Privacy notice

Last updated September 16, 2026.

XData is operated by Arthur Orts and indexes expert content for research and citation. During the private preview, corpus access requires an approved account and OAuth or an issued API key. The research corpus is shared among approved users; it is not a private document vault.

Information we process

• Sign-in identity: email, name, and an identifier from WorkOS.
• Access requests: email, name, organization, intended use.
• Authenticated access: API key records, usage counters, rate-limit state.
• Tool inputs, including search text, filters, source references, and public URLs you explicitly ask to ingest. XData receives the inputs sent to its tools, not your full ChatGPT or Codex conversation.
• Ingestion requests and job status, associated with your account, to process your requests, show progress, and understand source demand.
• Security and reliability records: operation names, timestamps, status, duration, and internal account and request identifiers. Hosting and authentication providers also process connection information, such as IP addresses, to deliver and protect the service.
• Your theme preference is stored only in your browser.
• Source material: articles, transcripts, figures, source URLs, bylines, speaker names, publication dates, and related research metadata.

How content is handled

We first check for an available publisher transcript. When transcription is needed, cloud-compatible audio is sent through OpenRouter to a speech provider. Some sources are downloaded and transcribed on our hardware. Temporary downloaded audio and transcription chunks are cleaned up after processing. We retain source text and article figures, source URLs, metadata, search passages, embeddings, generated research metadata, and records supporting content transformations such as advertising removal.

Search text can be sent to an embedding provider. Search text and candidate passages can be sent to a relevance-ranking provider. Source passages can be sent to language-model providers for enrichment and quality checks. Retrieved excerpts, source references, and requested figures are returned to the connected client. Do not submit passwords, API keys, private URLs, health records, payment-card data, or government identifiers in tool inputs.

Who receives data

Render hosts the service, database, and operational logs. WorkOS handles authentication. OpenRouter routes relevant audio, text, and search inputs to the configured speech, embedding, language-model, and ranking providers. Current configurations include MAI transcription, DeepSeek enrichment, and Voyage ranking. Provider routing can use fallbacks that meet the account's privacy settings. Source publishers receive network requests when their public material is fetched. The client you connect, including ChatGPT or Codex, receives tool results under its own data policies.

XData does not train its own models on your requests. Provider processing and retention also depend on the applicable provider terms and account settings; this notice does not promise that every provider has zero retention.

Retention and access

Account records, access requests, ingestion history, and stored source material currently have no automatic expiry. They remain until removed by an operator, including in response to a valid deletion or source-removal request. Rate-limit counters reset as their rolling window expires. Operational logs in Render expire after 7 to 30 days depending on the workspace plan. Provider-side records and backup copies follow the respective provider's retention and deletion processes.

Contact Arthur Orts through the support page to request access, correction, account deletion, or source removal, or to ask about a retained record. Disconnecting the plugin stops that client's access but does not by itself delete records already stored by XData. You can request access revocation separately. Clear your browser storage to remove the local theme preference.