Privacy Policy

Effective October 8, 2026 · Version 1.2

1. Who we are

XCortex (“XCortex”, “we”, “us”) is a task planner with built-in AI, available at xcortex.com. XCortex is operated by an individual based in California, United States. For the purposes of data-protection law, we are the “controller” (or “business”) responsible for the personal information described here. You can reach us at [email protected].

This policy covers the XCortex website and app, the Playground (trying XCortex without an account), and our emails and notifications.

2. What we collect

Information you give us

• Account details: your email address and, if you set one, a password. We store only a salted one-way hash of your password (bcrypt), never the password itself. If you sign in with emailed codes, we store only a one-way hash of each code, for 10 minutes of use (codes are deleted after a day). We also store your time zone (detected from your device when you sign up), your language, and your display settings.
• Your content: everything you put into XCortex: tasks and events (titles, notes, dates, times, priorities, estimates, sub-tasks), tags, contexts (like Work or Personal), goals and what XCortex drafts about them, templates, repeating schedules, and the names of people you add to events. XCortex doesn't collect those people's email addresses and never contacts them.
• Places: locations you attach to events, a home or current location if you set one, and optional context rules such as a network range or area that switches you to a context. XCortex does not read your device's GPS.
• “About you” facts you choose to tell the assistant, and your conversations with the assistant.
• Connections you set up: your own AI provider (address, model and API key), a Telegram bot for reminders, calendar feed addresses (.ics) to import, web search keys, and tool servers (MCP). API keys, tokens and calendar feed addresses are stored encrypted.
• Notification devices: if you turn on notifications, your browser gives us a push subscription (an address at your browser maker's push service plus encryption keys). We store it encrypted.
• Passkeys (optional): if you set one up, we store its public key, an ID for it, and the device name your browser reports (like “Chrome · macOS”). The private key and your fingerprint or face data never leave your device.
• Sign in with Google (optional): if you choose “Continue with Google”, Google tells us your email address, that Google has verified it, and a stable ID for your Google account, so we can find your XCortex account next time. We ask for nothing else — not your contacts, calendar, name or photo.
• Payment details: if you subscribe, payment is handled by Stripe. We receive your Stripe customer ID and subscription status, never your card number.
• Messages you send us, such as support requests ([email protected]), privacy requests ([email protected]), or feedback you ask the assistant to send to XCortex (directly or through another assistant you connected). Feedback reaches us as you worded it, with your account's ID, email address, language and time zone so we can reply. The assistant only sends it when you ask.

Information XCortex creates as you use it

• AI-derived information: suggestions (tags, reminders, estimates), short titles, labels that help the assistant understand a task, a short summary of how you work (your “personal context”), goal status and dossiers, and research results you ask for.
• History: an undo history of the changes you make, so you can undo and redo them. It includes previous versions of what you changed.
• Usage information: which features and screens you use, and how quickly the app responds (see section 6). This never includes what you write.
• AI usage: how many AI requests you make and how many tokens they use, so we can keep the built-in AI within its limits.
• Security logs: our servers log requests, including IP addresses, and sign-in successes and failures. We use these to keep the service running and to stop abuse.

The Playground and the landing page

If you try XCortex without an account, we create a temporary guest account with a sample day. It has no email address. What you do there is handled like an account's content, and the whole guest account is deleted automatically after about 24 hours unless you choose “Keep it” and sign up. We also keep a small anonymous summary of each Playground visit (how long it was used, how many actions were taken, whether the AI was used, and whether it was kept) so we can improve it. This summary contains no content and isn't linked to you.

When you visit the landing page while logged out, your browser sends us a few anonymous signals: that the page was viewed, which buttons were used (such as “Try it”), the website you came from (its domain name only), your device type (phone, tablet or desktop) and your language. These are tied to a random ID for that single page visit, not to you.

3. How we use it

We don't sell your personal information, don't share it for cross-context behavioral advertising, don't use it for advertising at all, and don't make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. AI features

XCortex uses AI to help with your tasks. When a feature runs, the text it needs is sent to an AI provider, which returns an answer. Specifically:

• When you add a task, its title (and notes, if any) may be sent to suggest tags, a reminder or an estimate, and long titles may be shortened for small screens.
• When you use the assistant, it sends your message, the recent conversation, the tasks it looks up to answer you, your personal context and “About you” facts, and your time zone and location (if you've set one).
• Planning, goals and research: suggesting a schedule, understanding your goals and drafting their dossiers use the relevant tasks and goals. Some of this runs in the background. Research you ask for sends the task and your instructions to the AI, and its search queries go to a web search provider. Research can also open public web pages.
• Reminders with notes (only if you turn this on) may send up to a few thousand characters of a task's notes to be summarized.

Which provider: if you connect your own AI provider, your requests go to that provider under your own agreement with it. If someone shares their AI access with you and you accept, your requests go through their provider, and they can see how much you've used it. Otherwise the built-in AI is provided by xAI using our account. We use providers' business APIs; we don't use your content to train AI models, and we don't permit our providers to use it for their own purposes beyond providing the service, to the extent their terms allow us to control this.

AI can be wrong. Always check what it suggests before relying on it. Changes the assistant makes are recorded like your own and can be undone. Research results and changes from connected tools are shown for your approval first.

5. Who we share it with

We share personal information only as needed to run XCortex, with these service providers (“subprocessors”):

Services you connect. When you connect your own AI provider, Telegram bot, calendar feed, search key or tool server, we send it what's needed for the feature you set up. For example, reminders go to your Telegram bot, and tool servers receive the requests the assistant makes. Those services are governed by your own agreements with them.

