Privacy

This describes what XRA stores, where it runs and who else touches it. It is written to be specific rather than exhaustive; if something here is unclear, ask and we will answer plainly.

XRA is operated by AllOne Labs. Contact: team@allonelabs.com.

What we hold

Account	Your email address, and a display name if you set one. If you sign in with Google we receive your email, name and profile picture from Google — nothing else, and we never receive your Google password.
Conversations	The messages you send and the replies you receive, so a thread is still there tomorrow.
Clone jobs	The address of any site you ask XRA to clone, the build log, and screenshots taken of the result and of the original for comparison.
API keys	Only a one-way hash and the first few characters. The key itself is shown once at creation and never stored, so we cannot recover it for you or for anyone else.
Billing	A PayPal subscription reference and the events against it. Card and bank details are handled entirely by PayPal — they never reach us.

Where it runs

Everything is processed in the European Union. The database, authentication and stored screenshots are hosted by Supabase in Frankfurt. Clone builds run on a machine in Nuremberg. The web application is served by Vercel.

Who else processes it

• Supabase — database, sign-in and file storage (EU).
• Hetzner — the machine that captures and builds clones (Germany).
• Vercel — application hosting and the deployment of clones you publish.
• Groq — runs the model that answers you in chat. Your message is sent to produce the reply.
• Anthropic — used on our build machine when you ask XRA to change a clone's code or compare it visually to the original.
• PayPal — subscriptions and payment.
• Resend — sends account email such as confirmation and password reset.
• Google — only if you choose to sign in with Google.

What we do not do

We do not train models on your conversations. We do not sell your data, and we do not share it for advertising. We do not read your threads except when you ask us to help with something specific, or where we are required to investigate abuse.

How long we keep it

Conversations are kept until you delete them. You can set an automatic retention window in Settings, after which older conversations are deleted for you. Deleting your account removes your profile, conversations, clone jobs and API keys. Billing records are kept where we are required to keep them for accounting.

What you can do

• Export every conversation as a file — Settings, Data controls.
• Delete individual conversations, or all of them at once.
• Delete your account, which removes the data above.
• Ask us for a copy of what we hold, or ask us to correct it.

Cookies

XRA sets a session cookie so you stay signed in. There are no advertising or tracking cookies on the application.

Changes

If this changes in a way that matters, we will say so on this page and date it. Continuing to use XRA after a change means the updated version applies.