Legal

The ground rules for using Xlaude. Written in plain language, not lawyer-speak.

Last updated:
Starter templates. These documents are a drafted baseline suitable for pre-launch and small-scale operation. Before you take significant revenue — roughly, past your first thousand customers or a few thousand dollars in monthly revenue — have a lawyer licensed in your jurisdiction review them. Lawyers' fees for a one-time review of this kind of pack run roughly $300–$1,500 and are worth it.

Terms of Service

The agreement between you and Xlaude.

1. Agreement

By creating an account, installing the Xlaude app, or using the Xlaude website, you agree to these Terms of Service. If you do not agree, do not use Xlaude.

2. Who we are

Xlaude is an AI chat and coding assistant operated by its founder, based in Qatar. "Xlaude", "we", "us", and "our" refer to the service and its operator. "You" means the person using the service.

3. Who can use Xlaude

  • You must be at least 13 years old to use the Free tier. Users under 18 need a parent or guardian's permission.
  • You must be at least 18 years old to subscribe to Pro or Ultra, or to use Unrestricted mode.
  • You must not be legally barred from using the service in your country of residence.
  • You are responsible for keeping your login credentials secure. We treat anyone using your account as you.

4. The service

Xlaude is a client application. It provides a chat and coding interface for AI language models that are run on your own machine or against your own API key. We do not host inference ourselves. Specifically:

  • The Free tier runs models in your browser using WebGPU (the Spark model family). Nothing leaves your device.
  • Pro — $15 one-time unlocks the Code Tab with filesystem access, cross-device chat sync, the ability to connect to a locally-installed Ollama runtime (on desktop) or to bring your own API key from a third-party inference provider such as OpenRouter, Groq, or Google AI Studio (on mobile). Lifetime access, no recurring fee.
  • Ultra — $20 one-time adds our Local Agent for shell-command execution, multi-folder project support, git integration, and priority access to new features. Lifetime access, no recurring fee.

Pro and Ultra are one-time purchases. You pay once and the entitlement is tied to your account forever. There is no subscription, no auto-renewal, no "lifetime access" expiring. We may launch a separate optional recurring service in the future for people who want hosted inference without BYO-key; that would be its own purchase and does not affect your one-time Pro or Ultra entitlement.

Because inference happens either on your own machine (Ollama / WebGPU) or against your own API account (BYO key), your prompts and model responses never pass through our servers. We cannot read them even if we wanted to.

The model names Spark, Spark Rogue, Ember, Ember Code, Pharos, and Pharos Rogue are Xlaude's naming for recommended underlying open-weight models (Llama, Qwen, DeepSeek, Hermes, Phi, and others). You pick which model to run through our settings; the underlying model identities may change over time as better open-weight models become available, but we will not change what each tier can access without notice.

5. What you can and cannot do — including in Unrestricted mode

You may use Xlaude for any lawful purpose, including creative writing, coding, research, roleplay, and conversation. Our stance is deliberately permissive: fiction is fiction, adults are adults, security research is research, and we are not your chaperone.

Unrestricted mode is a user-selectable system-prompt preset that strips the reflexive refusal patterns some underlying models have been trained with. It does not grant unlimited license. Three floor lines apply in every mode, Unrestricted included — they are baked into the system prompt itself and reinforced here contractually:

  1. No sexual content involving anyone under 18, fictional or otherwise. This line does not bend for framing, "aging up," claimed fictional context, roleplay setup, or any other wrapper. One line, same answer every time, at every bearing.
  2. No actionable targeting of specific real, named people or specific real infrastructure for live attack. Red-team architecture, security research, offensive-security craft, fiction, and academic discussion of attack techniques all remain open. The distinction is between craft and a specific real victim or target: craft is fine, a named target is not.
  3. No actionable synthesis routes for weapons of mass casualty — biological agents, chemical warfare agents, nuclear or radiological weapons at scale. Academic context, historical discussion, policy analysis, fiction, and ordinary security study are open. Step-by-step production or deployment of mass-harm weapons is not.

In addition to these three floors, you may not use Xlaude to:

  • Impersonate another person for the purpose of fraud, deception, or identity theft.
  • Spam, phish, or distribute malicious code targeting real victims (as distinct from writing offensive-security code for research, teaching, or your own authorized testing).
  • Attempt to extract, replicate, or disrupt the service's internal infrastructure beyond what is openly documented.
  • Resell access to Xlaude or redistribute paid-tier entitlements. One purchase, one user.

By using Xlaude, you confirm that you are at least 18 years old (if using Pro, Ultra, or Unrestricted mode), and you accept responsibility for what you produce and what you do with it. The three floor lines above are the author of the service's choice as a matter of policy, not solely of law; they apply even where local law would allow the activity.

