Privacy Policy

This policy applies to XubaoClub (出海寻宝社). Updated October 22, 2026.

Sign-in and account information

When you sign in with Google, we receive your Google account identifier, name, email address and profile picture to create and identify your account. We request basic identity information, without access to your Gmail, Google Drive or contacts. Sessions may also record your IP address, browser information and information needed for security.

Private research

Research settings, reference terms, target markets, experience summaries, search history and results that you choose to save are stored in a Cloudflare database with access restricted by account. Search history and deduplication terms are retained for 90 days, then deleted during scheduled cleanup or workspace access. The interface currently shows the latest 10 searches. Private records are not automatically published in the public editorial reports.

“My clues” supports up to 500 saved clues and notes, excluding the built-in example. They are stored in the current browser under the relevant user, do not currently sync across devices, and are not subject to the 90-day history cleanup. Use the workspace export feature to keep a backup. Clearing browser data may remove these notes. Cloud attachment uploads are currently disabled; importing txt / md extracts experience summary text only, up to 8,000 characters.

xAI API keys and search requests

You may provide your own xAI API key. The server encrypts the stored key; normal API responses and browser storage do not expose its plaintext value. Encryption cannot eliminate every security risk. Do not place keys in notes or public content.

The server calls xAI using your key only when you deliberately start a private search. Requests include your research direction, reference terms, market, experience summary, selected sources and known terms for deduplication. Do not include sensitive information that you do not want the model provider to process. Requests are configured not to store responses with xAI; its processing remains subject to its own policies.

Providers and essential storage

• Cloudflare provides hosting, databases and related infrastructure.
• Google provides authentication when you choose Google sign-in.
• xAI processes requests when you deliberately start a private search.
• Cookies or local storage support sign-in and saved preferences. Advertising, visitor analytics and newsletter features are not currently enabled.

Retention, access and deletion

We retain information needed to provide accounts, research history and security features. You can manage available settings, keys and records in the workspace. To request access, correction or deletion of account information, contact the address below. We will verify your identity and explain any information retained for security, backups or applicable requirements. Manage browser-only manual notes in the browser where they were saved.

Updates and contact

We update this page when our practices change. For privacy questions or data requests, contact echo650429@gmail.com.