XoralThis policy explains what data Xoral (xoral.si) collects, why it's needed, who it's shared with, how long it's kept and how to delete it. It covers the website, the chat and Xoral CLI.
1. What data we collect
- Account data: email address, name and password. The password is stored only as a hash; we don't know the password itself.
- Conversations: your messages, model answers and chat titles.
- Usage records: how many tokens were used and with which models, without message text. Needed for daily limits and cost accounting.
- Technical data: IP address, browser type, time and addresses of requests — in server logs.
- Xoral CLI: the agent's requests to models pass through our server the same way chat messages do. Your project files and session history stay on your computer; only what the agent sends to a model for an answer reaches our server.
- Support requests: your email address and the text of your message.
2. How we use it
- to run the Service: sign-in, storing chats, model answers, web search;
- to count limits, prevent abuse and keep the Service secure;
- to fix bugs and answer requests;
- to comply with the law.
We don't sell your data, don't show ads and don't use your conversations to train models.
3. How models process your messages
To get an answer, the text of your message together with the current chat history is sent through our server to an AI model provider. The provider processes it to generate the answer under the terms of its agreement with us. We don't send the provider your email, name or IP address. Model providers may be located outside the European Union.
Avoid sending passwords, access keys and other people's data to the chat unless necessary.
4. Web search
When a model needs fresh information, it writes a search query. Our server sends it to search engines (for example Google, Bing, DuckDuckGo, Brave) and loads the pages it finds. Search engines and websites see our server's address, not yours, and receive none of your account data. We don't log the text of search queries.
5. Who we share data with
- Hetzner Online GmbH — hosting: Xoral servers are located in a data center in Finland (European Union);
- AI model providers — message text, to generate answers (see section 3);
- Cloudflare — domain names and faster downloads of Xoral CLI files;
- Google — only if you sign in with a Google account;
- public authorities — only where the law directly requires it.
There are no other recipients. If this list changes, we'll update this policy.
6. How long we keep data
- Chats — until you delete them or delete your account.
- Account data — as long as the account exists. When you delete your account, we delete it together with all chats.
- Server logs — for a limited time, after which they're deleted automatically.
- Usage records without message text — as long as needed to calculate limits and costs and to prevent abuse.
- Support requests — as long as needed to answer and resolve them.
7. How we protect data
All connections to Xoral are encrypted (HTTPS). Passwords are stored as hashes. Xoral's internal services aren't reachable from the internet, and only administrators have access to the servers. No protection is absolute; if we learn of a breach that affects your data, we'll tell you.
9. Your rights
- Delete a single chat or all chats — in the sidebar or in Settings → Data & Privacy.
- Delete your account with all chats — in Settings → Account.
- To find out what data we hold about you, get a copy, correct it, restrict or object to its processing, write to support@xoral.si from your account's address. We'll reply within 30 days.
- If you believe we're violating your rights, you can contact the data protection authority in your country.
10. Children
Xoral is not intended for children under 16. If you learn that a child has signed up, let us know and we'll delete the account.
11. Changes to this policy
If this policy changes, we'll publish the new version on this page and update the effective date. We'll give advance notice of significant changes on the website or by email.
12. Contact
Send questions and requests about your data to support@xoral.si. The governing version of this policy is in Russian; translations are provided for convenience.