6. Pricing and billing

  • Pro ($15) and Ultra ($20) are one-time purchases. One payment, lifetime access to that tier's features.
  • Prices are in US dollars. Local taxes and fees are added at checkout by our payment processor (Lemon Squeezy, acting as Merchant of Record).
  • We may change list prices for new purchases at any time; your existing purchased tier is unaffected.
  • Upgrading from Pro to Ultra later is possible — you pay the difference, not the full Ultra price.

6a. Closed beta access

Before the public launch, Xlaude is available by invitation through access codes. Codes are issued at our discretion and are non-transferable. Beta access is a free preview and does not include a paid tier entitlement unless we say so in writing. We may revoke a code if it is shared publicly or used in bad faith, and we may change beta features without notice.

7. Service availability

We aim for 99% uptime but do not guarantee it. Scheduled maintenance, third-party API outages, and events outside our control can interrupt service. Credits are considered on request for outages exceeding 24 consecutive hours (see Refund Policy).

8. Changes to the service and these terms

We may change the service, add features, remove features, or update these terms. For material changes to these terms we will notify you by email at least 14 days before they take effect. Continued use after a change constitutes acceptance.

9. Termination

You can delete your account at any time from the account page. We may suspend or terminate accounts that violate section 5, with reasonable notice except in cases of ongoing harm. On termination, your access ends and we delete your stored data within 30 days (see Privacy Policy for details).

10. Liability

Xlaude is provided "as is". To the extent allowed by law, our total liability for any claim arising from your use of the service is capped at the amount you paid us in the 12 months before the claim, or $100 if you have paid us nothing. We are not liable for indirect, consequential, or incidental damages.

11. Governing law

These terms are governed by the laws of the State of Qatar. Disputes that can't be resolved through our complaints process (see below) will be addressed in the courts of Doha, Qatar, unless local consumer protection law gives you a different forum you are entitled to.

Refund Policy

When you get your money back.

First subscription — 7-day no-questions refund

If you are unhappy with Xlaude Pro or Ultra within 7 days of your first subscription payment, email support@xlaude.xyz with the subject line "Refund" and we will refund you in full. No reason required, no interview. We cancel your subscription at the same time.

Subsequent renewals — no automatic refunds

After the first 7 days, subscription renewals are non-refundable. You can cancel at any time to prevent future renewals; your access continues until the end of the period you have already paid for.

Service outages

If Xlaude is substantially unavailable for more than 24 consecutive hours in a billing period, email us and we will issue a pro-rata credit toward your next renewal.

Accidental double-charges and billing errors

Refunded in full, always, as soon as we see the ticket. Email support@xlaude.xyz with the charge ID.

How refunds reach you

Refunds are issued through the same payment method you used. Depending on your bank, they take 3–10 business days to appear.

Chargebacks

If you initiate a chargeback with your card issuer before contacting us, we may suspend your account while the dispute is resolved. Please email us first — we will almost always resolve it faster.

Privacy Policy

What we collect, where it goes, how to delete it.

Our stance

Your conversations are yours, and the architecture guarantees it: your prompts and model responses never pass through Xlaude's servers. On the Free tier, inference runs in your browser's WebGPU. On Pro desktop, it runs against your locally-installed Ollama. On Pro mobile, it goes directly from your browser to the inference provider whose API key you supplied, using TLS. We don't proxy any of it.

What we collect

DataWhyWhere
Email addressLogin and account recoverySupabase (EU region), encrypted at rest
Subscription statusTo know which tier you're onOur database + Lemon Squeezy
Chat history (Pro/Ultra, opt-in sync only)Cross-device syncSupabase, encrypted at rest; opt-in and client-side encrypted with your key where possible
Your API keys (if you supply them for mobile BYO-key mode)So the app can call the inference provider on your behalfStored in your browser's local storage only — never transmitted to our servers
Account settings (preset, theme, model preference)So the app opens the way you left itSupabase if sync is on, otherwise local storage only

What we never see

  • Your prompts.
  • Model responses to you.
  • The content of files you open in the Code Tab.
  • Any command the Local Agent (Ultra) runs on your machine.
  • Your API keys, which never leave your browser.

What we do not collect at all

  • We do not use advertising trackers, Google Analytics, Facebook Pixel, or similar.
  • We do not sell your data. We do not share your data with any party except as needed to run the service (payment processor, our hosting infrastructure for the frontend).
  • We do not have access to your conversations by design.

