Legal

Privacy Policy

Effective date: August 24, 2026
Last updated: August 24, 2026

This Policy replaces all prior versions, including those published for the previous version of Xenyyo.

This Privacy Policy explains how Xenyyo Inc. ("Xenyyo," "we," "us," or "our") collects, uses, and shares personal information.

It applies to xenyyo.com and to any other website, application, or service that Xenyyo Inc. operates and that links to this Policy (each, a "Service," and together, the "Services").

The short version

• You can use published tools without an account. If you do, we don't collect personal information about you — just anonymous usage counts.
• We don't sell your personal information. We never have.
• We don't run third-party advertising or analytics trackers. No ad networks, no Google Analytics, no advertising cookies.
• What you type to create a tool is sent to Anthropic to generate that tool. See Section 3.
• You can delete your account and your data. See Section 8.

1. Information we collect

If you use the Services without an account

You can browse the gallery and use any published tool without signing in. In that case we collect:

• Anonymous usage counts. We record that a tool was viewed, so we can display view counts. This is not linked to any identity.
• Standard technical logs. Our infrastructure providers automatically log IP address, browser type, referring page, and timestamps as part of delivering and securing the site. We use these for security, abuse prevention, and debugging.
• Essential cookies. Cookies strictly necessary for the site to work — for example, keeping you signed in during a session. We do not use advertising or cross-site tracking cookies.

If you create an account

• Account information. Email address, password (stored hashed — we never see it), and your chosen @handle. If you sign in with Google, we receive your email address and basic profile information from Google.
• Profile information. Display name and avatar image, if you provide them.
• Content you create. The descriptions you write to create or refine tools, the tools that result, and their titles and categories.
• Activity. Tools you save, like, remix, or follow, and tools you publish.
• Usage counters. How many tools and refinements you have used in the current billing period, so we can apply plan limits.

If you subscribe to a paid plan

• Payment information is handled by Stripe, not by us. We never receive or store your full card number. We receive a customer identifier, your subscription status, and the last four digits and card brand for your reference.
• Billing records — what you were charged and when.

Information we do not collect

We do not collect your precise location, contacts, biometric data, or government identifiers, and we do not build advertising profiles.

2. How we use information

We use personal information to:

• Provide the Services — generate tools, publish them, serve your feed, run your profile
• Create and secure your account, and authenticate you
• Process payments and manage subscriptions and usage limits
• Send transactional email — account confirmation, password reset, payment receipts, and important service notices
• Understand aggregate usage so we can improve the product
• Detect, prevent, and investigate abuse, fraud, and security incidents
• Comply with legal obligations and enforce our Terms of Service

Our legal bases (if you are in the EEA or UK): performing our contract with you, our legitimate interests in operating and securing the Services, your consent where we ask for it, and compliance with legal obligations.

3. AI processing — what happens to what you write

When you describe a tool or ask to refine one, the text you write is sent to Anthropic's API so that a Claude model can generate the tool. This is how the product works and cannot be turned off while using the creation feature.

Anthropic processes this text as our service provider, under its commercial terms.

Practical guidance: do not put personal, confidential, or sensitive information into tool descriptions or refinement prompts. Descriptions of published tools are visible on the Services, and the text is also sent to a third party for processing.

Tools that make their own AI calls while running — for example, a tool that summarizes text you paste into it — route those calls through our proxy to Anthropic as well. Whatever you enter into such a tool while using it is subject to the same guidance.

4. Content you publish is public

Anything you publish is visible to everyone, including people without accounts and search engines. This includes:

• Your published tools and their contents
• Your tool titles, categories, and descriptions
• Your @handle, display name, and avatar
• Your public profile page and the tools listed on it
• Attribution links when someone remixes your tool

Your Saved tab is private. Only you can see what you have saved.

Please do not publish personal information — yours or anyone else's — inside a tool. Published tools are indexed by search engines and can be remixed by others.

5. Who we share information with

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

We share information with service providers who help us run the Services, and only as needed for them to do that work:

We may also disclose information:

• When required by law — in response to a valid subpoena, court order, or legal process
• To protect rights and safety — where we reasonably believe disclosure is necessary to prevent harm, fraud, or a violation of our Terms
• In a business transaction — if Xenyyo Inc. is involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

6. How long we keep information

• Account information — while your account is active, and deleted within 30 days of account deletion
• Published tools — until you delete them or delete your account
• Payment records — as long as required by tax and accounting law, generally seven years
• Technical logs — typically 30 to 90 days, depending on the provider
• Anonymous usage counts — indefinitely, as they are not linked to an identity

Backup copies may persist for a limited period after deletion before being overwritten.

7. Security

We protect information with encryption in transit (HTTPS), encryption at rest, hashed passwords, isolated execution of published tools in sandboxed frames with strict content security policies, and access controls limiting who can reach production data.

No system is perfectly secure. We cannot guarantee absolute security, and you use the Services at your own risk. If we become aware of a breach affecting your personal information, we will notify you as required by law.

8. Your choices and rights

Everyone, regardless of where you live, can:

• Access and correct your account information in the product
• Delete your content — remove any tool you published at any time
• Delete your account — this removes your account, profile, and published tools. Account deletion is currently handled by request: email us at the address in Section 12 from your account email, and we will delete your account within 30 days.
• Unsubscribe from non-essential email. We will still send transactional messages about your account and payments.

To exercise any of these, use the product where available, or email us at the address in Section 12. We respond within 30 days.

If you are a California resident

Under the California Consumer Privacy Act, as amended, California residents have the right to know what personal information is collected and how it is used and shared, to request deletion, to request correction, to opt out of sale or sharing, and to be free from discrimination for exercising these rights.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information beyond what is necessary to provide the Services.

To exercise your rights, email us at the address in Section 12. We will verify your request through the email address associated with your account. You may use an authorized agent, and we will require proof of authorization.

If you are in the European Economic Area or the United Kingdom

You have the right to access, correct, delete, restrict, or object to processing of your personal information, and the right to data portability. You may withdraw consent at any time, and you may lodge a complaint with your local data protection authority.

Xenyyo is based in the United States, and your information is processed there. Where we transfer personal information from the EEA or UK, we rely on our service providers' standard contractual clauses.

9. Children's privacy

Using published tools does not require an account, and we do not collect personal information from people who simply use them. Tools are open to visitors of any age.

Creating an account requires you to be at least 13 years old. We do not knowingly collect personal information from children under 13.

If we learn that we have collected personal information from a child under 13, we will delete it promptly. If you are a parent or guardian and believe your child under 13 has created an account, contact us at the address in Section 12 and we will remove it.

10. Do Not Track

Some browsers send a "Do Not Track" signal. There is no common standard for responding to it. We do not track users across third-party websites, so there is nothing for us to change in response to the signal.

11. Changes to this Policy

We may update this Policy. If we make a material change, we will post the updated Policy with a new effective date and, if you have an account, notify you by email or in the product before the change takes effect.

12. Contact

Questions, requests, or privacy concerns:

Xenyyo Inc.
131 Continental Dr, Suite 305
Newark, DE 19713
United States

Privacy requests and questions: privacy@xenyyo.com
General support: support@xenyyo.com

We are the controller of the personal information described in this Policy.