The first time you use an AI feature, XeNo asks for your explicit, affirmative consent and names the recipient (Google LLC) before any document content is transmitted. No document data leaves your device until you grant this consent. Once granted, AI features work without repeating the prompt. You can withdraw your consent at any time in Settings, which disables AI features and stops any further data from being sent.
01 Information We Collect
1.1 Device & Technical Information
- Device info: Model, OS version, language, and time zone.
- App diagnostics: Crash logs, performance data, and app version.
1.2 File, Photos & Document Information
XeNo is a file manager with AI-powered document and photo understanding. It requires access to your device storage and, with your permission, your Photos gallery. Depending on your permissions and usage, we process:
- File names, paths, and metadata (size, type, creation dates)
- Folder structures and organization patterns
- Photo filenames and metadata (date, camera model, dimensions)
- Document and photo content — only when you explicitly invoke an AI feature such as document Q&A, photo Q&A, or semantic search (see Section 3 for the full data flow)
1.3 Usage Information
- Features you interact with and frequency of use
- Search queries and AI commands
- Interaction events (file opened, moved, renamed, etc.)
1.4 Contact & Support Information
- Email address and name if you contact us for support
- Content of your support messages
02 How We Collect Your Information
- Directly from you: When you grant storage or camera permissions, type a query, or contact support.
- Automatically: Crash logs and diagnostic data collected by Firebase Crashlytics when the app encounters an error.
- Through AI interactions: When you invoke an AI feature, relevant portions of your document are extracted on-device and sent to our backend (see Section 3).
03 AI Processing & the Document Pipeline
XeNo uses Retrieval-Augmented Generation (RAG) to answer questions about your documents. Below is the complete step-by-step account of what happens to your data when you use an AI feature.
Your documents are stored exclusively on your device. XeNo never uploads or mirrors your files to our servers.
When you enable AI on a document, XeNo builds a semantic index (embeddings) entirely on your device. No content leaves your device at this step.
When you ask a question, the most relevant text segments (“chunks”) are identified and extracted locally using the on-device index. Only the relevant chunks are selected — not the full document.
The selected chunks — and only those chunks — are transmitted over an encrypted TLS/HTTPS connection to our backend server. Your full documents are never sent.
Our backend passes the relevant chunks and your query to the Google Gemini API to generate a coherent, contextual response.
Once Gemini returns its response, the document chunks are permanently deleted from our backend. We do not log, store, cache, or retain any document content on our servers after the API call completes.
The AI-generated response is returned to the app and displayed to you. No document data is sent back.
- Provider
- Google LLC — Gemini API
- What is sent
- The text chunks extracted from your document that are relevant to your query, plus the query itself. Your full document, file name, file path, and any personal identifiers are never sent to Gemini.
- Why it is sent
- To generate a natural-language response to your question about the document. Gemini processes the context (chunks + query) and returns a synthesised answer.
- AI training
- XeNo uses the Gemini API under terms that disable the use of submitted data for AI model training. Google does not use data sent via the Gemini API to train or improve its AI models. We also do not use your data to train any of our own models.
- Retention by Google
- Google may transiently process the data to generate a response but does not retain it beyond the API call, per Gemini API usage terms.
- Data protection
- Google LLC provides data protection equivalent to or exceeding the standards in this policy. Its handling of API data is governed by the Google Privacy Policy, the Gemini API Additional Terms of Service, and the Google Cloud Data Processing Addendum, and complies with GDPR, CCPA, and other applicable frameworks. Under the paid Gemini API, Google does not use submitted prompts or responses to train or improve its models.
04 All Uses of Your Data
We use data collected for the following purposes only:
- Core app functionality: File management, search, organisation, and AI document Q&A.
- AI features: Semantic indexing, chunk extraction, and Gemini-powered response generation as described in Section 3.
- Diagnostics: Crash logs and performance data to identify and fix bugs.
- Usage analytics: Aggregate, anonymised usage patterns to improve the app.
- Support: Responding to your support requests and feedback.
- Legal compliance: Meeting our obligations under applicable law.
XeNo does not use your data — documents, queries, or any other content — to train AI models, whether our own or third-party models. The Gemini API is used under terms that explicitly disable training on API-submitted data.
05 Legal Bases for Processing (EEA / UK Users)
- Contract performance: To provide the core file management and AI features you use.
- Consent: For optional features or analytics where required by law.
- Legitimate interests: To improve the app and diagnose crashes.