Inference providers (BYO-key mobile)

When you supply your own API key on mobile, your prompts travel directly from your browser to the provider you chose. That provider's privacy policy governs that traffic. The providers we support and recommend because of their privacy commitments are:

  • OpenRouter, Inc. — openrouter.ai/privacy
  • Groq, Inc. — groq.com/privacy
  • Google AI Studio — ai.google.dev/terms

You are the customer of that provider; we are not in the middle. We recommend reading your chosen provider's data-retention policy and selecting one that does not train on API traffic.

Ollama (desktop)

Ollama is a separate open-source project (ollama.com) that you install and run locally. It is not operated by Xlaude. All inference happens on your own hardware. Nothing leaves your machine. Our website links to Ollama's installer; we do not host or modify it.

Cookies

We use strictly necessary cookies to keep you signed in. No analytics or advertising cookies.

Your rights

Regardless of where you live, you can:

  • Access all data we hold about you — email privacy@xlaude.xyz.
  • Correct any data that is wrong.
  • Export your data as a JSON file at any time from the account page.
  • Delete your account and all associated data — the account page has a one-click option that removes everything within 30 days.
  • Withdraw consent for chat-sync at any time (it's a toggle in settings).

Children

Xlaude is not intended for children under 13. We do not knowingly collect data from children under 13. If we learn we have, we delete it immediately.

Data retention

  • Account data: kept while your account is active, deleted within 30 days of account deletion.
  • Chat history (if sync is on): kept until you delete it or delete your account.
  • Payment records: kept 7 years as required by tax law, by our payment processor.

International transfer

Your data may be processed in the EU, US, and other locations where our providers operate. We rely on standard contractual clauses for transfers out of the EU.

Breach notification

If we suffer a data breach that affects your personal data, we will notify you by email within 72 hours of discovery, and we will tell you plainly what happened and what we are doing about it.

Security

What we do to protect your account.

  • Transit encryption: all traffic between your device and Xlaude is TLS 1.3.
  • At-rest encryption: all data stored in our database is encrypted at rest by our database provider.
  • Authentication: we use industry-standard password hashing (bcrypt). We support "sign in with" providers (Google, GitHub) so you can skip passwords entirely.
  • Payment data: we never see your card. All card data is handled by our payment processor (Lemon Squeezy), who is PCI-DSS compliant.
  • Infrastructure: hosted on Cloudflare's network with DDoS protection, bot filtering, and WAF rules.
  • Secret rotation: API keys and inference-provider tokens are rotated at least every 90 days.
  • Minimum data: we keep the smallest amount of your data that lets us run the service.

Account security — your side

  • Use a unique password or a "sign in with" provider.
  • Enable two-factor authentication from the account page.
  • If you suspect your account is compromised, email security@xlaude.xyz immediately. We can lock your account within minutes.

Reporting a vulnerability

If you find a security issue, email security@xlaude.xyz with a reproduction. We respond within 48 hours. We do not currently pay bug bounties but we will credit researchers who want public credit.

Local agent (Ultra tier)

Our optional local agent (which lets Xlaude Ultra run shell commands and edit files) listens only on 127.0.0.1 (your machine's loopback interface) and authenticates every command with a per-user token stored in your OS keychain. It is open source and auditable. You can kill it with Ctrl-C at any time.

User Control

What you can turn on, off, or wipe clean.

Settings you own

  • Chat sync. On by default (Pro/Ultra). Turn it off and chats stay on the device only — we store nothing of yours server-side except your account record.
  • Unrestricted mode. Off by default. You can enable it in Settings → Behavior. It changes the system prompt only; the underlying model is still the one you picked.
  • Model choice. You pick which model each request uses.
  • Temperature, top-p, max tokens. All exposed in Settings.
  • Memory. Xlaude has no persistent memory between chats unless you explicitly save context to a Project (coming in a later release). Each chat is a fresh slate.
  • Code tab filesystem access. Off until you grant it, scoped to one folder at a time, revocable per session or permanently.
  • Shell commands (Ultra). Three modes: Ask (default, approve each command), Trust session, Trust folder. Never a global trust.

Data you can take with you

  • Export a single chat as Markdown — from the chat view.
  • Export all chats as JSON — from the account page.
  • Export account data (profile, settings, usage history) — from the account page.

The nuclear option

The account page has a "Delete everything" button. One click and a 24-hour cool-off, then your account, chats, settings, and all associated records are removed. Payment records are kept for 7 years as required by tax law and reside with our payment processor.

Honest Claims & AI Disclaimers

What Xlaude actually is, and what it isn't.

What Xlaude is

Xlaude is a chat interface and coding assistant powered by large language models (LLMs). LLMs are statistical text predictors. They are useful for a wide range of tasks — writing, coding, brainstorming, explaining, searching, planning — but they do not know things in the way a person does, and they can be confidently wrong.

