Legal
Privacy policy
Effective 14 October 2026 · applies to https://xr-gules.vercel.app
The short version. The XR you install on your machine does not send us anything. It does not have an analytics endpoint, a crash reporter or a licence heartbeat, and it works identically if you never create an account. This policy is about the cloud service that exists only for the Business tier — accounts, teams, billing, SSO, the relay and team memory. If you use XR alone, nothing on this page applies to you because there is nothing to apply it to.
1. What the local software does with your data
Nothing leaves your machine unless you ask it to. Prompts go from your machine directly to the model provider you configured, using the API key you supplied. XR is not in the middle and does not see them.
XR stores your conversations, memory, workspaces, agents and settings in a local database in your own user directory. Uninstalling the app does not delete that directory, on the assumption that losing your memory because you reinstalled would be the wrong default. There is a documented command to delete it.
The desktop application does not contact XR servers at all in Personal mode. If you would like to verify that rather than take our word for it, the check is one command and it is written up in the security documentation.
2. What the cloud service stores
If you create a team, the following is stored on infrastructure we operate or rent:
| Category | Stored | Why |
|---|---|---|
| Account | Email address, display name, an argon2id password hash if you set a password, and the timestamps of sign-in events.To let you sign in. The IP is stored masked after 24 hours — we keep the city-level prefix for abuse detection and discard the rest. | To let you sign in. The IP is stored masked after 24 hours — we keep the city-level prefix for abuse detection and discard the rest. |
| Organization | Team name, a URL slug, member list with roles, and the invitation history.To run the team. Membership is what every authorization check reads. | To run the team. Membership is what every authorization check reads. |
| Billing | Stripe customer and subscription identifiers, seat count, plan, invoice history.To bill you and to answer 'what am I paying for'. We never receive or store a card number — checkout is hosted by Stripe. | To bill you and to answer 'what am I paying for'. We never receive or store a card number — checkout is hosted by Stripe. |
| Team memory | The facts your team chose to share, encrypted per fact with a key derived per workspace, plus a digest for integrity.This is the feature. The plaintext is never written to the database. | This is the feature. The plaintext is never written to the database. |
| Audit log | Administrative actions and data-access events, hash-chained.So an auditor can be handed something that is tamper-evident rather than a CSV we could have edited. | So an auditor can be handed something that is tamper-evident rather than a CSV we could have edited. |
| Usage counters | Per-user token counts and cost, per day and per month.To enforce spend caps. Counts are stored; the content that produced them is not. | To enforce spend caps. Counts are stored; the content that produced them is not. |
| Sessions | Refresh token hashes, device user-agent, masked IP, expiry.To let you see and revoke devices. We store a hash, so a stolen database does not yield a usable session. | To let you see and revoke devices. We store a hash, so a stolen database does not yield a usable session. |
3. What we never receive
- Your prompts or completions, when you use your own API keys. They never pass through us.
- Any file, repository, terminal output or screen content from your machine.
- Any analytics, telemetry, crash report or session recording, from the app or from this website.
- Your contacts, calendar, location or device identifiers.
- Anything at all, if you use XR without an account.
When you use managed models a prompt does pass through the cloud service, because that is what proxying is. It is forwarded and metered, not stored: the audit entry records the model identifier and the prompt length, and the test suite asserts the prompt text is absent from the log. That is the one case in which we handle your content, and it only happens for teams that chose managed models over their own keys.
4. How long we keep things
| Category | Stored | Why |
|---|---|---|
| Active accounts | Until you delete themYou can delete from the console. Deletion schedules a purge and emails you the date. | You can delete from the console. Deletion schedules a purge and emails you the date. |
| Deleted accounts and teams | 30 days, then purgedThe window exists so that a mistaken deletion is recoverable. After it closes, the data is gone — not archived, not retained. | The window exists so that a mistaken deletion is recoverable. After it closes, the data is gone — not archived, not retained. |
| Team memory and audit logs, after cancellation | 30 days, exportableEvery day of the window you can export both in full. The purge date is shown in the console rather than buried in a policy. | Every day of the window you can export both in full. The purge date is shown in the console rather than buried in a policy. |
| Usage counters | Current day and current month onlyOlder counters are aggregated and the detail is discarded; there is no per-request history to subpoena. | Older counters are aggregated and the detail is discarded; there is no per-request history to subpoena. |
| Sign-in attempts | 90 daysFor abuse detection. Masked IP only. | For abuse detection. Masked IP only. |
| Server and access logs | 14 daysStandard request logs at the edge. No third-party analytics processor is involved. | Standard request logs at the edge. No third-party analytics processor is involved. |
5. Who we share it with
Four sub-processors, each listed with exactly what it sees on the security page. Three of them are unreachable unless a customer action calls them. We do not sell data, we do not share it with advertisers, and there is no advertising SDK anywhere in the product or on this site.
We disclose data to law enforcement when we are legally compelled to and the demand is valid on its face. Where we are permitted to tell you, we will. Where we are not, we will say so in a transparency note in the changelog once the gag order lapses — the audit chain means we cannot quietly produce data we never logged in the first place.
6. Where it lives
The hosted service runs in a single region in the United States by default, with a European region available on request for Enterprise. Self-hosting the whole control plane is supported and documented, and if you do that, no data reaches us at all.
7. Your controls
- Export. Team memory as plaintext JSON and the audit log as CSV, at any time, from the console. Self-service, no support ticket.
- Delete. Account deletion from the console, with a 30-day recovery window and a confirmation email stating the purge date.
- Revoke. Every session and every device is visible under Settings and can be revoked individually. Revocation is immediate because roles and sessions are re-read per request rather than cached.
- Refuse. Every non-essential cookie is one we set ourselves for session and CSRF purposes. There is no consent banner because there is nothing to consent to.
8. Changes
Material changes are announced in the changelog and by email to organization owners at least 30 days before they take effect. The version history of this document is in the public repository, so a change is a diff you can read rather than a note we claim to have sent.
Questions about any of this, including requests that do not fit a form: privacy@xr.rrrtx.ai. A human answers. See also the terms and the security and trust page.