Privacy Policy

Last updated: May 8, 2026

1. Information We Collect

We collect the following information:

• Account information: email address, username, and display name
• Authentication data: password (hashed), OAuth tokens from Google Sign-In
• Chat data: messages you send and receive within the App
• Device information: device type, operating system, and push notification tokens
• Usage data: app interactions, feature usage, and analytics

2. How We Use Your Information

We use your information to:

• Provide and improve the App experience
• Personalize AI character interactions
• Send transactional emails (verification, password reset)
• Process payments and manage subscriptions
• Ensure safety and enforce our Terms of Service

3. Data Storage and Security

Your data is stored on secure servers hosted by Railway (cloud infrastructure). Passwords are hashed using bcrypt. We use HTTPS for all data transmission and JWT tokens for authentication.

4. Third-Party Services

We use the following third-party services:

• Google Sign-In: for OAuth authentication
• Google Calendar API (read-only): see Section 5 below for details on how Xomi uses calendar data
• Google Play / Apple App Store: for payment processing
• Firebase Cloud Messaging: for push notifications
• Resend: for transactional emails
• Cloudflare R2: for file storage (avatars, generated PDFs)
• Sentry: for error monitoring

5. Google Calendar Integration (optional)

If you connect your Google Calendar to Xomi (via the "Lịch phong thủy" feature with Thầy Tâm), Xomi requests the https://www.googleapis.com/auth/calendar.readonly OAuth scope. This scope grants Xomi read-only access to your calendars and events.

What Xomi reads

• Event titles, start/end times, and locations from your primary calendar
• Calendar metadata required to display events in the app

What Xomi does with this data

• Annotates each event with Vietnamese feng shui markers (Hoàng đạo / Hắc đạo days, hợp tuổi indicators) so you can see at a glance which days are auspicious for important events.
• Displays the annotated 30-day event list inside the Xomi app while you are actively viewing the feature.

What Xomi does NOT do

• Xomi never modifies, creates, or deletes events on your calendar.
• Xomi never shares your calendar data with third parties or other users.
• Xomi never uses calendar data for advertising or training AI models.
• Xomi never stores your raw event data on our servers — annotations are computed on demand and discarded after each request.

Token storage

OAuth refresh tokens are stored encrypted at rest using AES-256-GCM with a server-side encryption key. Tokens are bound to your user account and can be revoked at any time.

How to disconnect

• From inside Xomi: Lịch phong thủy screen → "Ngắt kết nối Google Calendar" — immediately revokes access and removes the encrypted token from our database.
• From Google: myaccount.google.com/permissions → find "Xomi" → Remove Access. This revokes the OAuth grant on Google's side; Xomi will no longer be able to read your calendar even if our copy of the refresh token survives momentarily.

Xomi's use of information received from Google APIs adheres to Google API Services User Data Policy, including the Limited Use requirements.

6. AI and Chat Data

Your chat messages are processed by AI models to generate responses. We may store conversation history to provide continuity in your interactions. AI-generated character memories are stored to personalize your experience.

7. Data Retention

We retain your data for as long as your account is active. When you delete your account, all associated data (messages, conversations, characters, memories) is permanently deleted.

8. Your Rights

You have the right to:

• Access your personal data through the App
• Update your account information
• Delete your account and all associated data
• Export your data upon request

9. Children's Privacy

The App is not intended for children under 13. We do not knowingly collect information from children under 13. If we discover such data, we will delete it promptly.

10. Cookies and Local Storage

The mobile App uses secure local storage for authentication tokens. The admin dashboard uses HTTP-only cookies for session management.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes through the App or email.

12. Contact

For privacy-related questions, contact us at support@xomi.app.