Privacy & Data Policy

Privacy & Data Policy

🔒 Our Privacy Commitment

XHack AI is built with privacy as a core feature. We are transparent about what data we process and how.

Two Products, Two Models

1️⃣ XHack AI Agent (CLI) - Powered by xhack-ai Model

• Runs locally on your machine
• Uses xhack-ai model for security analysis and decision-making
• Chat history stored locally in ~/.xhack/ - NOT on our servers
• Optional: Use local Ollama models for 100% offline operation
• No data collection, no telemetry, no tracking

2️⃣ XHack AI Platform (Web /chat) - Powered by xhack-ai Model

• Web-based interface for security research
• Uses xhack-ai model for computational analysis
• Chat history stored in secure cloud database - for session management and your access
• Necessary for: saving your work, team collaboration, research continuity
• You control deletion: delete a chat and it's permanently removed from servers

📌 Quick Comparison

Feature	Agent (CLI)	Platform (Web)
Model Used	xhack-ai (local)	xhack-ai (cloud)
Chat Storage	Local ~/.xhack/	Cloud (for sessions)
Server Access	None	Yes (for your work)
Data Collection	❌ None	For session management only
Offline	✅ Yes	❌ Requires internet
Deletion	Delete locally	Delete from UI
Privacy	Maximum	Transparent & Legal

XHack AI Agent (CLI) - Local-First Privacy

The XHack AI Agent is a command-line tool that respects your privacy.

How It Works

Your Security Test/Prompt
    ↓
XHack Agent (Local Process)
    ↓
xhack-ai Model (Local Computation)
    ↓
Analysis & Results
    ↓
Stored in ~/.xhack/chats/ (Your Machine)
    ↓
Zero Server Involvement

✅ What The Agent Provides

• ✅ xhack-ai Model - Our proprietary AI for security analysis and decision-making
• ✅ Local Processing - All computation happens on your machine
• ✅ Privacy by Default - No cloud storage, no data transmission
• ✅ Optional Ollama Support - Run local models for 100% offline operation
• ✅ Complete Control - All data stays in ~/.xhack/ folder on your machine

❌ What The Agent Does NOT Do

• ❌ No cloud data transmission - Chats don't leave your computer
• ❌ No server storage - We never store Agent chats on our servers
• ❌ No user profiling - We don't build profiles or track behavior
• ❌ No telemetry - No usage analytics or tracking data
• ❌ No third-party APIs - Uses xhack-ai model only (no OpenAI, Claude, etc.)
• ❌ No data selling - Your data is never sold or shared

✅ How Your Data Actually Works

Local Storage Architecture

Everything stays on YOUR machine:

~/.xhack/
├── config/
│   ├── settings.json          # Your local configuration
│   ├── api-keys.enc           # Encrypted API keys (local)
│   └── preferences.json       # Your preferences
├── chats/
│   ├── chat_1.json            # Chat history (local)
│   ├── chat_2.json            # Chat history (local)
│   └── chat_3.json            # Chat history (local)
├── models/
│   ├── ollama/                # Local Ollama models
│   ├── llamacpp/              # Local LLaMA.cpp models
│   └── custom/                # Your custom models
├── logs/
│   └── agent.log              # Local logs only
└── cache/
    └── responses.cache        # Cached responses (local)

Nothing is sent to XHack servers. Everything stays in ~/.xhack on your computer.

What Happens with Your Chats

1. You prompt the agent → Message stored locally
2. Agent processes request → Using local or your API keys
3. Response generated → Stored locally
4. Chat history saved → Only in ~/.xhack/chats/
5. Zero server involvement → No data transmitted to us

🤖 xhack-ai Model & Local Alternatives

Primary: xhack-ai Model

XHack Agent uses our proprietary xhack-ai model for all security analysis:

• ✅ Optimized for security - Trained specifically for vulnerability detection
• ✅ Fast and efficient - Runs locally without external dependencies
• ✅ Privacy-first - All computation on your machine
• ✅ No external APIs - Doesn't call OpenAI, Claude, or any third-party services
• ✅ Deterministic results - Consistent vulnerability analysis

Alternative: Local Ollama Models (100% Offline)

For maximum privacy and offline operation:

Ollama Models

Free, open-source models running on your machine:

# Install Ollama (https://ollama.ai)
ollama pull llama2              # 7B parameter model
ollama pull mistral             # Faster, lightweight
ollama pull neural-chat         # Chat optimized
ollama pull dolphin-mixtral     # More capable

