What we do with your data.

Who we are

This notice covers the Xaish service at xaish.com — the website, API, security and payment agents, and Paynnt. Questions: privacy@xaish.com or /contact.

What we collect

• Account data: email, password hash (bcrypt), optional display name and workspace name, 2FA enrollment metadata.
• Session: an HttpOnly cookie named xaish_session (a signed JWT, 14-day lifetime). See Cookies.
• Agent input you paste: code, configs, logs, invoices, transaction context — whatever you submit to a tool. We send that text to an AI provider to produce the result. We do not keep a searchable archive of pastes.
• Usage events: workspace, agent id, endpoint, actor kind, HTTP status, timestamp. Used for quotas and billing reconciliation. Not the paste itself.
• Paynnt: public wallet address, encrypted server-custody secret if you use that mode, off-chain transfer summaries. On-chain data is public by design.
• Billing: Stripe customer id and subscription status. We never receive full card numbers.
• Access logs: method, path, status, latency, client IP, request id. Request bodies are not logged in normal operation.

Where your paste goes

Most agents send your input to a third-party AI provider. Today that provider is Anthropic (Claude). Anthropic is contractually restricted from training its general models on API customer prompts under Anthropic's current commercial API terms. If you need a different provider contract (BAA, EU residency), write /contact before you subscribe.

We run a credential redactor on agent inputs and on many agent outputs. High-shape secrets (Anthropic keys, GitHub PATs, Slack tokens, AWS access keys, Authorization headers, and similar patterns) are replaced with [REDACTED-CREDENTIAL:<kind>] before the provider sees them. This is best-effort pattern matching, not a guarantee. Do not paste production secrets.

Processors we use

• Anthropic — analysis of agent submissions.
• Stripe — card subscriptions and invoicing. PAN/CVV stay in Stripe's PCI environment.
• Resend — transactional email (verify, password reset) when email is configured.
• Solana RPC operator (public devnet RPC by default, or a provider you configure such as Helius / QuickNode) — Paynnt reads and submits transactions. Public chain data is not private.
• Sentry — server error monitoring only if SENTRY_DSN is set. Browser Session Replay is off. We do not set a public browser DSN by default.
• Hosting / Postgres — the VPS or cloud host running the app and database.

We do not sell personal information. We do not share it for cross-context behavioral advertising.

Payment data and wallets

Subscription charges go through Stripe. We store stripe_customer_id and subscription status only.

• Server-custody (Paynnt default). We mint a Solana keypair and store the secret Fernet-encrypted under PAYNNT_VAULT_KEY. It does not appear in logs or API responses in plaintext. Paynnt on this deployment is Solana devnet — test value, not mainnet funds.
• External wallet. Connect Phantom, Solflare, or Backpack. We store the public key only.

Cookies

The only first-party cookie we set is the session cookie. It is strictly necessary to stay signed in. Details: Cookie notice.

How long we keep it

• Account + workspace: for the life of the account. We delete on a verified request to privacy@xaish.com.
• Usage events: 24 months, then eligible for purge. We can purge a workspace earlier on request.
• Access logs: about 14 days on the default single-host deploy; longer if your log aggregator is configured that way.
• Verify / reset tokens: deleted when used, or after 24 hours (verify) / 1 hour (reset).
• Paynnt on-chain history: immutable on Solana. We keep an off-chain summary for the UI until the account is deleted.

Your rights

You can ask for a copy of your data, a correction, or deletion, or close the account. Email privacy@xaish.com. We respond within 30 days. If you are in a jurisdiction with additional privacy rights (including the EU/UK GDPR and California CPRA), we will honor those requests through the same address.

International transfers

Anthropic, Stripe, and Resend may process data in the United States. Using the service means that transfer. If you need a data-processing addendum or SCCs for a paid enterprise contract, ask legal@xaish.com.

Children

Xaish is not directed at children under 16. We do not knowingly collect their data.

Changes

We bump the date at the top of this page when the notice changes. Material changes to how we handle personal data are emailed to subscriber-tier accounts.