Privacy Policy
Effective September 30, 2026
Xfile is operated by TEPEX LLC. This policy explains what the Xfile website and the Xfile Chrome extension do with your information, in plain terms. Questions go to privacy@xfile.me.
What this covers
Two things:
- The Xfile website at www.xfile.me, including the pages where published Xfiles are read.
- The Xfile Chrome extension, which lets you publish selected text from a page you are reading.
They behave differently, so they are described separately below.
The Chrome extension
What it reads, and when
The extension reads nothing until you ask it to. There is no content script and nothing is left running inside the pages you visit.
When you highlight text and choose Create Xfile from the right-click menu, the extension reads three things from that one tab, at that moment:
- the text you selected,
- the page title,
- the page address.
Those are shown to you in a review window. Nothing has been sent anywhere yet.
What it sends, and when
Only when you press Publish. At that point the extension sends the title, the text you selected, any commentary you typed, and the source link to Xfile over HTTPS, so it can be published to your account. If you close the review window instead, nothing leaves your computer.
Your API key
Your key is stored on your own computer using Chrome's local extension storage. It is not synced to other devices, never placed into any web page, and never written to a log. It leaves your computer only as an authorization header sent to Xfile when you publish.
On our side, we do not keep your key. We store a one-way SHA-256 hash of it together with its first 16 characters, which is what lets us show you which key is which. The key itself is shown to you once when you create it and is not recoverable from what we store. We also record when a key was last used to publish, and you can revoke a key at any time.
The extension contains no analytics, telemetry, tracking, or advertising. It makes exactly one network request, to Xfile, and only when you publish. It does not follow your browsing, and it does not send what you publish to any AI service.
Publishing an Xfile
When you publish, we store a record containing the title, the content, your account handle, the page address it will live at, a short summary generated from the content, the time it was published, and whether it is public.
Xfiles published through the Chrome extension are public. Anyone with the link can read them, and search engines may index them. Publishing costs one credit from your account balance.
Published Xfiles are stored in our database. They are not written to any permanent or blockchain-based storage, and publishing is reversible — see Deleting your data.
Your account
To use Xfile you sign in with an email address. We send a one-time sign-in link to that address; the link expires after one hour and works once. We store your email address, your chosen handle, and your credit balance.
If you buy credits, the payment is handled by Stripe on Stripe's own pages. Card details are entered with Stripe and are not stored by us.
Analytics on the website
The Xfile website uses Google Analytics to understand how the site is used. This includes the pages where published Xfiles are read — so if someone opens an Xfile you published, that visit is measured by Google Analytics.
This applies to the website only. As stated above, the Chrome extension contains no analytics of any kind.
Use of AI services
Some features on the website — such as importing an article from a URL — send that content to an AI provider to generate a summary or description.
Publishing from the Chrome extension does not do this. Text you publish through the extension is not sent to any AI provider.
Deleting your data
You can delete any Xfile you have published from your dashboard at xfile.me/user. Deleting removes the record from our live database.
To delete your account and the email address attached to it, write to privacy@xfile.me.
How long we keep things
We do not run an automatic deletion schedule. What you publish stays until you delete it, and your account details stay until you ask us to remove them.
Our service providers keep their own backups and server logs under their own standard practices and retention periods. Those periods are set by them, not by us, so a copy of deleted content can persist in a provider's routine backups for some time after it is gone from Xfile. We do not state specific durations here because we do not control them.
Who processes your data
We use these providers to run Xfile:
- Vercel — website and API hosting. As with any web host, it processes standard web request information, which can include IP address.
- Supabase — database and sign-in.
- Stripe — payments.
- Resend — sending sign-in emails.
- Google Analytics — website analytics, as described above.
Selling and advertising
We do not sell your data. We do not transfer it to data brokers, and we do not use it to serve personalized, re-targeted, or interest-based advertising.
Chrome Web Store Limited Use
Xfile's use of information received from the Xfile Chrome extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data collected by the extension is used only to provide the extension's single purpose — publishing text you select to your own Xfile account.
Security
Everything the extension and the website send travels over HTTPS. API keys are stored only as one-way hashes, as described above.
Changes to this policy
If this policy changes, we will update this page and the effective date at the top. Material changes will be reflected here before they take effect.
Governing law
This policy is governed by the laws of the State of Texas, United States.
Contact
TEPEX LLC — privacy@xfile.me