# XHack automatically detects and connects to Ollama
# All inference happens on your computer
# Zero data leaves your machine

Available Ollama Models:

• Llama 2 - General purpose, 7B-70B sizes
• Mistral - Fast and efficient
• Neural Chat - Optimized for conversations
• Dolphin Mixtral - High quality responses
• OpenHermes - Instruction-tuned
• Any custom model - Bring your own

Llama.cpp (CPU-based)

Run quantized models even on older hardware:

# Download quantized model
# XHack supports GGUF format models

# Examples:
# - Mistral 7B Q4 (4GB RAM)
# - Llama 2 13B Q5 (8GB RAM)
# - Neural Chat 7B Q8 (16GB RAM)

Local GPU Acceleration

Speed up local models:

• NVIDIA GPU - CUDA support for fast inference
• AMD GPU - ROCm support
• Apple Silicon - Metal acceleration
• CPU - Works everywhere, slower

🔐 API Key Security

If you choose to use cloud services, your API keys are:

• ✅ Encrypted locally - AES-256 encryption
• ✅ Never sent to XHack - Only sent to the service you choose
• ✅ Never logged - Not stored in plain text
• ✅ Under your control - You can rotate/revoke anytime
• ✅ Deleted on demand - Remove them from .xhack/config/api-keys.enc

Example storage:

{
  "openai": "sk-xxx...xxx (encrypted)",
  "anthropic": "sk-ant-xxx...xxx (encrypted)",
  "groq": "gsk-xxx...xxx (encrypted)"
}

All encryption/decryption happens locally. Keys never leave your machine.

📊 Zero Data Collection Policy

We DO NOT:

• Store any of your prompts or questions
• Store any of the agent's responses
• Track which models you use
• Track how often you use the agent
• Collect IP addresses
• Collect device information
• Use cookies for tracking
• Send telemetry data
• Build user profiles
• Correlate usage patterns

XHack AI Platform (Web /chat) - Session-Based Storage

The XHack AI Platform (/chat web interface) is where researchers perform security work.

✅ Why We Store Platform Chats (Necessary for Sessions)

Chat storage is required for core functionality:

• ✅ Session Management - Maintain your working environment
• ✅ Chat Continuity - Resume previous research sessions
• ✅ Work Preservation - Save your security assessments and findings
• ✅ Team Collaboration - Share chats with authorized team members
• ✅ Audit Trails - Maintain compliance and documentation records
• ✅ Research Reference - Access findings and methodologies later
• ✅ Performance - Enable fast chat loading and retrieval

🔒 How We Protect Platform Chats

• ✅ Encryption at rest - Industry-standard encryption
• ✅ Access control - Only you and authorized collaborators
• ✅ Secure transmission - HTTPS/TLS encryption in transit
• ✅ No data sharing - Never shared with third parties
• ✅ No tracking - Chats not used for profiling or analytics
• ✅ Transparent policy - Clear deletion and retention rules

🗑️ What Happens When You Delete

When you delete a chat from the platform:

• ✅ Immediately removed from database - Not recoverable
• ✅ Permanent deletion - No backup copies or archives retained
• ✅ Complete purge - Not in trash or recovery system
• ✅ Zero data retention - Data completely vanished from servers
• ✅ Instant - Deletion is immediate, not queued

Deletion process:

You click "Delete Chat"
    ↓
Immediate database removal
    ↓
All associated messages deleted
    ↓
No retention or archiving
    ↓
Completely vanished from all servers
    ↓
Zero recovery possible

Legal Basis for Storage

Platform chat storage is necessary for:

• ✅ Service Delivery - Cannot provide web platform without storing sessions
• ✅ User Benefit - You requested chat history storage for your work
• ✅ Legitimate Interest - Allowing researchers to save their work
• ✅ GDPR Compliant - Processing is necessary for contract performance
• ✅ User Control - You have full deletion control at any time

Comparison: Agent vs Platform

Feature	Agent (CLI)	Platform (Web)
Chat Storage	Local only	Cloud
Server Access	None	Yes (for work)
Data Retention	Forever (until you delete)	Until you delete
Use Case	Private local testing	Collaborative research
Deletion	Delete ~/.xhack/	Delete from UI
Deletion Result	Vanishes locally	Vanishes from servers
Accessibility	Your machine only	Accessible online
Team Collaboration	Not built for it	Full collaboration

🔄 Data Flow Diagrams

Agent (CLI) - Using xhack-ai Model:

