Skip to main content
XXenith

Privacy Policy

Last updated: October 16, 2026

1. Scope

This Privacy Policy explains how Xenith ("Xenith," "we," "us," "our") handles personal information when you use our website and application (the "Service"). It applies to all users of Xenith.

2. Data We Collect

Depending on how you use Xenith, we may collect:

  • Account data, such as email address, login credentials, and profile details.
  • User-generated data, such as intentions, routines, reflections, notes, projects, and other content you create inside the Service.
  • Biometric and health-related inputs, such as weight, height, age, and activity level, if you use tools like the Biometric Wizard (available on every plan) — used only to calculate estimated calorie and macro-nutrient targets within Xenith. These are general informational estimates, not medical advice; see Section 12 of our Terms of Service.
  • Product and usage data, such as app interactions, performance events, and settings preferences, collected via PostHog. We disable session recording and automatic click/pageview capture, and configure PostHog to respect your browser's Do Not Track setting. These browser-side events only run after you accept the cookie banner.
  • Account activity events, recorded by our servers without cookies and without depending on the cookie banner, so we can tell whether new people find Xenith useful and come back. They cover that you signed in, which onboarding step you reached, when you first wrote an intention, completed one, finished a Focus session, or saved a reflection, and which calendar days (in your timezone) you were active. They are names of actions, counts and dates tied to your account ID. They never include what you wrote, your reflections, or any health, finance, or other personal content. They are sent to PostHog, and a short record of which ones were sent is kept in our database. If you would like us to stop recording them for your account or delete the ones we hold, email [email protected].
  • Billing data, such as your subscription plan, status (active, trialing, past due, canceled), renewal date, and the Stripe customer and subscription identifiers needed to manage your subscription. Your card number, CVC, and other raw payment credentials are entered directly into Stripe's hosted checkout and are never received or stored by Xenith — see Section 5 for how Stripe processes that data.
  • Support and communication data, such as feedback messages and customer support requests.

3. How We Use Data

We process personal information to provide and maintain Xenith, authenticate users, secure accounts, improve reliability, personalize user experience, respond to support requests, and comply with legal obligations.

4. Legal Bases

We process data based on one or more of the following grounds, where applicable: performance of our contract with you, legitimate interests in operating and improving the Service, consent (for optional features), and compliance with legal obligations.

5. Sharing and Processors

We do not sell your personal information. We share data only with trusted service providers ("subprocessors") who process it on our behalf, solely to operate and improve Xenith. Current subprocessors include:

  • Supabase — database, authentication, and file storage.
  • Stripe — subscription billing and payment processing. Stripe collects and stores your payment details (card number, billing address, etc.) directly and processes them under its own privacy policy. We receive back only your subscription status and billing identifiers, never your full card details.
  • PostHog — product analytics (page views and in-app events) to understand usage and improve the Service, plus the account activity events our servers send (see Section 2). Session recording and automatic event capture are disabled, and the browser-side part of PostHog is configured to respect Do Not Track.
  • Vercel — hosting, along with Vercel Analytics and Speed Insights for aggregate, privacy-friendly performance and usage measurement.
  • Anthropic — AI processing for features such as insights and growth guidance. Content you submit to an AI feature is sent to Anthropic to generate a response and is not used to train their models.
  • Cloudflare — Turnstile bot and abuse protection on sign-up and forms.
  • Sentry — error monitoring and diagnostics to detect and fix crashes.
  • Google Analytics — aggregate website traffic measurement.
  • Resend — transactional and lifecycle email delivery.
  • Google and Microsoft — optional third-party sign-in (OAuth) when you choose to authenticate with those accounts.
  • Google Calendar, Google Tasks, Microsoft To Do, Notion and Todoist — optional connections that you start yourself. We read calendar events (Google Calendar, Notion) and tasks that are due soon (Google Tasks, Microsoft To Do, Todoist: the title, due date, and a link back) to show them in Xenith. If you turn on two-way sync for Google Tasks or Microsoft To Do, we also create tasks there from your open intentions (title and date, in a list named "Xenith") and mark tasks complete when you finish them. We never delete tasks in those services. The access tokens are stored encrypted; disconnecting deletes them from Xenith, and you can also remove Xenith's access in your Google, Microsoft, or Todoist account settings. See the Limited Use statement below.
  • Notion databases you keep in sync — if you import a Notion database, we copy its rows into Xenith. If you then turn on sync for it (it is off until you do, and starts with a preview that changes nothing), we also read that database from Notion on a schedule and write your changes back: cell values and new rows. We never delete a row in Notion or in Xenith unless you confirm it. To tell what changed we store Notion page ids and a fingerprint of each cell, not its content. Turning sync off stops all of this; what is already in both places stays.
  • Importing from Notion, Google Docs and Word — when you choose Import, we read only what you pick and copy it into a project. For Notion that is the pages and databases you select (and the pages inside them) from what you have shared with Xenith. For Google Docs it is the documents you choose in Google's own picker: Xenith asks for the drive.file permission, which covers only those documents, and your browser receives a short-lived token to open the picker. Word files you upload are kept in private storage only while the import runs and are deleted afterwards. Imports are copies; your originals are not changed. Images and files in your pages, whether imported or added in the editor, are stored in a storage bucket under an unguessable address: anyone who has the exact link can view the file. They are removed when you delete your account; deleting a single page does not immediately delete its files. The connection tokens are stored encrypted, and disconnecting deletes them. Content you imported stays in Xenith until you delete it.
  • Web push services — browser push providers used to deliver notifications you opt into.

