Xelora logo

Xelora

Clarity through intelligence
Back Home
Privacy Policy

Privacy Policy

This Privacy Policy is written to match Xelora's actual product shape: AI chat, mood and journal tools, guided modules, memory/context features, uploads, voice or audio features where enabled, and account controls.

Legal, privacy, and Xelora support contact details are not yet available. They will be published here before public launch. Legal Portal

Updated October 29, 2026 15 sections Xelora legal
Key Point

Sensitive Wellbeing Data

Xelora may process account data, chats, journals, mood entries, check-ins, goals, safety plans, uploads, and voice or audio data where enabled.

Key Point

AI Processing

Content submitted to AI features may be sent to configured AI, speech, hosting, storage, or infrastructure providers so the product can respond.

Key Point

Deletion and Retention

Account deletion removes active product data where supported, but backups, logs, moderation records, security records, and legal records may remain where needed.

Overview

What this policy covers

This Privacy Policy explains how Xelora handles personal information across the landing page, app, AI features, support paths, uploads, and voice or audio features where enabled.

Top
  • This policy applies to information you provide directly, information created through product use, and technical information generated when the service runs.
  • Xelora is a clarity and reflection app, not a medical provider or clinical record system. Information in Xelora should not be treated as a professional medical record.
  • If a local law gives you privacy rights beyond this policy, we will follow the law that applies to your information.

Collection

Information you provide or create

The information Xelora receives depends on which features you use.

Top
  • Account information may include name, handle, email address, password authentication data, login sessions, profile settings, avatar files, language settings, theme settings, and communication preferences.
  • For the adults-only service, we record your confirmation that you are at least 18, the time you accept the legal documents, and their version. This confirmation does not require your birth date or identity documents. Information you volunteer in chat may separately include your age.
  • Reflection content may include chat messages, chat sessions, AI memory/context, mood entries, journal entries, goals, reflection notes, check-ins, thought logs, guided entries, clarity sessions, dream logs, and personal coping notes.
  • Knowledge and upload features may process files, images, inline text, notes, or other material you choose to add for retrieval or personalization.
  • Voice or audio features, when enabled, may process audio uploads, transcripts, generated speech, call events, or related technical data.
  • Support requests may include messages you send to us, identifiers needed to locate your account, and records needed to resolve the request.

Collection

Technical information collected automatically

Xelora uses technical data to keep accounts, security controls, and product features working.

Top
  • The app may process IP address, browser or app version, device type, operating system, language, coarse region, referrer, timestamps, request paths, response status, and diagnostic logs.
  • Session cookies and similar local storage may keep you signed in, remember theme or language choices, protect against abuse, and support security controls.
  • Mobile features may process device session identifiers, push tokens, provider identifiers, device metadata, and session revocation information.
  • Rate limiting, fraud prevention, upload validation, crash logs, performance signals, and security logs may be used to protect the service and diagnose problems.

Sensitive Data

Reflection content and high-risk information

Many Xelora features can involve sensitive personal information.

Top
  • Do not submit information you do not want Xelora or its configured providers to process.
  • Do not upload or post someone else's private, health, financial, contact, image, message, or identifying information unless you have the right and permission to do so.
  • Do not use Xelora to store passwords, payment credentials, government IDs, emergency-only instructions, or professional records you are legally required to protect under a separate duty.
  • Xelora is offered directly to consumers for reflection and wellbeing, not as a healthcare provider's clinical record service. Whether HIPAA or another privacy law applies depends on the actual relationship and processing activity. State consumer-health privacy laws and other legal protections may apply even where HIPAA does not; this policy does not waive them.
  • Xelora may show crisis or urgent-help guidance when content suggests serious risk, but the service is not monitored as an emergency channel and cannot guarantee intervention.

Use

How Xelora uses information

We use information to provide, protect, maintain, and improve Xelora.

Top
  • To create accounts, authenticate sessions, keep users signed in, revoke sessions, manage settings, and provide the features users request.
  • To generate AI replies, summaries, prompts, sentiment labels, safety prompts, context memory, progress views, and other product outputs.
  • To personalize the product based on settings, language, recent context, user-owned knowledge, mood or journal history, and enabled memory features.
  • To secure the service, enforce rate limits and file limits, prevent spam or abuse, troubleshoot incidents, test releases, and measure reliability.
  • To comply with law, respond to valid legal process, defend rights, resolve disputes, or reduce serious risk of harm.

