Privacy Policy

Last updated: 2026-05-26

What we collect

• Account data — when you sign in with Google we receive your email, display name, and avatar URL. We store these to identify you across devices.
• Project content — when you save a project, its configuration (layers, templates, settings) is stored in our MongoDB.
• Uploaded assets — audio, images, and video you upload are stored on Cloudflare R2 (our object storage). They're accessible only via unguessable URLs scoped to your account.
• Cookies — one httpOnly cookie (`xenaxio_session`) holds your signed-in JWT. We don't use third-party tracking cookies.

What we don't do

• No third-party analytics or advertising trackers.
• No selling or sharing your data with third parties.
• We never read or process your audio content for purposes other than delivering the visualizer service.

Local processing

Signing in (free, via Google or an emailed link) is required to use the editor, but the audio processing itself stays on your device: audio decoding, BPM detection, rendering, and export all happen client-side in your browser. Your audio file is only uploaded when you save a project to your account or use an AI feature.

Where data is stored

Account and project metadata live in MongoDB on a Hetzner server in the EU. Uploaded assets live in Cloudflare R2 (EEUR region by default). Backups are kept for up to 30 days.

Deleting your data

Email [email protected] from your account email and we'll delete everything within 7 days. A self-serve account deletion endpoint is on the roadmap.

Children

Xenaxio is not intended for users under 13. We don't knowingly collect data from children.

Contact

Privacy questions: [email protected].