Privacy Policy

Overview

What this policy covers

This Privacy Policy explains how Xelora handles personal information across the landing page, app, AI features, support paths, uploads, and voice or audio features where enabled.

Top

This policy applies to information you provide directly, information created through product use, and technical information generated when the service runs.
Xelora is a clarity and reflection app, not a medical provider or clinical record system. Information in Xelora should not be treated as a professional medical record.
If a local law gives you privacy rights beyond this policy, we will follow the law that applies to your information.

Collection

Information you provide or create

The information Xelora receives depends on which features you use.

Top

Account information may include name, handle, email address, password authentication data, login sessions, profile settings, avatar files, language settings, theme settings, and communication preferences.
Reflection content may include chat messages, chat sessions, AI memory/context, mood entries, journal entries, goals, reflection notes, check-ins, thought logs, guided entries, clarity sessions, dream logs, and personal coping notes.
Knowledge and upload features may process files, images, inline text, notes, or other material you choose to add for retrieval or personalization.
Voice or audio features, when enabled, may process audio uploads, transcripts, generated speech, call events, or related technical data.
Support requests may include messages you send to us, identifiers needed to locate your account, and records needed to resolve the request.

Collection

Technical information collected automatically

Xelora uses technical data to keep accounts, security controls, and product features working.

Top

The app may process IP address, browser or app version, device type, operating system, language, coarse region, referrer, timestamps, request paths, response status, and diagnostic logs.
Session cookies and similar local storage may keep you signed in, remember theme or language choices, protect against abuse, and support security controls.
Mobile features may process device session identifiers, push tokens, provider identifiers, device metadata, and session revocation information.
Rate limiting, fraud prevention, upload validation, crash logs, performance signals, and security logs may be used to protect the service and diagnose problems.

Sensitive Data

Reflection content and high-risk information

Many Xelora features can involve sensitive personal information.

Top

Do not submit information you do not want Xelora or its configured providers to process.
Do not upload or post someone else's private, health, financial, contact, image, message, or identifying information unless you have the right and permission to do so.
Do not use Xelora to store passwords, payment credentials, government IDs, emergency-only instructions, or professional records you are legally required to protect under a separate duty.
Xelora is NOT a HIPAA-covered entity, is NOT subject to regulated health privacy rules (such as HIPAA), and does not provide clinical security guarantees. You agree not to upload protected health information (PHI) or clinically regulated data.
Xelora may show crisis or urgent-help guidance when content suggests serious risk, but the service is not monitored as an emergency channel and cannot guarantee intervention.

Use

How Xelora uses information

We use information to provide, protect, maintain, and improve Xelora.

Top

To create accounts, authenticate sessions, keep users signed in, revoke sessions, manage settings, and provide the features users request.
To generate AI replies, summaries, prompts, sentiment labels, safety prompts, context memory, progress views, and other product outputs.
To personalize the product based on settings, language, recent context, user-owned knowledge, mood or journal history, and enabled memory features.
To secure the service, enforce rate limits and file limits, prevent spam or abuse, troubleshoot incidents, test releases, and measure reliability.
To comply with law, respond to valid legal process, defend rights, resolve disputes, or reduce serious risk of harm.

Sharing

How information may be shared or processed by providers

Xelora relies on service providers and infrastructure to operate.

Top

Information may be processed by hosting, database, storage, email, authentication, observability, security, analytics, support, moderation, speech, or payment providers where those services are configured.
Content submitted to AI features may be processed by AI model providers or infrastructure providers, including configured OpenAI or NVIDIA services where enabled by the app configuration.
We do not control the security protocols, training practices, data retention, or breach vulnerabilities of third-party AI API providers. You acknowledge that sending data to these providers is done at your own risk, and we are not liable for any data exposures caused by their services.
Audio or voice features may involve speech-to-text, text-to-speech, or related providers where those features are enabled.
We may disclose information when required by law, valid legal process, platform rules, or when necessary to enforce terms, protect users or the public from serious harm, or protect Xelora's rights and security.
If Xelora is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction under appropriate confidentiality and transition controls.
AI Training Disclosure: Xelora does not use your journal entries, chat messages, or mood data to train its own AI models. However, third-party AI API providers (such as OpenAI or NVIDIA) may process submitted content under their own data usage and training policies. Where available, Xelora enables provider settings (such as zero-data-retention or training opt-out flags) to minimize third-party training exposure, but we cannot guarantee that all providers honor these settings at all times.

Note

We do not sell journal entries, chat content, or mood entries to data brokers. If advertising or analytics practices change in a way that requires additional disclosures or choices, we will update this policy and provide required controls before that use.

Cookies

Cookies, local storage, and similar technology

The web experience uses browser storage for basic functionality.

Top

The landing page may use local storage to remember theme and language preferences.
The app may use session cookies or similar tokens for authentication, security, account access, and abuse prevention.
Browser, device, or platform controls may let you delete cookies or local storage, but doing so can sign you out or reset preferences.

Retention

Retention, deletion, and account controls

We keep information only as long as needed for product, security, legal, moderation, and business purposes.

Top

Account deletion, where available, removes active product records tied to the account, including many chat, mood, journal, settings, profile, memory, device session, and guided module records.
Separate chat wipe controls, where available, may delete chat sessions, messages, conversations, and related chat memory without deleting the whole account.
Some information may remain in backups, security logs, audit logs, moderation records, legal records, support records, billing records, provider logs, or cached systems for a limited time or where retention is legally permitted or required.
Data export is available only where the shipped product exposes it. If an export path is not available in your app version, use the support path published in the app or store listing.