┌─────────────────┐
│  Your Prompt    │
└────────┬────────┘
         │
         ↓
┌──────────────────────────────────────┐
│  XHack Agent (Local Process)         │
│  • Runs entirely on YOUR machine     │
│  • Uses xhack-ai model               │
│  • Processes security analysis       │
│  • Zero external API calls           │
└────────┬─────────────────────────────┘
         │
         ↓
┌──────────────────────────────────────┐
│  xhack-ai Model (Local Inference)    │
│  • Proprietary security model        │
│  • No third-party APIs               │
│  • Deterministic analysis            │
│  • Privacy-first computation         │
└────────┬─────────────────────────────┘
         │
         ↓
┌──────────────────────────────────────┐
│  ~/.xhack/chats/                     │
│  (Your Computer - Local Storage)     │
│  No XHack servers involved           │
│  Complete privacy maintained         │
└──────────────────────────────────────┘

Agent (CLI) - With Local Ollama Model:

┌─────────────────┐
│  Your Prompt    │
└────────┬────────┘
         │
         ↓
┌─────────────────────────────────────┐
│  XHack Agent (Local Process)        │
│  + Local Ollama/LLaMA.cpp Model     │
│  - Zero internet access             │
│  - Zero data transmission           │
└────────┬────────────────────────────┘
         │
         ↓
┌─────────────────────────────────────┐
│  ~/.xhack/chats/                    │
│  (Your Computer Only)               │
│  Completely private and offline     │
└─────────────────────────────────────┘

Platform (Web /chat) - Session Storage:

┌──────────────────┐
│  Your Prompt     │
└────────┬─────────┘
         │
         ↓
┌────────────────────────────────────────┐
│  XHack Platform (Web /chat)            │
│  • Web-based interface                 │
│  • Session management                  │
│  • Real-time collaboration             │
└────────┬───────────────────────────────┘
         │
         ↓
┌────────────────────────────────────────┐
│  xhack-ai Model (Cloud Instance)       │
│  • Computational analysis              │
│  • Security decision-making            │
│  • Proprietary xhack-ai model          │
└────────┬───────────────────────────────┘
         │
         ↓
┌────────────────────────────────────────┐
│  XHack Cloud Database                  │
│  STORED FOR SESSION MANAGEMENT:        │
│  ✓ Save your research work             │
│  ✓ Access chats later                  │
│  ✓ Team collaboration                  │
│  ✓ Research continuity                 │
│  ✓ Encrypted at rest                   │
│  ✓ You control deletion                │
│  → Delete chat = permanently removed   │
│  → Zero retention after deletion       │
└────────────────────────────────────────┘

🛡️ Security Features

Encryption

• ✅ Local API keys encrypted with AES-256
• ✅ Chat files stored securely
• ✅ Configuration files encrypted
• ✅ Optional passphrase protection

Isolation

• ✅ Agent runs as local process (not cloud)
• ✅ No network listeners by default
• ✅ Communication only with chosen services
• ✅ Can run completely offline with local models

Auditability

• ✅ See exactly what's stored in ~/.xhack/
• ✅ Inspect all configuration files
• ✅ Delete any data anytime
• ✅ No hidden syncing or uploads

📁 Accessing Your Data

All your data is human-readable and accessible:

# View your chat history
ls ~/.xhack/chats/

# Read a specific chat
cat ~/.xhack/chats/chat_1.json

# View configuration
cat ~/.xhack/config/settings.json

# Check what's stored
du -sh ~/.xhack/

🗑️ Deleting Your Data

Complete control over your data:

# Delete specific chat
rm ~/.xhack/chats/chat_1.json

# Delete all chats
rm -rf ~/.xhack/chats/*

# Delete everything (full reset)
rm -rf ~/.xhack/

# Data is gone. Nothing on our servers to delete.

🌐 Internet Requirements

With Local Models

• ✅ Fully offline - No internet required
• ✅ No connectivity needed - Run anywhere
• ✅ Zero external calls - Complete privacy

With Cloud Models

• ⚠️ Internet required - To reach API providers
• ⚠️ Only to your chosen service - Not to XHack
• ⚠️ Your API key only - Direct connection

📋 Compliance

GDPR

• ✅ No data collection = GDPR compliant
• ✅ User has full control of their data
• ✅ Data on user's machine only
• ✅ No "right to be forgotten" needed (we have nothing)

CCPA

• ✅ No personal information collected
• ✅ No data sharing
• ✅ No tracking cookies
• ✅ Complete user control

HIPAA

• ✅ Can be used for healthcare without violations
• ✅ All data stays local
• ✅ No server-side storage
• ✅ Fully compliant with encryption

❓ Frequently Asked Questions

Q: Does XHack store my chats?

