Privacy Policy

Introduction

This Privacy Policy explains how XChatAI ("we", "us", "our") collects, uses, and protects your personal information when you use xchatai.io and related services.

Information We Collect

Account Information: When you sign up, we collect your name, email address, and profile picture through Google or GitHub OAuth.

Conversation Data: Messages you send and receive when chatting with AI characters are stored in our database. This includes message content, timestamps, and associated character IDs.

Memory Data: If persistent memory is enabled, facts extracted from your conversations are stored and linked to your account. This allows AI characters to recall context across sessions.

Usage Data: We collect information about which tools and characters you use, including interaction counts and session duration.

Payment Information: If you purchase credits, payment is processed by third-party payment providers. We do not store your credit card details directly.

Prompt, Upload, and Generation Data: We process prompts, uploaded materials, generation settings, and generated outputs to provide AI chat, image, video, and audio features.

Moderation and Safety Data: We may process reports, enforcement records, account signals, and related content to detect abuse, enforce our policies, handle content removal requests, and comply with legal obligations.

How We Use Your Information

• To provide and improve our AI chat, image generation, video creation, and audio production services
• To maintain conversation history and persistent memory features
• To process payments and manage your credit balance
• To personalize your experience and recommend relevant characters
• To communicate service updates and respond to support requests
• To review reports, moderate content, prevent abuse, and enforce our Terms of Service

Data Storage and Security

Your data is stored in PostgreSQL databases hosted on secure infrastructure. Conversations and memories are isolated per user — other users cannot access your data.

We use industry-standard encryption (TLS) for data in transit.

Third-Party Services

We use the following third-party services:

• AI Model Providers: OpenAI, Anthropic, Google, DeepSeek, xAI — your messages are sent to these providers for AI responses
• Payment Providers: Payment processing
• Better Auth: Authentication

Your Rights

You can:

• View and export your conversation history
• Delete individual conversations or all your data
• Manage your memory (view, search, delete stored facts)
• Delete your account at any time through Settings

Data Retention

Conversation data is retained as long as your account exists. When you delete a conversation, it is permanently removed. When you delete your account, all associated data is deleted within 30 days.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or through the service.

Contact

For privacy-related questions, contact us at [email protected].

Last updated: April 14, 2026