What LLMs do

  • Produce fluent, plausible text in response to a prompt.
  • Draw on patterns learned from training data up to the model's cutoff date.
  • Follow instructions and formats remarkably well, most of the time.

What LLMs do not do, and never do

  • They do not verify facts. They can and do produce plausible-sounding falsehoods ("hallucinations"). Treat factual output as a draft to check, not a finished answer.
  • They do not read the live internet by default. If a model answers a question about current events without a search tool, it is drawing on stale training data.
  • They do not give professional advice. Xlaude is not a lawyer, doctor, accountant, licensed therapist, or financial advisor. Information produced by Xlaude is not legal, medical, financial, mental-health, or tax advice. For decisions that matter, consult a licensed professional.
  • They are not perfectly consistent. The same prompt can produce different answers at different times.

Code

Code generated by Xlaude is a draft. Review it, test it, and understand it before running it, especially:

  • In production systems.
  • Against databases that contain data you cannot afford to lose.
  • Where the code touches credentials, keys, or billing.
  • Where the code is destructive (delete, overwrite, deploy, drop).

The Ultra tier's local agent asks for explicit approval before running destructive commands. Approvals are irreversible from our side — if you approve a command, we run it.

Unrestricted mode

Unrestricted mode strips the refusal reflexes some underlying models have been trained with. It does not make the model smarter or more accurate. It does not grant it new abilities. It makes it more likely to answer a request fully rather than hedge or decline. You are responsible for what you do with the output.

Our honest claims

  • We say "no API keys required". That is true: you do not supply an API key to use Xlaude. We supply the keys to the inference providers internally. We never ask you to.
  • We say "runs in your browser" of the Free tier. That is literally true: models run on your GPU via WebGPU; no inference request leaves your machine.
  • We say "your data is yours". That is true for anything you can access from the account page.
  • We say "no training on your data". That is true: we do not train models on your prompts or responses, and we route through providers that make the same commitment.

Where any of these claims become inaccurate — if a feature changes, a provider policy shifts — we will update this page and tell affected users by email.

User Content

Who owns what you type, and what we are allowed to do with it.

Your content is your content

You retain ownership of everything you type into Xlaude ("your prompts") and everything the AI generates in response to you ("your outputs"). Together these are "your content".

License to run the service

To make Xlaude work, you grant us a limited, non-exclusive, worldwide license to process your content for the sole purposes of:

  • Delivering your prompt to the AI model and returning the response to you.
  • Storing your chat history for cross-device sync (only if you have sync enabled).
  • Operating the service — basic things like serving your account page, counting tokens for your usage meter, troubleshooting an error you report.

This license ends when you delete your content or your account.

What we don't do with it

  • We don't use your content to train models — ours or anyone else's.
  • We don't sell, rent, or share it with advertisers, data brokers, or anyone outside the operational chain described above.
  • We don't read it for any human review except in two cases: (a) you report a bug or ask for support and give us permission to look, or (b) we have a legal obligation (court order).

Your responsibility for content

You are responsible for what you ask Xlaude to produce, what you share with it, and what you do with the output. Do not upload content you don't have the right to share. Do not use the service to harass or harm real people. See the Terms of Service for the complete list of prohibited uses.

If you share Xlaude content publicly

If you post AI-generated text or code publicly (blog, social media, product), consider disclosing that AI tools were involved — not a legal requirement from us, but a good practice.

Complaints & Disputes

How to tell us something went wrong, and what happens next.

How to complain

Email complaints@xlaude.xyz. Please include:

  • What happened.
  • When it happened (date and approximate time).
  • Your account email.
  • What outcome would resolve this for you.

Our commitment

StageWhat happensWithin
AcknowledgmentWe confirm we received your complaint24 hours
Substantive replyWe investigate and reply with findings and proposed resolution7 days
Final decisionIf a reply doesn't resolve it, we escalate internally and give you a final decision30 days

If we can't agree

If our final decision doesn't satisfy you, you can:

  • Open a chargeback with your card issuer or payment provider (we don't block this, though please talk to us first — we almost always resolve it faster).
  • Pursue the matter in the courts of your country of residence under consumer protection law, if that applies to you.
  • Pursue the matter in the courts of Doha, Qatar, under our Terms of Service (section 11).

Reporting abuse

If you encounter content on Xlaude that violates our Terms (section 5) or that you believe is illegal, email abuse@xlaude.xyz. We take abuse reports seriously and respond within 24 hours.

Contact

Every address on this page, in one place.

General support
support@xlaude.xyz
Privacy and data requests
privacy@xlaude.xyz
Copyright claims
copyright@xlaude.xyz
Security vulnerabilities
security@xlaude.xyz
Complaints
complaints@xlaude.xyz
Abuse reports
abuse@xlaude.xyz