Sharing

How information may be shared or processed by providers

Xelora relies on service providers and infrastructure to operate.

Top
  • Information may be processed by hosting, database, storage, email, authentication, observability, security, analytics, support, moderation, speech, or payment providers where those services are configured.
  • AI chat can use OpenRouter and the downstream model hosts serving the selected model. Other configured AI integrations may include OpenAI or NVIDIA. Requests can include your message, relevant conversation history, and memory or other context used to answer you.
  • Providers process information under the contracts, service settings, and privacy terms that apply to the configured service. Provider retention, logging, and training restrictions must be assessed for that service; using an API alone does not establish zero retention. Xelora remains responsible for its own legal obligations when using providers.
  • When voice replies are enabled, the reply text and selected voice settings are sent to ElevenLabs to generate speech. Generated audio is stored with your account. Turning voice replies off prevents new automatic voice generation; it does not erase audio or text already processed.
  • We may disclose information when required by law, valid legal process, platform rules, or when necessary to enforce terms, protect users or the public from serious harm, or protect Xelora's rights and security.
  • If Xelora is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, information may be transferred as part of that transaction under appropriate confidentiality and transition controls.
  • Xelora does not train its own AI models on your journal entries, chat messages, or mood data. This is not a promise that every downstream service has zero retention or disables training. Those protections depend on the actual provider agreement and account configuration; this policy makes no unverified claim that they are enabled.

Note

We do not sell journal entries, chat content, or mood entries to data brokers. If advertising or analytics practices change in a way that requires additional disclosures or choices, we will update this policy and provide required controls before that use.

Cookies

Cookies, local storage, and similar technology

The web experience uses browser storage for basic functionality.

Top
  • The landing page may use local storage to remember theme and language preferences.
  • The app may use session cookies or similar tokens for authentication, security, account access, and abuse prevention.
  • Browser, device, or platform controls may let you delete cookies or local storage, but doing so can sign you out or reset preferences.

Retention

Retention, deletion, and account controls

We keep information only as long as needed for product, security, legal, moderation, and business purposes.

Top
  • Account deletion, where available, removes active product records tied to the account, including many chat, mood, journal, settings, profile, memory, device session, and guided module records.
  • Separate chat wipe controls, where available, may delete chat sessions, messages, conversations, and related chat memory without deleting the whole account.
  • Some information may remain in backups, security logs, audit logs, moderation records, legal records, support records, billing records, provider logs, or cached systems for a limited time or where retention is legally permitted or required.
  • The web app's Export your data control downloads a ZIP containing account-owned records, including chats, memories, journals, moods, guided-module records, settings and available stored media. An archive manifest identifies unavailable media. Authentication secrets, shared knowledge indexes, internal moderation records and provider-held copies are not included; contact the legal contact address (pending publication) for additional access requests.

Security

Security safeguards

Xelora uses technical and organizational safeguards, but no online service can be perfectly secure.

Top
  • Security measures may include password hashing, secure session settings, rate limits, upload validation, access controls, proxy-aware deployment settings, CORS controls, security headers, logging, and administrative review.
  • You are responsible for keeping your password, devices, email account, and recovery channels secure.
  • If you believe your account or data has been accessed without permission, use the available support path promptly.

Minors

Adults-only service

Xelora is intended only for people aged 18 and older.

Top
  • People under 18 may not use Xelora, including with parental permission. We do not knowingly provide accounts to minors.
  • The account confirmation is a self-attestation, not verified proof of age. We do not request a birth date or government ID for that confirmation.
  • If you believe a person under 18 has an account or submitted personal information, contact the legal contact address (pending publication) so we can investigate, restrict access, and address deletion as required by applicable law.

US Rights

US state privacy disclosures (California CCPA/CPRA & state laws)

Additional specific disclosures for residents of California, Virginia, Colorado, Connecticut, Texas, and other US states.

