Privacy Policy

1. Introduction

This Privacy Policy describes how x-n.dev, operated by bxng.com ("we", "us", or "our"), collects, uses, and protects your personal information when you use the Platform.

By using x-n.dev, you consent to the data practices described in this policy.

2. Information We Collect

We collect the following types of information:

• Account information: name, email address, and password (hashed). If you register via Google, we receive your name and email from Google's OAuth service.
• Workspace data: organization names, member roles, and invitation status.
• Platform content: scenarios, prompts, audio files, arena configurations, and their results — including model outputs, latency, token counts, and cost data per run.
• API keys: third-party provider API keys you provide to enable model comparisons (LLM, STT, and TTS). These are stored encrypted and never exposed in plaintext.
• Billing data: subscription plan, run balance, purchase history, and payment method metadata processed via Stripe. We do not store full card numbers — all payment data is handled by Stripe, Inc.
• Usage data: pages visited, features used, arena run history, and general interaction patterns used to operate and improve the Platform.

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain the Platform.
• Authenticate your identity and manage your account and workspace.
• Execute arena runs using your provided API keys against third-party AI providers.
• Process subscription payments and optional extra run purchases via Stripe, Inc.
• Send transactional emails (e.g., email confirmation, password reset, invitation).
• Process feedback and suggestions you submit.
• Analyze usage patterns to improve the Platform.

4. API Keys and Model Requests

Your API keys are stored securely using encryption at rest. They are used exclusively to make requests to third-party AI providers (e.g., OpenAI, Anthropic, Google, Deepgram, ElevenLabs) on your behalf during arena runs. We never share your API keys with other users or third parties.

Prompts, audio files, and model responses are transmitted to and from third-party providers during arena execution. These interactions are subject to the respective provider's privacy policy and data handling practices. x-n.dev does not retain raw audio or transcript content beyond the retention period defined by your plan (7 days for Trial, 30 days for Pro, 90 days for Team).

5. Payments and Billing

Subscription payments and extra run purchases are processed by Stripe, Inc. We receive a payment confirmation and update your run balance accordingly. We do not store your full card number, CVV, or other raw payment credentials — these are handled entirely by Stripe and subject to Stripe's Privacy Policy.

We retain billing records (plan history, purchase amounts, dates, and run usage) for accounting and support purposes in accordance with applicable law.

6. Data Sharing

We do not sell, rent, or trade your personal information. We may share data only in these cases:

• With third-party AI providers: only the prompts, audio, and parameters you configure, transmitted via your own API keys during arena execution.
• With Stripe: payment and billing information necessary to process subscription and extra run purchases.
• Within your organization: members of your workspace can see shared scenarios and arena results.
• Legal requirements: if required by law, regulation, or legal process.

7. Data Retention

We retain your account data for as long as your account is active. Audio files are deleted automatically after the retention period defined by your plan. If you delete your account or organization, we will remove your personal data and associated content within a reasonable timeframe, except where retention is required by law (e.g., billing records).

8. Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS) and at rest, secure password hashing, encrypted API key storage, and access controls. Authentication is managed via short-lived JWT tokens transmitted as HttpOnly cookies. However, no method of electronic storage is 100% secure, and we cannot guarantee absolute security.

9. Cookies and Analytics

The Platform uses HttpOnly cookies to manage authentication sessions. These cookies are not accessible to JavaScript and are used solely to maintain your logged-in state securely.

The x-n.dev landing site (x-n.dev) uses Google Analytics (GA4) to collect anonymized usage data, including pages visited, session duration, and general interaction patterns. This data is collected via browser cookies set by Google and is subject to Google's Privacy Policy. You may opt out using browser extensions such as the Google Analytics Opt-out Add-on.

Browser local storage may be used to persist non-sensitive UI preferences (e.g., selected locale or workspace view). We do not use cookies for advertising or retargeting purposes.

10. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.
• Withdraw consent for data processing.

To exercise these rights, contact us at contact@x-n.dev.

11. Children's Privacy

x-n.dev is not intended for use by individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Platform. Continued use after changes constitutes acceptance of the updated policy.

13. Contact

For questions or concerns about this Privacy Policy, contact us at contact@x-n.dev.