Security

Security safeguards

Xelora uses technical and organizational safeguards, but no online service can be perfectly secure.

Top

Security measures may include password hashing, secure session settings, rate limits, upload validation, access controls, proxy-aware deployment settings, CORS controls, security headers, logging, and administrative review.
You are responsible for keeping your password, devices, email account, and recovery channels secure.
If you believe your account or data has been accessed without permission, use the available support path promptly.

Minors

Children and younger users

Xelora is not intended for unsupervised use by children who cannot legally consent to digital services.

Top

If you are under the age required to consent in your region, use Xelora only with appropriate parent or guardian involvement.
Xelora is strictly prohibited for children under the age of 13 (or under 16 in the EEA/UK). We do not knowingly collect or solicit data from children under these ages. If we learn we have collected data from a child under these limits without parental consent, we will delete that information immediately and disclaim all liability for doing so.
Parents or guardians who believe a child submitted information without appropriate permission should contact us through the available support path.

US Rights

US state privacy disclosures (California CCPA/CPRA & state laws)

Additional specific disclosures for residents of California, Virginia, Colorado, Connecticut, Texas, and other US states.

Top

California Consumer Privacy Act (CCPA / CPRA): California residents have the Right to Know what personal information we collect, the Right to Delete personal information, the Right to Correct inaccurate data, and the Right to Non-Discrimination for exercising privacy rights.
Right to Limit Use of Sensitive Personal Information: Xelora processes sensitive personal information (such as user journal logs and mood entries) solely to perform the service requested by the user and as permitted under Cal. Civ. Code § 1798.121.
Notice of No Sale or Sharing: Xelora does NOT sell your personal information, journal entries, or chat data to third parties, and does NOT share your data for cross-context behavioral advertising.
Shine the Light & Do Not Track: We do not share personal information with third parties for their direct marketing purposes under California's Shine the Light law. Our app responds to valid opt-out mechanisms where supported.

Health Privacy

Consumer health data privacy notice (Washington MHMDA & Nevada law)

Disclosures regarding consumer health and emotional wellbeing data under state health privacy statutes.

Top

Washington My Health My Data Act (MHMDA): To the extent user mood logs, emotional check-ins, or wellness notes are defined as Consumer Health Data under Washington MHMDA or Nevada Senate Bill 370, Xelora collects and processes this data solely to provide the clarity, journaling, and AI reflection features explicitly requested by the user.
No Unauthorized Disclosure: Xelora does not sell, lease, or disclose Consumer Health Data to third parties for commercial gain or advertising without express, separate consent.
Consumer Health Rights: Eligible consumers have the right to confirm processing, access their consumer health data, revoke consent, and request deletion of consumer health records by submitting a request through our published legal contact email.

EU / UK Rights

European Economic Area, UK, and Swiss privacy disclosures (GDPR)

Additional disclosures for users located in the European Economic Area (EEA), United Kingdom, or Switzerland under the General Data Protection Regulation (GDPR) and UK GDPR.

Top

Data Controller: The data controller for information processed through Xelora is the entity identified on the official Xelora website or app store listing. For data protection inquiries, contact legal@xelora.app.
Legal Basis for Processing: Xelora processes personal data on the following legal bases: (a) Contract Performance — to provide the features you request when you create an account; (b) Legitimate Interests — to secure the service, prevent abuse, and improve product quality; (c) Consent — where you explicitly opt in to optional features such as voice processing or memory; and (d) Legal Obligation — to comply with applicable laws.
Your GDPR Rights: You have the right to access, rectify, erase, restrict processing, object to processing, and port your personal data. You also have the right to withdraw consent at any time (without affecting the lawfulness of prior processing) and the right to lodge a complaint with your local data protection supervisory authority.
Automated Decision-Making: Xelora uses AI to generate reflections, sentiment labels, and suggestions. These outputs are informational aids, not legally or medically binding decisions. No automated decision with legal or similarly significant effect is made without human involvement.

Transfers

International data transfers

Xelora infrastructure and service providers may be located in countries outside your home jurisdiction.

Top

Your personal data may be transferred to, stored in, and processed in the United States and other countries where Xelora's hosting providers (such as Railway), AI API providers (such as OpenAI or NVIDIA), and infrastructure services operate.
Where personal data is transferred from the EEA, UK, or Switzerland to a country not recognized as providing adequate data protection, Xelora relies on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms.
By using Xelora, you acknowledge and consent to the transfer of your information to the United States and other jurisdictions as described in this policy. We take reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

Rights

Your privacy rights, updates, and contact paths

Privacy rights vary by location and may include access, correction, deletion, objection, restriction, portability, or appeal rights.

Top

You may use in-app controls where available to access, update, delete, or manage information tied to your account.
Where required by law, we will provide additional rights, notices, choices, or appeal paths for users in covered regions.
We may update this policy as Xelora, providers, data flows, or legal obligations change. The updated date will show when the page was last revised.
Use the contact or support method published inside the app, on the store listing, or on the official service page for privacy requests.
Legal Contact: For privacy requests, data subject access requests, GDPR inquiries, CCPA requests, or MHMDA rights, contact legal@xelora.app or the address published on the official Xelora website.