Clear details about what Xaro handles and why.

01

Scope

Xaro, Inc., a Delaware corporation, operates Xaro and is responsible for the personal information described in this policy. This policy applies to the xaro.app public website, web app, installed web experience, account and room services, collaboration surfaces, notifications, billing connections, integrations, and optional AI features. A linked third-party service applies its own privacy terms to its independent processing.

02

Account and profile information

Xaro processes information used to create, secure, present, and manage an account.

• Email address, authentication provider, authentication identifiers, and sign-in or recovery state.
• An optional birthday collected during signup, plus display name, photo, username or short identifier, pronouns, biography, status, flair, theme color, and other profile choices.
• Skills, kudos, badges, XP, quests, streaks, and related participation or activity records where those features are used.

03

Content and collaboration data

Xaro stores and processes the content people create or share so the intended room or conversation can work.

• Room messages, private messages, inbox previews, reactions, links, images, uploads, and related timestamps or delivery state.
• Documents, whiteboards, tasks, polls, events, calendar records, call metadata, room settings, channels, roles, permissions, moderation records, and vault content.
• Content can remain visible to room members, message participants, or other authorized viewers according to the room type and permissions.

04

Directory and visibility

Selected profile information is copied into a user directory that signed-in users can access for people search, contacts, room membership, and profile cards. Public or discoverable community information can be visible more broadly than a private friends group.

• Room creators and authorized managers can control membership, roles, permissions, and discoverability within the available settings.
• People who can view content may copy, download, forward, screenshot, or retain it outside Xaro. Their independent actions are not controlled by account deletion.

05

Device, browser, and technical data

The app and its infrastructure process technical information needed to connect, secure, troubleshoot, and deliver the service.

• Browser and device type, platform, truncated user-agent information where recorded, network and request metadata, timestamps, error details, and security signals.
• Firebase authentication state, local storage, cached app resources, offline data, theme and feature preferences, and saved account hints such as display name, email, photo, provider, and last-used time.
• Xaro does not provide a separate response to the browser Do Not Track signal. Other legally recognized browser privacy signals are handled when and where applicable requirements are implemented.

06

Notifications and push tokens

If notifications are enabled, Xaro can store a Firebase Cloud Messaging token with its update time, platform, and limited device or user-agent information so a notification can reach that browser or device.

• Notification permission can be changed in the browser or operating-system settings.
• Signing out or disabling notifications can remove or stop use of a stored token, subject to successful device and server cleanup.

07

Billing and subscriptions

Stripe hosts checkout and subscription management. Xaro records the identifiers and status needed to grant, update, or remove paid account and room benefits.

• Records can include the Stripe customer and subscription identifiers, price identifier, plan, status, cancellation-at-period-end flag, current period end, and update timestamps.
• Xaro does not store raw payment-card numbers. Stripe processes payment details under its own privacy terms.
• Account subscriptions and room subscriptions are separate purchases and must be managed or cancelled separately.

08

Calendar and other integrations

An optional Google Calendar connection requests the calendar.events permission so a user can import, create, update, or delete supported events. Other links or integrations process only the information needed for the action the user starts.

• The Google Calendar access token is held in application memory for the active connection. A local connection marker can remain on the device until it is disconnected or cleared.
• Disconnecting an integration stops future app access but does not automatically remove information already created in the third-party service.

09

AI processing

AI features are optional and can send a request through Xaro's authenticated gateway to configured AI infrastructure. The provider and model can vary by configuration, availability, and capacity.

• A room request can include the prompt and a bounded set of relevant recent messages, tasks, documents, and events from a room the account is allowed to access.
• Winston can process personal instructions, tone, saved memory or preferences, and the user display name. Supported profile assistance can process selected directory profile information.
• Supported calendar-photo extraction can send an image and prompt to the protected Ollama bridge or a configured Groq fallback.
• AI output can be inaccurate. People should review it and should not submit secrets or content they do not have permission to share.

10

AI queue, usage, and audit records

When AI capacity is busy, a request can be queued with a sanitized request payload and identifiers needed to authorize and process the job.

• Queue data can include prompt text, room or channel identifiers, model profile, status, result, and error details. A capacity-wait job can remain until it is processed, cancelled, or fails.
• Terminal queue results and status are retained for up to 24 hours under the current queue implementation.
• Usage and audit records can include request ID, mode, room or channel, provider and model, duration, status, error category, and displayed AI usage cost. The current audit record does not store prompt or response bodies.

11

How information is used

Xaro uses information to provide and secure accounts, rooms, messaging, collaboration, billing, notifications, integrations, support, and optional AI; enforce permissions and plan limits; prevent abuse; troubleshoot reliability; and comply with applicable obligations.

