xChk Privacy Policy

Effective: October 27, 2026

xChk provides an authorization and evidence layer for AI agents: it lets a person authorize, hold, or refuse an agent's consequential actions and keeps a tamper-evident record of what was decided. It also runs identity checks that organisations ask people to complete. This policy explains what we collect, why, who else handles it, and your choices. It covers the xChk websites (xchk.io, in.xchk.io, xchk.me), the xChk phone app, and the xChk agent guardrails. Questions: support@xchk.io.

Information we collect

• Account information you provide: name, email, and, if you enable SMS approvals, your mobile number. If you sign in with Google, Microsoft, LinkedIn, Facebook or GitHub, we receive your name, email and account identifier from that provider. If you add a passkey, we store only its public key; the private key stays on your device.
• Authorization records: the actions your agents request (for example the command, tool or file involved), the decisions you make, how each action ended, and the cryptographic evidence of those decisions.
• Agent and host records, when you install the xChk guardrails: the agent's licence, the computer and agent software it runs on, a list of the AI agent tools found on that computer, and periodic signals that the guardrails are still running. If the owner of an agent's licence turns it on, the first 400 characters of each request typed to that agent are kept on the licence's record.
• Identity checks (live verification, helpdesk calls and interviews), when an organisation asks you to complete one and you open its link:
  • photos from your camera during the check;
  • your device's location, if you allow it, and a place name looked up from it;
  • your network address, and the location and provider of that network;
  • device and browser characteristics: device type, operating system and browser, screen, a device fingerprint, languages, time zone, and number, date and currency formats;
  • a liveness result, and the phone number the check was sent to;
  • in a voice interview, your voice and a transcript of it.
• Optional verifications you choose to start:
  • an identity-document check, run by our provider Didit; we keep the result, the document type and the name it returns;
  • a payment-card check, a $0 verification through Stripe in which nothing is charged and the card is not saved. We keep the card network, issuing country, last four digits, the bank's authentication result, and whether the name matches your account; never the card number.
• Payments: if you subscribe, Stripe processes the payment. We keep your subscription status, not your card details.
• Site analytics on xchk.io: we use Google Analytics to count visits and see which pages are read. It sets cookies and sends your IP address and browser details to Google; Google's handling is described at policies.google.com/privacy. The registries (in.xchk.io, xchk.me) and the phone app carry no analytics.
• Delivery and security signals: message delivery receipts, sign-in times and network addresses, used to send and confirm notifications and to secure your account.

How we use information

• To operate the service: route approval requests to you, record your decisions, and keep the tamper-evident record.
• To notify you, over the channels you enable, when an agent action needs your attention.
• To run identity checks: a check is compared with your own earlier checks so that an unusual change (a new device, place, network or language) can be noticed, and the result is shown to the organisation that asked for it. An automated AI model may summarise a check's risk signals for that organisation's reviewer; it does not make the decision.
• When you connect xChk to another app, to share with it only what you approve on the consent screen.
• To secure accounts, prevent abuse and fraud, and meet legal and audit obligations.

We do not use your information for advertising, and we do not sell it.

The xChk phone app

The xChk app for iPhone and Android lets you sign in to an xChk registry, see your agents, and receive approval requests as notifications instead of text messages. It collects your sign-in (email and password, checked by Google Firebase Authentication, and the account identifier that results) and a notification token for your phone, issued by Google Firebase Cloud Messaging and stored with your account so requests can reach that phone. Signing out of the app removes that phone's token; your other devices keep receiving requests.

Notifications show only a generic line on your lock screen ("An agent needs your decision"); the details appear after you open the request. The app has no advertising, analytics or tracking, and does not access your location, camera, photos or contacts. Approvals open the same secure page as our web and text-message links, where the rest of this policy applies.

How we share information

With the organisation that asked you to complete an identity check, which sees that check's result and evidence. With service providers that help us operate, under terms that limit their use to providing the service:

• Google Firebase: sign-in and app notifications.
• Backblaze B2: storage of check photos and files. Bunny CDN: delivery of our web pages.
• Mapbox and OpenStreetMap (Nominatim): place names from a location.
• ipapi.is: the location and provider of a network address.
• OpenRouter, and the AI model provider it routes to: automated summaries of check signals.
• Deepgram or AssemblyAI: transcription in voice interviews.
• Didit: identity-document checks. Stripe: payments and card checks.
• Telnyx and VoIP.ms: text messages. WhatsApp (Meta), if you choose WhatsApp delivery. Our email provider: email.

To make records tamper-evident, we publish cryptographic fingerprints of them to public timestamping services (OpenTimestamps and the Ravencoin blockchain); a fingerprint reveals nothing about the content. We also share information when required by law, or at your direction. We do not sell personal information, and, as stated above, we do not share SMS opt-in data for third-party marketing. Some providers process data outside your country, including in the United States.

Cookies and local storage

The registries use a sign-in cookie that lasts up to 24 hours, and your browser's local storage for settings and to keep you signed in. xchk.io also sets Google Analytics cookies, described above. We use no advertising cookies and no other third-party trackers.

Retention

Authorization records are retained as tamper-evident evidence for as long as your account is active and as needed for audit, legal, and dispute-resolution purposes. Identity-check records, including their photos, are kept with the check for the organisation that asked for it and as your own history for later checks, on the same terms. Account contact details are retained while your account is active. A phone's notification token is removed when you sign out of the app or the token stops working. You may request deletion of personal data, subject to records we must retain by law.

Your choices

• Opt out of SMS any time by replying STOP, or by removing your mobile number in settings.
• Turn off app notifications in your phone's settings, or sign out of the app.
• Refuse camera or location access; a check may then be weaker or unable to finish.
• Request access to, correction of, or deletion of your personal data via support@xchk.io.

Children

xChk is not intended for anyone under 18, and we do not knowingly collect their information.

Changes

We may update this policy; material changes will be posted here with a new effective date.

xChk · Trust · Verify · Proof · Contact support@xchk.io · See also our Terms of Service.