A: It depends on which product:

• Agent (CLI): No. Chats are stored ONLY on your computer in ~/.xhack/chats/. XHack servers never receive Agent chat data.
• Platform (Web /chat): Yes. Chats are stored in our secure cloud database for session management and your access. Delete a chat and it's permanently removed from our servers.

Q: What AI model does XHack use?

A: XHack uses its own proprietary xhack-ai model for all security analysis. We do NOT use OpenAI, Claude, Google Gemini, Groq, or any third-party APIs. Everything stays with xhack-ai.

Q: Can I use this completely offline?

A: Yes! Use local models (Ollama, LLaMA.cpp) and run 100% offline with zero data transmission.

Q: Where is my data stored?

A: Only in ~/.xhack/ on YOUR computer. Nowhere else.

Q: Can you access my chats?

A: No. We cannot access your ~/.xhack/ folder. It's on your machine only.

Q: What if I delete the agent - is my data deleted?

A: No. Your data in ~/.xhack/ persists. Uninstalling the agent doesn't touch it. You must manually delete ~/.xhack/ to remove all data.

Q: Can you see my API keys?

A: No. Keys are encrypted locally. Even if you reinstall, the encryption is local-only. Keys are never transmitted or logged.

Q: Is there any telemetry?

A: No. Zero telemetry, zero tracking, zero analytics. We have no way to know you're using XHack.

Q: What about updates - do you track usage?

A: No. Update checks are minimal and don't include usage data. You control when/if to update.

Q: Can local models access the internet?

A: No. Local models (Ollama, LLaMA.cpp) run entirely on your machine with zero internet access.

Q: Is my data encrypted?

A: Yes - API keys are AES-256 encrypted. Chat data is stored plaintext in JSON (you can encrypt the folder yourself for additional security).

🔗 Local Model Setup Guide

Quick Start: Ollama (Recommended)

# 1. Install Ollama (https://ollama.ai)
curl https://ollama.ai/install.sh | sh

# 2. Start Ollama service
ollama serve

# 3. Pull a model (in another terminal)
ollama pull mistral

# 4. XHack automatically detects Ollama running on localhost:11434
# 5. Configure XHack to use Ollama
xhack config set model ollama:mistral

# 6. Start using - completely private, no data leaves your machine
xhack chat "Your prompt here"

Advanced: LLaMA.cpp

# Build from source or use pre-built binaries
# Configure XHack to use local model file
xhack config set model local:/path/to/model.gguf

# Run with GPU acceleration (optional)
xhack config set use-gpu true

🎯 Summary

Agent (CLI) - Powered by xhack-ai

Aspect	Status	Details
Model Used	xhack-ai	Proprietary security analysis model
Chat Storage	📁 Local Only	~/.xhack/chats/ on your computer
Server Data	❌ None	XHack servers have ZERO Agent chat data
Data Collection	❌ None	Zero tracking, zero telemetry
Third-Party APIs	❌ None	No OpenAI, Claude, Google, Groq, etc.
Offline Support	✅ Full	Run with xhack-ai or local Ollama models
Data Deletion	✅ Easy	Delete ~/.xhack/ to remove everything
Privacy Level	🔒 Maximum	Complete local privacy
GDPR Compliant	✅ Yes	No server data = fully compliant
CCPA Compliant	✅ Yes	No tracking, full user control

Platform (Web /chat) - Powered by xhack-ai

Aspect	Status	Details
Model Used	xhack-ai	Proprietary security analysis model
Chat Storage	☁️ Cloud	Secure database for session management
Storage Necessity	✅ Required	Core functionality for web platform
Encryption	✅ At Rest	Industry-standard encryption
Data Deletion	✅ Instant	Permanently removed from servers
Retention Policy	🗑️ None	Zero retention after deletion
Team Collaboration	✅ Yes	Share chats with team members
Access Control	✅ Yes	Only you and authorized collaborators
Audit Trail	✅ Yes	For compliance and documentation
Legal Basis	✅ Transparent	Necessary for service delivery
GDPR Compliant	✅ Yes	Data deletion honored immediately
CCPA Compliant	✅ Yes	User controls all data

Need Help?

• Privacy Questions: contact privacy@xhack.io
• Data Issues: contact support@xhack.io
• Technical Help: Check ~/.xhack/logs/ for agent logs

Last Updated: {current_date}

Your privacy matters. That's why we built XHack to never collect your data. 🔒