider controls.

8. Retention and deletion

We retain account and service information while needed to provide services. Some records may remain for security, legal duties, disputes, backup rotation, or operations. Periods vary by product and data type.

Deleting an account or content does not necessarily remove caches, backups, required records, or copies already sent to other people or providers at the same time. External analytics also follows provider-specific retention rules; one data type’s retention period is not a universal limit.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal data, and to withdraw consent. You may also complain to your local data-protection authority.

Use profile settings where available or email support@xhalo.co. We may need to verify your identity and may retain information when an exception under applicable law applies.

10. Security

We use access controls, encryption in transit, monitoring, rate limits, bot protection, backups, and separated service responsibilities. No online system is completely secure. Protect credentials and developer keys, and report suspected misuse.

Do not share sessions, API keys, or access tokens publicly. Give connected tools only the access you need and revoke authorization when it is no longer needed.

11. Children

xHalo is not directed to children under 18, and we do not knowingly collect their personal information. If you believe a child has provided information, contact us so we can investigate and delete it when appropriate.

12. Changes and contact

We may update this policy when services, providers, or legal requirements change. We will update the date above and provide additional notice for material changes when appropriate.

Contact support@xhalo.co for privacy questions, requests, or complaints.