• Where applicable, processing can be necessary to provide the service requested, based on consent for an optional connection, required for legal obligations, or used for legitimate security and service-operating interests.
• Xaro can aggregate or de-identify information for reliability and product understanding when the result is not reasonably linked back to a person.

12

When information is disclosed

Information can be disclosed to the people and rooms a user chooses, to authorized room managers, to configured service providers, to an integration the user starts, or when reasonably required for law, safety, security, fraud prevention, or enforcement.

• Providers receive only the categories needed for the configured function, although their independent handling is also governed by their terms and privacy notices.
• Xaro can preserve or disclose information in response to valid legal process or to protect users, the public, rights, and service integrity.

13

Service providers

Xaro currently relies on Firebase and Google infrastructure, Stripe, optional Google Calendar access, configured AI infrastructure, and retained GitHub issue-reporting flows for the functions described below.

• Firebase and Google infrastructure: Authentication, Realtime Database, file storage, hosting, push notifications, and App Check when configured. Account identifiers, profile and room records, content, files, tokens, device metadata, and security signals needed for those services.
• Stripe: Checkout, recurring subscriptions, invoices, payment-method management, and the customer billing portal. Stripe receives payment and transaction information. Xaro stores customer and subscription identifiers, plan, status, and renewal or cancellation timestamps rather than raw card numbers.
• Google Calendar: Optional event import, creation, update, or deletion after the user connects Calendar access. The active access token and relevant calendar event details. The token is held in application memory for the active connection; a connection marker can remain on the device.
• Configured AI infrastructure: Optional room AI, Winston, profile assistance, and supported event extraction. Prompts, limited relevant context, supported images, model preferences, request metadata, results, and usage information can be routed through the protected Ollama bridge, Cloudflare Workers AI, or Groq depending on configuration and capacity.
• GitHub: Public issue reporting and supported bug-report workflows. Issue content and technical details a user chooses to submit through a retained reporting flow.

14

Retention

Except where a specific period is stated, Xaro retains information for as long as reasonably needed to provide the account, room, conversation, transaction, integration, security, or support function; comply with law; resolve disputes; and enforce agreements.

• Retention depends on the record type, whether the account or room remains active, what other participants retain, provider backup and deletion cycles, security needs, and legal or billing obligations.
• Queued AI terminal status and results currently have the specific 24-hour period described above; this does not establish a 24-hour period for other AI, account, room, or billing records.

15

Security and encryption

Xaro uses authentication, authorization rules, provider safeguards, and other reasonable technical and organizational measures designed to protect information. No online service can guarantee absolute security.

• Xaro does not represent every room or private message as end-to-end encrypted.
• Optional private-message passphrase encryption protects only supported messages sent after both participants enable it with the same passphrase. It does not retroactively encrypt earlier messages or every related record.
• Users should protect credentials, device access, recovery methods, and any shared passphrase, and should avoid placing highly sensitive secrets in chat or AI prompts.

16

Choices and privacy rights

People can edit available profile fields, manage room visibility and permissions where authorized, change browser notification permissions, disconnect supported integrations, clear local browser data, cancel subscriptions through the correct billing flow, and delete an account from Settings.

• Depending on where a person lives, applicable law can provide rights to access, correct, delete, restrict, object to, or receive a copy of personal information, and to complain to a data-protection authority.
• Xaro can require identity verification and can deny or limit a request where an exception applies, such as another person's rights, security, fraud prevention, billing, or legal retention.

17

Account deletion and subscription cancellation

The current in-app account deletion flow removes the user profile, attempts to remove the directory entry, removes stored push tokens, and deletes the Firebase Authentication user after required confirmation and recent sign-in checks.

• Deletion does not automatically remove room messages, private messages, files, room content, records retained by other participants, provider backups awaiting deletion, or records kept for billing, safety, security, or legal reasons.
• Deletion does not cancel Stripe subscriptions. Cancel each account or room subscription through its correct billing-management flow before deleting the account or room.
• A broader data request can be handled separately from the in-app deletion control and may require identity verification.

18

Children

Xaro is not designed as a child-directed service. Where a child cannot consent under applicable law, a parent, guardian, school, or other authorized organization must provide any permission and supervision required by law and the Terms.

• The signup flow can ask for an optional birthday. A birthday field by itself is not a parental-consent system.
• If personal information appears to have been submitted without required permission, use the support channel currently displayed in the service so the situation can be reviewed.

19

International processing

Xaro and its providers can process information in countries other than the one where a user lives. Privacy laws and government-access rules can differ. Where required, appropriate contractual or other transfer safeguards should apply.

20

Policy changes and requests

This policy can be updated as the product, providers, or legal requirements change. The date at the top identifies the current version, and material changes will be communicated where applicable law requires it.

• Use the support channel currently displayed in the service to ask a privacy question or make a request.
• The service can verify identity and request enough information to locate the relevant account, room, transaction, or integration records.