Xyra
Xyra← Back

Privacy Policy

Last updated: June 20, 2026

Xyra ("we", "us", or "our") operates the platform at xyracloud.com, including Cloud Storage, Cloud Backup, Email Hosting, Website Design, Website Hosting, and Xyra Mail. This policy explains what data we collect, why we collect it, and how you can control it.

1. Information We Collect

Account information

When you register, we collect your email address and a hashed password. If you sign in via Google OAuth, we receive your Google account email address and display name. We do not receive or store your Google password.

Billing information

Payments are processed by Lemon Squeezy. We store your subscription status, plan tier, and a customer reference ID. We do not store or have access to your credit card number, bank details, or CVV. All payment data is handled by Lemon Squeezy under their own privacy policy.

Files and backup data

Files you upload to Cloud Storage and data backed up by the Xyra Backup agent are stored in your account. We store file names, sizes, MIME types, upload dates, folder structure, and the file content itself. Backup data additionally includes device identifiers, run timestamps, and error logs.

Email data

If you use Email Hosting, we store your custom domain name and forwarding rules or mailbox credentials in our database. If you use Xyra Mail to access Gmail or a third-party IMAP account, your credentials and OAuth tokens are stored in an encrypted session cookie in your browser — they are not stored on our servers.

Website data

If you use Website Design or Website Hosting, we store your site content, selected templates, custom domain configuration, and published site files.

Usage data

We collect logs of actions such as file uploads, downloads, deletions, backup runs, and login events. These logs are used for billing, storage quota enforcement, activity history, and fraud prevention. We do not sell usage data.

Cookies

We use essential session cookies to keep you signed in. We do not use advertising cookies or cross-site tracking. The Xyra Mail feature uses an encrypted webmail_accounts cookie to store your email session locally — this cookie never leaves your browser in a readable form.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the Xyra platform and all services.
  • Authenticate your identity and keep your account secure.
  • Enforce storage quotas, plan limits, and acceptable use policies.
  • Process subscription payments and issue invoices via Lemon Squeezy.
  • Send transactional emails (e.g., storage quota warnings, backup failure alerts) via Resend.
  • Respond to support requests and investigate reported issues.
  • Improve the platform through aggregated, anonymised usage analysis.
  • Comply with legal obligations where required.

We do not use your data for advertising, sell it to third parties, or use it to train AI or machine learning models.

3. Third-Party Services

We use the following third-party services to operate Xyra. Each has its own privacy policy governing their use of your data.

Supabase

Authentication, user database, and metadata storage.

https://supabase.com/privacy ↗

Amazon Web Services (AWS S3)

File storage for Cloud Storage and Cloud Backup. Files are stored in encrypted S3 buckets. Access is controlled with per-user scoped keys and presigned URLs.

https://aws.amazon.com/privacy ↗

Cloudflare

Email MX routing (for the free Email Forwarding feature). Email in transit passes through Cloudflare's routing infrastructure.

https://www.cloudflare.com/privacypolicy ↗

Google

OAuth 2.0 sign-in for Xyra Mail (Gmail access). We request read, send, and compose permissions only. We do not store Google tokens on our servers — they are kept in your browser session cookie.

https://policies.google.com/privacy ↗

Lemon Squeezy

Subscription billing and payment processing. Lemon Squeezy acts as the Merchant of Record for all transactions.

https://www.lemonsqueezy.com/privacy ↗

Resend

Transactional email delivery (quota alerts, backup notifications, system messages).

https://resend.com/privacy ↗

Vercel

Application hosting and global CDN. Server logs (IP address, request path, timestamp) are retained by Vercel for up to 30 days.

https://vercel.com/legal/privacy-policy ↗

4. Data Retention

Active accounts

Your data is retained for as long as your account is active. You may delete files, email rules, websites, and backup devices at any time.

Deleted files

Files deleted from Cloud Storage are moved to Trash and retained for 30 days before permanent deletion. Backup run data is retained according to your backup plan settings.

Account deletion

When you delete your account, we permanently delete your stored files, metadata, email configurations, website data, and personal information within 30 days. Some records (e.g., anonymised billing transactions) may be retained for up to 7 years to comply with financial regulations.

Logs

Server and activity logs are retained for up to 90 days and then automatically purged.

5. Data Security

We take the security of your data seriously. Our measures include:

  • All data transmitted between your browser and our servers is encrypted with TLS 1.2 or higher.
  • Files in AWS S3 are encrypted at rest using AES-256 server-side encryption.
  • Passwords are hashed using bcrypt; we never store plaintext passwords.
  • Email session credentials are stored only in an httpOnly, secure, SameSite=Strict browser cookie that cannot be accessed by JavaScript.
  • Access to production systems and databases is restricted to authorised personnel only.
  • File downloads use time-limited presigned URLs rather than exposing bucket credentials.

No method of transmission or storage is 100% secure. In the event of a breach affecting your data, we will notify you as required by applicable law.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Correction: Request that we correct inaccurate data.
  • Deletion: Request that we delete your account and personal data.
  • Portability: Request your data in a machine-readable format.
  • Restriction: Request that we restrict processing of your data in certain circumstances.
  • Objection: Object to our processing of your data where we rely on legitimate interests.

To exercise any of these rights, contact us at support@xyracloud.com. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.

7. Children's Privacy

Xyra is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. International Transfers

Xyra is operated from infrastructure based primarily in the United States and European Union. If you access Xyra from outside these regions, your data may be transferred to and processed in the United States or EU. We rely on standard contractual clauses and data processing agreements with our sub-processors to protect transfers.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or by a prominent notice in the Xyra dashboard. Continued use of Xyra after changes take effect constitutes your acceptance of the revised policy.

10. Contact Us

If you have questions about this Privacy Policy or your personal data, contact us at:

Xyra

Email: support@xyracloud.com

Website: xyracloud.com