Xeus app and xeus.io

Privacy Policy

Effective 28 September 2026. Updated 5 October 2026 to cover the xeus.io website, and 15 October 2026 for work-account sign-in.

This policy explains how the Xeus mobile app and its web version at check.xeus.io (together, "the app") handle information. The app is published by XTN Pty Ltd (ABN 46 668 186 463), trading as XEUS, in Australia ("we", "us"). We handle personal information in line with the Australian Privacy Principles. The forms on the xeus.io website are covered in The xeus.io website below.

In short: the app asks you to sign in with a work account; the web version at check.xeus.io doesn't. We don't show ads, we don't use third-party advertising or analytics trackers in the app, and we don't sell your information. We do keep a few first-party counts so we can tell which channels bring people to the app.

What we collect and why

Information	Why	Where it's kept
Your work account (app only): your name, work email and company domain, from your Google or Microsoft sign-in or the work email you register. Google and Microsoft confirm who you are; we never receive your Google or Microsoft password. If you register a work email, your password is stored only as a secure hash.	Running your account; applying the daily Ask Xeus allowance (per person and per company) and fair-use limits; keeping your Ask Xeus conversations private to you; linking Xeus Pro to your account; showing Exposure Match for your company's domain; and letting our team see which companies use the app. We only send you marketing email if you switch on the weekly exposure email.	On our servers and with Supabase, our sign-in provider (the same account system as app.xeus.io).
A random reader ID, on the web version at check.xeus.io only. It isn't linked to your name or email.	Applying fair-use limits on the web version.	In your browser and on our servers.
Your personalisation choices (tech stack, regions, industries).	Tailoring your feed, alerts, briefings and answers.	On your device. They're sent with requests so the AI can tailor its output, and stored with your Ask Xeus conversations.
Questions you ask Ask Xeus and the answers it gives.	Showing your conversation history.	On our servers, linked to your account (or reader ID on the web).
Saved stories, read status and theme.	Your reading list and display settings.	Saved stories and theme stay on your device. Read status also syncs to your account, so it follows you to a new phone.
Details you send through "Talk to Xeus" (name, work email, company, role, interest, message).	Responding to your enquiry.	On our servers, and emailed to our team.
Where you installed or opened the app from: the campaign tags (such as utm_source) in the Google Play install referrer or the web link, and whether you've read three stories in your first week.	Knowing which channels bring people to the app.	On our servers, linked to your account (or reader ID on the web).
Exposure Match: in the app, the company domain of your work account and whether you switched on the weekly email (it starts off); on the web, a work email you choose to verify, the company domain it belongs to, and whether you agreed to be contacted.	Checking which technologies public internet scanners already see on that domain and matching them to exploited-vulnerability stories. If you agree, a weekly email when new stories match, and a reply from our team. If you tap "Validate it free", your details go to our team as an enquiry.	On our servers, linked to your account (or reader ID on the web). If you agreed to be contacted, your email and that choice are also kept in our contact preferences (see Supabase below).
Your IP address.	Preventing abuse through rate limits, and keeping the service secure.	Held briefly for rate limiting, and in server logs.

The app doesn't use your microphone, camera, contacts, photos or location.

Purchases

Xeus Pro is sold through Google Play or the App Store, and they process your payment. We never receive your card details. RevenueCat, our subscription provider, receives your purchase status and your account ID so that Xeus Pro works on any phone you sign in on and can be restored.

AI features and service providers

We use these providers to run the app. Each processes information only to provide its service to us:

OpenAI generates briefings, Ask Xeus answers and spoken narration, and turns your Ask Xeus questions into search vectors so answers can cite related stories. It receives article text and summaries, your personalisation choices and your questions. It does not receive your name or contact details.
Exa finds news from trusted security publishers and summarises the full public text of each article. No personal information is sent.
RevenueCat manages subscriptions, as described above.
Amazon Web Services (Sydney region) hosts our servers, and Cloudflare protects and delivers our network traffic.
Resend sends verification codes and, if you agreed, the weekly Exposure Match email, and delivers enquiries to our team.
Shodan answers our questions about which technologies public internet scanners have seen on a company domain. It receives the domain only, never your email or name. We only show you a summary: never host names, IP addresses or ports.
Cloudflare DNS answers public DNS lookups for the domain (mail and verification records).
Supabase (Sydney region) holds our news store, our enquiry inbox, the exposure summaries for company domains, and your contact preferences (the work email you verified, whether you agreed to be contacted, and any unsubscribe). Contact preferences are shared with other XEUS services, so an unsubscribe anywhere stops our emails everywhere.

Some of these providers process information outside Australia, including in the United States.

Retention and your choices

Information on your device is removed when you uninstall the app. Your account is kept until you delete it. Ask Xeus conversations and enquiries stay on our servers until you ask us to delete them. The exposure summary for a domain is refreshed from public sources and kept for up to 7 days. If you verify a work email but don't agree to be contacted, we replace the email with a one-way hash after 12 months and keep only the domain. You can remove your verified work email at any time in the app (Exposure Match, "Remove my work email"), and every weekly email has an unsubscribe link. To request access to, correction of, or deletion of your information, email [email protected] and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Delete your data or account

In the app, go to Settings, Account, Delete account. That deletes your Xeus account, your Ask Xeus conversations, enquiries made from the app, your Exposure Match record and your contact preferences straight away. A Xeus Pro subscription is cancelled in Google Play or the App Store, not in the app. If you also use app.xeus.io as part of a team you own, transfer or delete that team there first.

You can also have your information deleted by email: write to [email protected] with the subject "Delete my data" from the email address involved. This covers Ask Xeus conversations, enquiries, a verified work email and your contact preferences, and an XEUS account at app.xeus.io if you created one from the app. We confirm by email and delete within 30 days, except records we must keep by law, such as purchase records held by Google Play.

You can also do some of this yourself: uninstalling the app removes everything stored on your device, "Remove my work email" in Exposure Match deletes your verified work email, and every weekly email has an unsubscribe link.

The xeus.io website

When you use a form on xeus.io (the contact form, a scoping call request, the free exposure snapshot, a partner enquiry or the Exposure of the Week email), we collect what you enter: usually your name, work email, company and your answers, and for a snapshot the domain you ask us to check. We use it to respond to you, to prepare what you asked for and, if you signed up, to send the weekly email.

Form submissions are stored in our enquiry inbox (Supabase) and emailed to our team, and our reply to you, through Resend. For a snapshot we only look at information about your domain that is already public, such as DNS and certificate records and what internet scanners have already seen. Nothing is tested without a signed scope.

The website uses Google Tag Manager and Google Analytics to measure visits and completed forms, and a first-party cookie (xeus_attr, kept for 30 days) that remembers which campaign link brought you to the site, so we can tell which channels work. We keep enquiries until you ask us to delete them, every weekly email lets you unsubscribe, and the access, correction and deletion rights above apply.

Children

The app is built for security professionals and isn't directed at children under 16.

Security

Traffic to our servers is encrypted in transit. Access to our systems is restricted, and secrets such as sign-in tokens are kept in secure storage on your device.

Changes

If we change this policy, we'll update the date above. For significant changes, we'll also tell you in the app.

Contact

XTN Pty Ltd, trading as XEUS. Email: [email protected]

This policy covers the Xeus app and the xeus.io website.