Other assistants you connect. If you connect another AI assistant, such as ChatGPT, Claude, Gemini or Grok (Settings → Connections → Other assistants, see how it works), that assistant can read and change your tasks through the tools you approved: it receives the tasks, notes and results its requests return, and handles them under your agreement with that provider. We don't receive your conversations with it, only the requests its tools send us. Requests it hands to the XCortex assistant are processed as described in section 4. You can disconnect it at any time, which stops its access immediately.

Other disclosures. We may disclose information if the law requires it, such as a valid court order, to protect the rights, safety or property of our users, the public or XCortex, or as part of a sale or transfer of XCortex (for example, to a company formed to operate it). In that case this policy continues to protect your information, and we'll tell you before it's governed by a different policy.

6. Analytics and browser storage

• No cookies. XCortex doesn't set cookies, and there are no advertising or third-party analytics scripts. All code runs from xcortex.com.
• Browser storage: the app keeps your sign-in token and your display preferences (theme, text size, language, week start and similar) in your browser's local storage. Signing out removes the sign-in token.
• Usage analytics: when you're signed in, the app records which features, buttons and screens you use, and response times. It uses fixed labels such as “opened the calendar”, and never the text you write. These records are linked to your account so we can understand how features are used over time. Detailed records are kept for 90 days; daily totals are kept longer.
• Performance telemetry: anonymous timings (how fast the app responds), tied only to a random ID for a single visit.
• Notifications: if you turn them on, your browser installs a small service worker that only shows notifications. It doesn't cache pages or track you.
• Do Not Track: because we don't track you across other websites, we treat all visitors the same whether or not the browser sends a Do Not Track signal. We also don't share data for cross-context advertising, which is what Global Privacy Control signals opt out of.

7. How long we keep it

When you delete your account in Settings, it and everything it owns are removed from our live systems immediately. If you ask us by email instead, we do it within 30 days. Either way, it ages out of our backups within the following 14 days. We may keep information longer if the law requires it or to resolve a dispute.

8. Security

We protect your information with measures including:

• Encryption in transit (HTTPS/TLS) everywhere.
• Passwords stored only as bcrypt hashes.
• Signed sign-in tokens that “Log out” invalidates on every device.
• Encryption at rest for connection credentials, calendar feed addresses and notification subscriptions.
• Encrypted backups.
• Rate limits and automatic blocking of repeated failed sign-ins, and a strict content-security policy.
• A server that only accepts traffic through Cloudflare.

To be clear about one thing: your task content isn't encrypted at rest with a key only you hold. XCortex's servers can read it, because search, reminders and AI features need to. No system is perfectly secure. If a breach affects your personal information, we'll notify you and the authorities as the law requires.

9. Your rights and choices

• Access and portability: Settings → Download my data gives you everything your account holds as a machine-readable JSON file, instantly. Passwords and connection secrets are left out.
• Correction: most things can be edited directly in the app. Ask us for anything else.
• Deletion: Settings → Delete account permanently deletes your account and everything it owns right away, after you confirm with your password. Cancel any paid subscription first.
• Objection and restriction: ask us to stop or limit a use based on our legitimate interests, such as usage analytics.
• Withdraw choices any time in the app: turn off notifications, disconnect services, turn off AI summaries of notes in reminders, or remove “About you” facts.

For anything else, or if you can't sign in, send requests to [email protected] from the email address on your account. We'll respond within 30 days (45 days for California requests, which we may extend as the law allows) and won't charge you. We may need to confirm the request comes from you. You won't be treated differently for using your rights.

10. California residents

If you live in California, the California Consumer Privacy Act (as amended by the CPRA) gives you the rights to know, access, correct and delete your personal information, and to not be discriminated against for exercising them. You can use an authorized agent; we may ask for proof of their authority and to verify your identity.

• Categories we collect: identifiers (email, account ID, IP address); customer records (account and subscription details); internet activity (usage of XCortex); approximate geolocation (places you enter); inferences (your personal context and task labels); and the content you store. We collect these from you, your device and the services you connect, for the purposes in section 3, and disclose them to the providers in section 5.
• Sensitive personal information: account sign-in credentials. We use them only to provide the service and never to infer characteristics about you.
• No sale or sharing: we have not sold or shared (for cross-context behavioral advertising) personal information in the past 12 months, including of consumers under 16.
• Retention: see section 7.
• Shine the Light: we don't disclose personal information to third parties for their direct marketing.

11. EEA, UK and Swiss residents

You have the rights in section 9 under the GDPR, UK GDPR or Swiss law, and the legal bases for our processing are listed in section 3. You may complain to your local data-protection authority, although we'd appreciate the chance to resolve it first. Your information is stored in the United States (section 13).

12. Children and teens

XCortex isn't for children under 13, and we don't knowingly collect personal information from them. If you're between 13 and 18, or under the age of digital consent where you live (16 in some EU countries), you may use XCortex only with a parent's or guardian's permission. If you believe a child under 13 has given us personal information, contact [email protected] and we'll delete it.

13. Where your data is stored

XCortex's servers are in the United States, and our providers may process data in the United States and other countries. If you use XCortex from outside the US, your information is transferred to and stored in the US. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses included in our providers' terms.

14. Changes to this policy

We'll post any changes here and update the date at the top. If a change is significant, we'll tell you in the app or by email before it takes effect. If you keep using XCortex after that, you're agreeing to the updated policy.

15. Contact

Questions or requests: [email protected].