Legal

Privacy Policy

How XMethod Browser handles your data — spoiler: it stays on your machine.

Last updated: March 25, 2026

1. Introduction

XMethod Organization ("we," "us," or "our") operates XMethod Browser (the "Application"). This Privacy Policy explains how we collect, use, and protect information when you use the Application. We are committed to protecting your privacy and being transparent about our data practices.

2. Our Privacy Philosophy

XMethod Browser is built on a local-first architecture. Your browsing data, passwords, settings, app data, and personal information are stored locally on your device in the ~/.xmethod/ directory. We do not operate cloud servers that store your personal data.

3. Information We Collect

3.1 Account Information

When you create an XMethod account through our portal (portal.xmethod.net), we collect:

  • Email address
  • Name
  • Password (hashed and salted, never stored in plain text)
  • Subscription plan and billing information (processed by our payment provider)

3.2 Locally Stored Data

The following data is stored exclusively on your device and is never transmitted to our servers:

  • Browsing history, bookmarks, and tab sessions
  • Passwords and credentials (AES-256-GCM encrypted)
  • Application settings and preferences
  • Built-in app data (journal entries, notes, tasks, health data, etc.)
  • Downloaded App Store applications
  • AI conversation history

3.3 Information We Do Not Collect

We do not collect or have access to:

  • Browsing activity or history
  • Keystrokes or form input
  • Screenshots or screen recordings
  • Device telemetry or analytics
  • Location data
  • Contacts or calendar data

4. How We Use Information

Account information collected through the portal is used solely for:

  • Authenticating your license and managing your subscription
  • Providing customer support when requested
  • Sending essential account notifications (e.g., subscription renewal, security alerts)
  • Processing payments through our payment provider

5. Third-Party Services

5.1 Google Services (Opt-In)

If you choose to connect your Google account, XMethod Browser communicates directly with Google's APIs on your behalf. We do not proxy, intercept, or store your Google data on our servers. Google services include Gmail, Google Calendar, Google Drive, and Google Tasks integration. Your Google authentication tokens are stored locally on your device.

5.2 AI Services

AI features are powered by third-party model providers accessed through OpenRouter or our portal proxy. When you use AI features, your prompts are sent to the selected AI provider for processing. We do not store or log your AI conversations on our servers. You may provide your own API key or use the portal proxy included with your subscription.

5.3 Ad and Tracker Blocking

The built-in ad and tracker blocker operates entirely on your device. Filter lists are downloaded periodically and applied locally. No browsing data is transmitted for this feature.

5.4 Have I Been Pwned

Password breach checking uses the k-anonymity model — only a partial hash prefix is sent, never your actual passwords or email addresses.

6. Data Security

We implement the following security measures:

  • Encryption at rest: Passwords encrypted with AES-256-GCM; auth tokens stored in Electron safeStorage
  • Biometric protection: Touch ID support for vault access
  • No cloud storage: All personal data remains on your device
  • Secure authentication: JWT-based portal authentication with offline grace period
  • App verification: App Store downloads verified via SHA-256 checksums

7. Data Retention

Local data is retained on your device until you delete it. You have full control over all locally stored data. Account data on our portal is retained for the duration of your active subscription. Upon account deletion, your portal account data is permanently removed within 30 days.

8. Your Rights

You have the right to:

  • Access your data — local data is in ~/.xmethod/, portal data is viewable in your account settings
  • Delete your data — remove ~/.xmethod/ to erase all local data; request account deletion through the portal
  • Export your data — local files are standard JSON and can be copied freely
  • Restrict processing — disconnect Google services, disable AI features, or use the browser without an account (offline mode)

9. Children's Privacy

XMethod Browser is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information through the portal, please contact us so we can delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes through the portal or the Application. Continued use of the Application after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: