xgoose privacy

Updated October 26, 2026 · Chrome and iOS Safari

What the extension accesses

The floating agent reads and acts on the current page when you use it. Installed skills and JavaScript tools can access page content and make requests using the page’s session. Navigation, refresh or closing the page ends the run. Local chat history is stored in extension storage. Skill recommendations match cached catalog metadata locally; they do not send each visited URL to our website.

Images you attach to a conversation

In the Chrome and iOS Safari extensions, you can choose or paste an image. Before sending, the extension resizes and re-encodes it locally. Sending the message shares that image with the selected AI provider, including luna when you use Hosted AI. Attached images remain in local conversation history. Diagnostic transcript uploads include attachment metadata and omit image bytes.

Hosted conversations are saved automatically

Using Hosted AI automatically uploads and saves complete conversations: user messages, model answers, actual tool inputs and outputs, errors, interruptions and context summaries. These may contain page content you ask the agent to read, including personal communications, financial records or health information when you select such content. The extension removes credentials, cookies, authorization headers and recognized sensitive fields before upload. Do not include information you do not want processed by the service.

We store conversation indexes in an account-isolated database and bodies in private object storage. Records expire after 90 days. For requests about stored conversations, contact support. Deleting conversation records does not refund usage. Operational measurements include success, error, latency, usage and completeness. Chat bodies are not sent to Google Analytics or included in public test artifacts.

iOS Safari and account deletion

The iOS app stores API keys and account tokens in a shared, device-only Keychain item. Non-secret preferences are shared with its Safari extension through an App Group. The app guides you to enable the extension and grant website access; access to one website does not grant access to every website. The iOS release executes packaged website skills and does not install community scripts or run AI-authored JavaScript.

In the iOS app, open Account and choose Delete account & cloud data to request permanent deletion. We immediately disable the account and revoke its sessions, then remove its associated data, conversations and owned published skills. Temporary storage failures are retried automatically. Local exported files remain under your control. Optional product analytics are off by default for a new iOS installation.

BYOK

When using your own provider or LiteLLM endpoint, model requests go to your configured provider. Conversation upload to xgoose is off by default. After signing in, you may separately opt in. Provider privacy terms also apply to the data sent for inference.

Storage and staff access

Conversation storage is part of the Hosted AI service and does not require a separate upload setting. Turning off optional BYOK uploads stops future uploads and clears pending uploads when the extension next connects. Administrators may review stored conversations to provide support, diagnose failures and maintain service quality. Cloud transcript viewing is restricted to authenticated administrators, and every read is audited. Ordinary users keep their chat history locally in the extension.

Usage analytics

Transcripts may include the website hostname to help diagnose site-specific issues; this metadata is restricted to administrators with the transcript. The website records public page paths, documentation visits and visible reading time, game starts and results, product actions and timing. First-party product events are retained for 30 days. The website also uses a separate Google Analytics 4 web stream for visitor and session counts, approximate location, device categories and acquisition sources. Referral data is limited to the referring website origin; campaign labels use validated UTM values. Analytics page locations exclude query strings and fragments, including search terms and authentication tokens. You can disable website usage analytics from the footer; Do Not Track is respected. We use this data to understand site usage and diagnose failures. Advertising personalization and Google signals are disabled. Private URLs, email addresses, messages and keys are excluded. The extension has a usage analytics setting that can be turned off in Settings. When enabled, interaction events, provider choice, errors, platform and a persistent installation identifier are sent through our analytics endpoint to Google Analytics 4. Signed-in events may include a pseudonymous account ID. Conversation bodies, tool bodies, API keys and authentication tokens are not included in these analytics events. Hosted billing and service reliability records remain necessary to operate the service.

When enabled, extension analytics also includes browser family and major version, operating system, language, screen resolution, approximate country/region and foreground interaction time. Our analytics proxy does not send raw IP addresses, raw user-agent strings or precise location to Google. Backend operational events stay in the first-party dashboard.

Accounts, credit and security

We retain account and session information, including IP address and user agent, to authenticate users, revoke devices, prevent abuse and account for usage. We do not request precise GPS location. Trial credit is automatically issued once per verified account, expires after 30 days and is subject to a platform spending cap. Provider credentials and internal service credentials are server secrets and are not shipped in the extension.

Contact

For privacy requests, use Support. If a tool output or transcript is incomplete, the service records that limitation rather than treating it as a complete account of the run.