Top
  • California Consumer Privacy Act (CCPA / CPRA): California residents have the Right to Know what personal information we collect, the Right to Delete personal information, the Right to Correct inaccurate data, and the Right to Non-Discrimination for exercising privacy rights.
  • Right to Limit Use of Sensitive Personal Information: Xelora processes sensitive personal information (such as user journal logs and mood entries) solely to perform the service requested by the user and as permitted under Cal. Civ. Code § 1798.121.
  • Notice of No Sale or Sharing: Xelora does NOT sell your personal information, journal entries, or chat data to third parties, and does NOT share your data for cross-context behavioral advertising.
  • Shine the Light & Do Not Track: We do not share personal information with third parties for their direct marketing purposes under California's Shine the Light law. Our app responds to valid opt-out mechanisms where supported.

Health Privacy

Consumer health data privacy

Our separate Consumer Health Data Privacy Policy describes health-related data, sources, purposes, disclosures and rights.

Top
  • Read the Consumer Health Data Privacy Policy at /consumer-health-data-privacy. State health-data protections may apply to wellbeing data and inferences even when they are not HIPAA-protected clinical records.
  • No Unauthorized Disclosure: Xelora does not sell, lease, or disclose Consumer Health Data to third parties for commercial gain or advertising without express, separate consent.
  • Consumer Health Rights: Eligible consumers have the right to confirm processing, access their consumer health data, revoke consent, and request deletion of consumer health records by submitting a request through our published legal contact email.

EU / UK Rights

European Economic Area, UK, and Swiss privacy disclosures (GDPR)

Additional disclosures for users located in the European Economic Area (EEA), United Kingdom, or Switzerland under the General Data Protection Regulation (GDPR) and UK GDPR.

Top
  • Data Controller: The data controller for information processed through Xelora is the entity identified on the official Xelora website or app store listing. For data protection inquiries, contact the legal contact address (pending publication).
  • Depending on the activity and applicable law, processing may rely on providing the service you request, legitimate interests such as security, a legal obligation, or consent where required. Memory is part of chat personalization; the current app provides memory and chat deletion controls rather than a separate memory opt-in switch. Voice replies have an explicit setting. Acceptance of the terms does not substitute for separate consent where the law requires it.
  • Your GDPR Rights: You have the right to access, rectify, erase, restrict processing, object to processing, and port your personal data. You also have the right to withdraw consent at any time (without affecting the lawfulness of prior processing) and the right to lodge a complaint with your local data protection supervisory authority.
  • Automated Decision-Making: Xelora uses AI to generate reflections, sentiment labels, and suggestions. These outputs are informational aids, not legally or medically binding decisions. No automated decision with legal or similarly significant effect is made without human involvement.

Transfers

International data transfers

Xelora infrastructure and service providers may be located in countries outside your home jurisdiction.

Top
  • Your personal data may be processed in countries where the hosting, OpenRouter and downstream model services, ElevenLabs, or other configured providers operate. This policy does not promise that all processing stays in the United States.
  • International availability requires an appropriate legal basis and any required transfer safeguards for the relevant region. This policy does not claim that a specific transfer agreement or mechanism has been executed without verification.

Rights

Your privacy rights, updates, and contact paths

Privacy rights vary by location and may include access, correction, deletion, objection, restriction, portability, or appeal rights.

Top
  • You may use in-app controls where available to access, update, delete, or manage information tied to your account.
  • Where required by law, we will provide additional rights, notices, choices, or appeal paths for users in covered regions.
  • We may update this policy as Xelora, providers, data flows, or legal obligations change. The updated date will show when the page was last revised.
  • Use the contact or support method published inside the app, on the store listing, or on the official service page for privacy requests.
  • Legal Contact: For privacy requests, data subject access requests, GDPR inquiries, CCPA requests, or MHMDA rights, contact the legal contact address (pending publication) or the address published on the official Xelora website.

RELATED PAGES

Read the rest of the legal stack.

These pages are designed to work together. Privacy explains data handling, and Terms explains product use.

Open

Consumer Health Data Privacy Policy

Health-related data, purposes, disclosures and your privacy request options.

Open

Terms of Use

See the product rules, AI limitations, crisis boundaries, permitted use rules, and liability limits that apply to Xelora.

Open

Back to Landing Page

Return to the main marketing site and app entry points.