Xeus app

Privacy Policy

Effective 28 September 2026

This policy explains how the Xeus mobile app and its web version at check.xeus.io (together, "the app") handle information. The app is published by XTN Pty Ltd (ABN 46 668 186 463), trading as XEUS, in Australia ("we", "us"). We handle personal information in line with the Australian Privacy Principles.

In short: you can read the news feed without an account. We don't show ads, we don't use third-party advertising or analytics trackers in the app, and we don't sell your information. We do keep a few first-party counts against your random reader ID so we can tell which channels bring people to the app.

What we collect and why

Information	Why	Where it's kept
A random reader ID the app creates the first time it runs. It isn't linked to your name or email.	Applying the daily Ask Xeus allowance and fair-use limits, keeping your Ask Xeus conversations private to you, and linking a Xeus Pro subscription to your device.	On your device and on our servers.
Your personalisation choices (tech stack, regions, industries).	Tailoring your feed, alerts, briefings and answers.	On your device. They're sent with requests so the AI can tailor its output, and stored with your Ask Xeus conversations.
Questions you ask Ask Xeus and the answers it gives.	Showing your conversation history.	On our servers, linked to your reader ID.
Saved stories, read status and theme.	Your reading list and display settings.	On your device only. If you sign in to the Xeus customer portal, read status also syncs to your customer account.
Details you send through "Talk to Xeus" (name, work email, company, role, interest, message).	Responding to your enquiry.	On our servers, and emailed to our team.
Customer portal sign-in (work email and password).	Giving existing Xeus customers access to their SOC and Exposure dashboards. Passwords are stored only as a secure hash.	On our servers.
Where you installed or opened the app from: the campaign tags (such as utm_source) in the Google Play install referrer or the web link, and whether you've read three stories in your first week.	Knowing which channels bring people to the app.	On our servers, linked to your reader ID.
Exposure Match: a work email you choose to verify, the company domain it belongs to, and whether you agreed to be contacted.	Checking which technologies public internet scanners already see on that domain and matching them to exploited-vulnerability stories. If you agree, a weekly email when new stories match, and a reply from our team. If you tap "Validate it free", your details go to our team as an enquiry.	On our servers, linked to your reader ID. If you agreed to be contacted, your email and that choice are also kept in our contact preferences (see Supabase below).
Your IP address.	Preventing abuse through rate limits, and keeping the service secure.	Held briefly for rate limiting, and in server logs.

The app doesn't use your microphone, camera, contacts, photos or location.

Purchases

Xeus Pro is sold through Google Play or the App Store, and they process your payment. We never receive your card details. RevenueCat, our subscription provider, receives your purchase status and your reader ID so that Xeus Pro works on your device and can be restored.

AI features and service providers

We use these providers to run the app. Each processes information only to provide its service to us:

OpenAI generates briefings, Ask Xeus answers and spoken narration, and turns your Ask Xeus questions into search vectors so answers can cite related stories. It receives article text and summaries, your personalisation choices and your questions. It does not receive your name or contact details.
Exa finds news from trusted security publishers and summarises the full public text of each article. No personal information is sent.
RevenueCat manages subscriptions, as described above.
Amazon Web Services (Sydney region) hosts our servers, and Cloudflare protects and delivers our network traffic.
Resend sends verification codes and, if you agreed, the weekly Exposure Match email, and delivers enquiries to our team.
Shodan answers our questions about which technologies public internet scanners have seen on a company domain. It receives the domain only, never your email or name. We only show you a summary: never host names, IP addresses or ports.
Cloudflare DNS answers public DNS lookups for the domain (mail and verification records).
Supabase (Sydney region) holds our news store, our enquiry inbox, the exposure summaries for company domains, and your contact preferences (the work email you verified, whether you agreed to be contacted, and any unsubscribe). Contact preferences are shared with other XEUS services, so an unsubscribe anywhere stops our emails everywhere.

Some of these providers process information outside Australia, including in the United States.

Retention and your choices

Information on your device is removed when you uninstall the app. Ask Xeus conversations and enquiries stay on our servers until you ask us to delete them. The exposure summary for a domain is refreshed from public sources and kept for up to 7 days. If you verify a work email but don't agree to be contacted, we replace the email with a one-way hash after 12 months and keep only the domain. You can remove your verified work email at any time in the app (Exposure Match, "Remove my work email"), and every weekly email has an unsubscribe link. To request access to, correction of, or deletion of your information, email [email protected] and we'll respond within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Delete your data or account

To have your information deleted, email [email protected] with the subject "Delete my data" from the email address involved. This covers Ask Xeus conversations, enquiries, a verified work email and your contact preferences, and an XEUS account at app.xeus.io if you created one from the app. We confirm by email and delete within 30 days, except records we must keep by law, such as purchase records held by Google Play.

You can also do some of this yourself: uninstalling the app removes everything stored on your device, "Remove my work email" in Exposure Match deletes your verified work email, and every weekly email has an unsubscribe link.

Children

The app is built for security professionals and isn't directed at children under 16.

Security

Traffic to our servers is encrypted in transit. Access to our systems is restricted, and secrets such as sign-in tokens are kept in secure storage on your device.

Changes

If we change this policy, we'll update the date above. For significant changes, we'll also tell you in the app.

Contact

XTN Pty Ltd, trading as XEUS. Email: [email protected]

This policy covers the Xeus app. The xeus.io website uses Google Tag Manager and Google Analytics to measure visits.