We may also disclose information where required by law or to protect the rights, safety, and security of our users and the Service.

Limited Use disclosure (Google Workspace APIs). Xenith's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Calendar data accessed via the Google Calendar API is used exclusively to power two-way calendar sync within Xenith, at your explicit request. Task data accessed via the Google Tasks API is used exclusively to show you your tasks in Xenith and, only if you turn on two-way sync, to create and complete tasks at your request. Document data accessed via the Google Docs and Drive APIs (only the documents you choose in Google's picker) is used exclusively to copy those documents into your project when you ask for an import. None of this is ever used to train, develop, or improve any AI or machine-learning model, sold, shared for advertising, or used for any purpose beyond providing those features themselves.

6. Your Rights

Depending on your jurisdiction, you may have the right to:

  • Request access to the personal data we hold about you.
  • Request correction of inaccurate personal data.
  • Request deletion of your account and related data.
  • Export your data where technically feasible.

To exercise any of these rights, contact us using the details in the Contact section below.

7. Data Retention

We retain personal data for as long as needed to provide the Service and satisfy legal, tax, accounting, and security obligations. You may request deletion of your account at any time. Approximate retention periods by category:

  • Account and user-generated content — retained until you delete your account, at which point it is permanently removed from our production database within 30 days, subject to standard backup rotation.
  • Subscription and billing records — retained for the life of your account plus up to 7 years afterward, as required for tax, accounting, and fraud -prevention purposes. Stripe retains payment records under its own policy independent of Xenith.
  • Product analytics events (PostHog) — retained for up to 12 months, after which events are deleted or aggregated.
  • Error and performance diagnostics (Sentry, Vercel Speed Insights) — retained for up to 90 days.

8. Security

We apply reasonable technical and organizational measures to protect data, including access controls, encryption in transit, and secure infrastructure practices. No system is guaranteed secure, but we continuously improve our controls.

9. Cookies and Local Storage

Xenith uses limited browser storage for essential app behavior: your signed-in session, theme, onboarding state, and a small local cache of your subscription status (plan and Pro/free access) used only to decide what the interface shows optimistically while it re-confirms your real status with our servers — it does not itself grant access to any gated data or action. We also use analytics (PostHog, Google Analytics, and Vercel Analytics) to understand aggregate usage and improve the Service. We do not use third-party advertising trackers for behavioral ad targeting.

On your first visit, a cookie banner lets you accept or reject non-essential (analytics) cookies; essential cookies needed for sign-in and core functionality are always active since the Service cannot work without them. The banner controls browser-side analytics. The account activity events described in Section 2 are sent by our servers, use no cookies, and are not controlled by the banner. Your choice is stored in local storage and you can change it at any time — see our Cookie & Tracking Policy for the full list of cookies and storage we use and how to manage them.

10. International Use

If you use Xenith from outside your home jurisdiction, you understand your data may be processed in locations where our providers operate. We use contractual and technical safeguards where appropriate.

11. Children's Privacy

Xenith is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If we become aware of such collection, we will delete the data.

12. Policy Updates

We may update this policy periodically. Material changes will be reflected on this page by updating the "Last updated" date.

13. Contact

For privacy-related requests, contact us at [email protected].