- Legal obligation: Where required by applicable law.
06 Third Parties We Share Data With
We do not sell your data. Below is the complete list of third parties that receive data from XeNo, what data they receive, and confirmation that each provides equivalent data protection:
| Service | Purpose | Data Shared |
|---|---|---|
| Google Gemini API | AI response generation (Section 3) | Relevant document chunks + query only. Training disabled. |
| Firebase Crashlytics | Crash reporting and diagnostics | Crash logs, device model, OS version. No document content. |
| Firebase Analytics | Anonymised usage analytics | Aggregated interaction events. No document content. |
| Apple APNs | Push notification delivery (iOS only) | Device push token only. |
All providers listed above are contractually bound to protect your data to standards equivalent to or exceeding this policy. Google services comply with GDPR, CCPA, ISO 27001, and SOC 2.
Third-Party Service Privacy Policies
Below is the complete list of third-party services XeNo uses, with links to their privacy policies and terms. We encourage you to review them.
AI Processing
Analytics & Diagnostics (Firebase / Google)
Push Notifications
Under the paid Gemini API, Google does not use submitted prompts or responses to train or improve its models, and does not retain them beyond the API call. See the Gemini API terms above for details.
07 Data Retention Policy
| Data Type | Retention | Notes |
|---|---|---|
| Document chunks | Zero — deleted immediately | Permanently deleted from our backend as soon as Gemini returns a response. Never stored. |
| Gemini API processing | Transient only | Google processes chunks to generate a response and does not retain them, per API terms (training disabled). |
| Crash & diagnostic logs | 90 days | Automatically deleted after 90 days. |
| Account & support data | Duration of account | Deleted within 30 days of account deletion request. |
Account Deletion
You may request deletion of your account and all associated data at any time by contacting us. We will complete deletion within 30 days of your request.
In line with Apple App Store guidelines, account deletion is available directly within the app under Settings → Delete Account. You do not need to contact us or visit a website to delete your account.
08 App Permissions (iOS)
- Camera (NSCameraUsageDescription): To capture documents directly into the app.
- Files / Storage (UIFileSharingEnabled): Required to browse, organise, and index your documents for AI features.
- Notifications (UNUserNotificationCenter): For task completion and reminder alerts via Apple Push Notification service (APNs).
XeNo does not use Apple’s App Tracking Transparency (ATT) framework, the IDFA, or any cross-app advertising identifiers. We do not track your activity across other apps or websites.
You may revoke any permission at any time in Settings → Privacy & Security. Revoking file access will disable file management and AI features.
09 Data Storage & Security
- On-device storage: Encrypted Core Data / SwiftData stores and iOS Keychain for credentials.
- Encryption in transit: All network communication uses TLS/HTTPS, enforced via iOS App Transport Security (ATS).
- Backend access: Restricted via authentication; no document content is persisted.
- No file mirroring: Your documents are never uploaded to or stored on our servers.
10 Your Rights
- Access: Request a copy of personal data we hold about you.
- Rectification: Correct inaccurate data.
- Deletion: Request erasure of your data.
- Opt-out of analytics: Disable analytics collection in app settings.
- CCPA (California): We do not sell personal data.
To exercise any right, contact us at support@imaginationai.net.
11 International Data Transfers
XeNo is operated by ImaginationAI. Your data may be processed in countries outside your own, including the United States (Google’s infrastructure). Where required, we rely on Standard Contractual Clauses (SCCs) or equivalent mechanisms to ensure adequate data protection for transfers outside the EEA or UK.
12 App Store Privacy Nutrition Labels
Apple requires all apps to declare their data practices in the App Store. Below is XeNo’s App Store privacy label summary:
| Data Type | Purpose | Linked to Identity |
|---|---|---|
| Crash Data | App Improvement | No |
| Usage Data (anonymised) | App Improvement / Analytics | No |
| Document Chunks (transient) | App Functionality (AI features) | No |
| Support Contact Info | Customer Support | Yes |
XeNo does not collect data for advertising and does not track users across other apps or websites. We do not use Apple’s ATT framework or the IDFA.
13 Children’s Privacy
XeNo is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
14 Changes to This Policy
We may update this policy from time to time. We will update the “Last updated” date at the top of this page. For material changes, we will provide in-app notice.
15 Contact Us
Questions about this policy or your data:
- Email: support@imaginationai.net
- Subject line: “Privacy – XeNo”
- Company: ImaginationAI