Privacy Policy
xkg stores only what it needs to sign you in and act on your behalf: your captures stay in your own GitHub repository. This policy covers the hosted service at xkg.xmu.sh (“xkg”, “we”). The data controller is SPV Technology Inc., 1111B S Governors Ave, STE 34689, Dover, DE 19904, United States.
1. What we collect
| Data | Where it comes from | Why we need it | How it is stored |
|---|---|---|---|
| GitHub user ID and username | GitHub, when you sign in | To identify your account | Plain text |
GitHub access token (repo scope) | GitHub, when you sign in | To write captures to and read them from your repository | Encrypted (AES-256-GCM) |
| Name of your knowledge repository | You, at setup | To know where your captures go | Plain text |
| LLM provider and API key | You, at setup | To process captures with your own provider account | Key encrypted (AES-256-GCM) |
| xkg API key (for AI workers and the CLI) | Generated by xkg | To authenticate your AI workers | One-way hash only; we cannot recover it |
| PIN | You, at setup | Quick unlock on a device already verified with GitHub | Salted scrypt hash |
| Display name and profile image | You, optional | Shown in the app | Plain text |
| Security records | Generated by xkg | Lock out repeated failed PIN attempts, cap captures per hour, and track connected AI clients, keyed by account | Plain text; the counts reset each window |
Passed through, not stored. To do its job, xkg handles data it does not keep:
- What you capture: the text or URL you submit, and the page at that URL when xkg fetches it.
- Content of your knowledge repository, read to answer your AI workers.
- From the optional CLI hooks: your project's name, current git branch, last five commit messages, and the path of a file being edited.
- What you or your AI tools send to get briefings, plans and suggestions: project context, task descriptions and code snippets.
Not collected. No email address, no payment details, no analytics, tracking or advertising identifiers.
The repo scope lets xkg read and write all repositories your GitHub account can access. GitHub offers no narrower scope that covers private repositories. xkg only accesses your knowledge repository.
Legal basis (EU/UK). We process this data to provide the service you signed up for (contract), and keep security records to protect your account (legitimate interests).
2. Where your data goes
We do not sell your data, use it for advertising, or share it beyond the providers below, except where the law requires.
| Recipient | What it receives | Why | Location |
|---|---|---|---|
| Vercel | Every request to xkg, including your IP address and browser details in its request logs | Hosts the app | United States (Washington, D.C.) |
| Neon | The account data in section 1 | Database | United States (Washington, D.C.) |
| GitHub | Your captures, written to your repository | Where your knowledge lives | GitHub's infrastructure |
| Your LLM provider (Anthropic, OpenAI or Google) | Capture content, relevant knowledge-base entries, and the context sent for briefings, plans and suggestions (such as project name, branch, recent commit messages, file paths, task descriptions and code), sent with your API key | Extracting and ranking insights, writing briefings, plans and suggestions | Your provider's infrastructure |
| Websites you capture | A request from xkg's servers, not from your device | Reading the page you submitted | Anywhere |
Your LLM provider processes this content under your account and its terms; xkg is not a party to that agreement. Your captures are subject to GitHub's terms and your repository's visibility, which is private by default.
International transfers. xkg is run by a US company, and its servers and database are in the United States. If you use xkg from elsewhere, including the EU or UK, your data is processed in the US, where data protection law may differ from yours; this policy's protections apply to you in full. Vercel and Neon are bound by data processing agreements that include the EU Standard Contractual Clauses.
3. How long we keep it, and deleting it
Account data and security records are kept while your account exists.
| Data | How long |
|---|---|
| Account data (section 1) | Until your account is deleted |
| Signed-in session | 30 days, or until you generate a new xkg API key |
| AI worker connections | Access tokens 1 hour; refresh tokens 30 days; authorization codes 5 minutes |
| Failed PIN attempts | Counted in 15-minute windows, lockouts last at most 24 hours; the record is kept until your account is deleted |
| Capture counter | Counted in 1-hour windows; the record is kept until your account is deleted |
| Hosting request logs | Up to 30 days |
| Database backups | Up to 30 days |
| Your captures | In your GitHub repository, until you delete them |
Deleting your account. In Settings, choose Delete account. It takes effect at once: your account data is deleted and we ask GitHub to revoke xkg's access. You can also email sofia@spvtechnology.com from, or naming, your GitHub username; we then delete your data within 30 days and confirm when done. Backup copies expire up to 30 days after deletion. Your captures are not touched: they live in your repository, and you delete them in GitHub.
Cutting off access immediately, without deleting anything:
- Generate a new xkg API key in Settings. This signs out every other session and disconnects every AI worker.
- Revoke xkg in GitHub under Settings → Applications → Authorized OAuth Apps. This invalidates the stored GitHub token.
- Delete your API key at your LLM provider.
4. Cookies
xkg sets only the cookies it needs to work; there are no analytics or advertising cookies, so no consent banner is shown.
| Cookie | Purpose | Lasts |
|---|---|---|
xkg_session | Keeps you signed in | 30 days |
xkg_device | Marks a browser verified with GitHub, so PIN unlock works on it | 180 days |
oauth_state | Protects GitHub sign-in against forgery | 10 minutes |
xkg_oauth_return | Returns you to an AI worker after you approve its connection | 10 minutes |
Older xmu_ and mnemos_ versions of the first two are still read so earlier sign-ins keep working.
5. Your rights
You can ask us to show, correct, export or delete your data, to restrict how we use it, or object to how we use it. Email sofia@spvtechnology.com; we answer within 30 days and won't charge you or treat you differently for asking. In the EU or UK you may also complain to your data protection authority. California residents have the same rights under the CCPA; we do not sell or share personal information.
To use xkg you need to sign in with GitHub, and at setup choose a knowledge repository, add an LLM API key and set a PIN; without them the service can't work. A display name and profile image are optional. xkg makes no automated decisions with legal or similarly significant effects on you. We have not appointed a Data Protection Officer; the law does not require one for a service like xkg.
6. Children
xkg is not for anyone under 16. GitHub, which you need to sign in, requires users to be at least 13. If we learn that an account belongs to someone under 16, we delete it.
7. Changes and contact
We'll post any change here and update the effective date, and tell you in the app before a material change takes effect. Questions or requests: sofia@spvtechnology.com. Security issues: report privately.