Privacy Policy

ONE LOOP PTY LTD operates XCR and is responsible for the personal information described here. Contact/postal address: Level 2/63 Foveaux St, Surry Hills NSW 2010, Australia. Privacy contact: xcrmc2@gmail.com. Verified company details are shown on this page; missing contact fields remain pending.

We process sign-in and profile details, consent versions and timestamps, authorised computer names, credential hashes, access status and last-use information. Billing records may include purchases, credit ledger entries, task costs and model usage. The checkout provider processes payment card information; our service does not receive full card numbers.

For purchases through Creem, buyer and payment data are processed under Creem’s own privacy policy: https://www.creem.io/privacy. Historical payment providers may retain legally required records. Our product privacy responsibilities remain with us.

The repository remains on your computer. Relevant instructions, selected files, patches, check output and other task context are transmitted temporarily through our service to AI APIs to carry out your request. Exclusions and secret detection help reduce accidental disclosure but cannot guarantee detection of all sensitive information.

Our server database and production logs do not retain full plugin task prompts, model replies or source files. Task records include a title derived from the first line of your request (up to 200 characters), status, usage/cost and check metadata. The title may itself contain personal information. A project hash identifies the project; an optional project label is sent only if enabled.

Local working copies, task records, configuration backups and undo information remain on your computer. Uninstalling the plugin may leave these records. Remove them separately if no longer needed, after preserving any backups you need.

Before the first AI request the workshop asks for consent. Your answers and plan are sent to AI APIs to produce a draft. The workshop endpoint does not store conversation content in the database. Browser session/local storage holds drafts for up to 24 hours; expired drafts are removed on next access and Start over clears the draft. A draft can remain through sign-in.

The service uses hashed IP-based rate limits, consent records and budget/usage reservations for abuse prevention and operation. These records are distinct from the locally stored draft.

Records from the retired web chat or BYOK interface may include conversations, uploaded files and encrypted provider keys until deleted under the applicable retention process. Removing the interface does not automatically erase historical data. Optional remote MCP functionality may process and store conversations or remote job records differently from the local coding plugin. Use only the features whose data handling you accept.

We use data to provide requested work, authenticate access, maintain account balances, prevent abuse, investigate incidents, respond to support requests and meet legal duties. Where applicable, processing relies on the contract, legal obligations, consent or legitimate interests subject to your rights. We do not sell personal information or use project content for advertising.

Relevant content is processed by the AI providers disclosed at /legal/ai-providers. Hosting, databases, storage, sign-in/email and payment service providers process data as needed for their functions. Data may be processed outside your country, including by providers’ international infrastructure. Provider policies and account settings affect retention and training; we do not promise a particular region or zero retention for every provider.

We may disclose information when legally required or to investigate abuse and protect rights. We will apply safeguards required by applicable law; this statement does not claim that any particular transfer contract or certification has already been obtained.

We use these service providers to run the service. Each processes personal information only as needed for its function:

We will update this list when providers change.

We keep account, task and operational metadata only as long as needed for the purposes above, disputes and legal duties. Financial and transaction records (purchases, credit ledger, refunds) are generally kept for 7 years as required by Australian tax and corporations law, including after account deletion. Plugin task prompts, source files and model replies are not stored on our servers.

You can revoke plugin access and request account or historical data deletion through available account controls or xcrmc2@gmail.com. Deletion from our service does not automatically delete local backups or information already held by independent AI providers. Browser drafts can be cleared with Start over or browser storage controls.

We use access controls and TLS for transport. Historical stored BYOK credentials use AES-256-GCM encryption; this is not a claim that all local files or all service data use that encryption. Sensitive credentials must be decrypted when needed for authorised API use. No security measure guarantees absolute protection. We handle incidents and any required notices (including under the Australian Notifiable Data Breaches scheme and the GDPR, where they apply) in accordance with applicable law.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Personal information is disclosed to overseas recipients as described above, mainly in the United States and Japan and in other countries where our providers and Creem operate. You may deal with us anonymously or under a pseudonym only where practicable; paid accounts need a working email address.

To access or correct your information or make a privacy complaint, contact xcrmc2@gmail.com. We aim to respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (https://www.oaic.gov.au).

If the GDPR or UK GDPR applies, ONE LOOP PTY LTD is the controller. Our legal bases are: performance of our contract with you (account, tasks, billing, support); legal obligations (financial records, responses to lawful requests); legitimate interests (security, abuse and fraud prevention, improving reliability), balanced against your rights; and consent where we ask for it (for example before the Idea workshop sends your answers to an AI provider). We do not make decisions with legal or similarly significant effects about you solely by automated means.

Transfers outside the EEA or UK rely on safeguards such as the standard contractual clauses in our providers’ data processing terms, where available. You have the rights listed below and may lodge a complaint with your local data protection supervisory authority.

Depending on applicable law, you may request access, correction, deletion, portability or restriction, object to processing, withdraw consent or complain to a competent regulator. Withdrawal does not undo lawful prior processing. Contact xcrmc2@gmail.com; we may need to verify identity and will observe applicable deadlines and exceptions.

Do not submit secrets or third-party personal information that the task does not require. You can stop using the workshop or plugin and revoke credentials. Revocation prevents future authorised use but does not reverse completed processing or usage charges.

We use essential cookies for sign-in, sessions and security and browser storage for workshop drafts and preferences. We do not use advertising or cross-site tracking cookies. Blocking essential cookies or clearing local storage may sign you out or remove a draft.

The service is for adults aged 18 and over. If you believe a child has provided personal information, contact xcrmc2@gmail.com so that we can investigate and take appropriate action.

Material privacy changes will be published with an updated effective date and notified through available channels where required. Legal/privacy inquiries: xcrmc2@gmail.com; support: xcrmc2@gmail.com; postal contact: ONE LOOP PTY LTD, Level 2/63 Foveaux St, Surry Hills NSW 2010, Australia.