Privacy Policy
1. What this covers
This policy describes what Xerion ("we", "us") stores, what stays in your browser, and who else ever sees anything when you use xerionsoft.net and the tools on it ("the Service"). It is written from the code that runs the site, so where one tool behaves differently from another, it says so. Our Terms of Service cover plans, accounts and acceptable use.
2. Information we collect
- Account details: your username, email address and a hashed password. We never store your password in plain text. The IP address you registered from is kept with your account and is used to allow one free trial per person.
- Content you save: Anything you press Save on (documents, spreadsheets, invoices, bookkeeping entries, plans, models, journals) is stored in your account so it is there next time.
- Files you upload: Files you deliberately upload are stored: your invoice logo, receipt attachments in Bookkeeping, bio-page avatars, book covers and brand-kit logos. Photo Studio projects are saved as project data when you save them. Receipt files are only ever served back to the account that uploaded them.
- Server and security logs: our web server keeps standard access logs (IP address, browser user agent, pages requested). Security events on your account, such as password changes, email address changes, two-factor changes and sign-ins through the desktop app or API, are recorded with the IP address they came from. Failed sign-in attempts are recorded with the username or email tried and the IP address so repeated attempts can be slowed down; those records are cleared after about two days.
- Tool usage records: each time a tool page is opened we record the tool's name, your user id if you are signed in, and your IP address. These records power the "Recently used" list and achievements on your dashboard, the weekly digest in your notification bell, marketplace suggestions, and the administrator analytics described in section 4.
- Support tickets and tool requests: the subject or title, category and messages you send us are stored with your account so we can reply.
- Email list: if you join the email list, we store the address, the page you signed up from, your IP address and the time you signed up (see section 6).
3. Where processing happens
| Where | What happens |
|---|---|
| In your browser only | These tools process your files on your own device and do not upload them to Xerion: PDF Merge, PDF Split & Extract, PDF Compress, PDF Organize Pages, PDF Sign, PDF to JPG / PNG, Images to PDF, Document Scanner, Audio Trimmer & Converter, Audio Recorder & Editor, Video Trimmer & Compressor, Video Recorder & Editor, Background Remover, Meme Generator, Before & After Slider, Camera Color Picker, Barcode Scanner, Guitar Tuner, Code Beautifier, JavaScript Syntax Checker, JWT Decoder. The five free tools run in your browser. Nothing you enter is sent to Xerion unless you create an account and press Save. |
| Saved to your account when you press Save | Anything you press Save on (documents, spreadsheets, invoices, bookkeeping entries, plans, models, journals) is stored in your account so it is there next time. Nothing is saved until you choose to save it. |
| Uploaded files | Files you deliberately upload are stored: your invoice logo, receipt attachments in Bookkeeping, bio-page avatars, book covers and brand-kit logos. Photo Studio projects are saved as project data when you save them. They are stored on our hosting provider's server alongside our database. |
| Sent to a third party | Stripe receives your payment details when you buy a plan (section 5). Plausible receives page views and a small number of named events for web analytics (section 4). ip-api.com receives IP addresses from tool usage records so an administrator can see an approximate country breakdown (section 4). No content you create is sent to any of them. |
4. Analytics and approximate location
Web analytics: we use Plausible, a cookie-less analytics service, to count page views, referrers and clicks on links that lead off the site. Its script is loaded from plausible.io. It is not loaded for signed-in administrators or for IP addresses excluded in our configuration, it sets no cookies, and events we send name pages and tools, never your content. If you block the script, nothing on the page breaks.
Approximate location: the administrator analytics page shows which countries recent visitors came from. To produce it, the IP addresses in the last 30 days of tool usage records (up to 100 at a time) are sent to ip-api.com, which returns the country each address belongs to. Only the IP address is sent, and only the country name and code come back; that result is cached in our database against the IP address so the same address is not looked up twice. We do not build advertising profiles and we do not share analytics with advertisers.
5. Payments
Plans and gift keys are paid for through Stripe. Your card details are entered on Stripe's own checkout page and never touch our servers. What we keep is the payment record Stripe sends back: the amount, date, plan and billing interval, whether it was a first payment or a renewal, the period a renewal paid for, the Stripe event, session and subscription identifiers, and the email address on the Stripe customer. Your Stripe customer and subscription identifiers are also stored on your account so renewals, plan switches and cancellations can be matched to you. Stripe's handling of your payment data is governed by Stripe's privacy policy. If a gift key is bought through the gift page, the sender name and gift message typed at checkout are stored and shown to the recipient on their gift page.
6. Email
Email we send you comes from notifications@xerionsoft.net: email verification, password resets, confirmation of an email address change (with a warning sent to the old address), a notice when a plan is activated, a notice if a renewal payment fails, reminders you switch on inside tools (Financial Planner bill and income reminders, Subscription Tracker renewal reminders, and uptime or SSL alerts for sites you monitor, sent to the address you set per site), and replies to your support tickets and proposal updates unless you turn those off in Notification Settings.
Occasional announcements about Xerion may also be sent to the email address on your account.
Email you send through Xerion: quotes, invoices and receipts go to the client address you enter, with your business name as the sender name and your address as the reply-to. "Email this to me" in Documents and Spreadsheets, and design emails from the product builder, go to the address you enter. These sends share one limit of 15 per day per account and the text is checked automatically for threatening or hateful language before it goes out. Quotes, invoices, receipts and "Email this to me" messages carry a link to report abuse.
The email list is separate from your account. When you sign up we record the address, the page you signed up from, your IP address and the time of consent. Each address on the list has its own one-click unsubscribe link, and opening it marks the address as unsubscribed. Nothing on the site emails the list automatically. The signup form gives the same answer whether or not an address is already on the list, so it cannot be used to test whether someone has subscribed.
7. Public pages and shared links
Some tools exist to publish things. Bio pages, blogs (including their RSS feeds), countdown pages, RSVP pages, proposals you share by link, testimonial collection links and gift pages are public by design: anyone with the address or link can read them, and pages with a plain public address can be indexed by search engines. Do not put anything on them that you would not want public.
Text you publish on these pages, and text you send by email through Xerion, is checked automatically for threatening or hateful language. Anything flagged is logged for an administrator to review, and blocked text is not published or sent. Anyone, member or not, can report a page or an email at report-content.php; a person reviews every report.
8. Journal entries
Entries in the Journal tool are encrypted on our server before they are written to the database (AES-256-GCM), titles included. Each journal has its own data key. If the journal has no password, that key is wrapped with a server-side master key that is stored separately from the database (in our server configuration or a key file), so the site can open the entries for you when you sign in. If you give a journal a password, the key is wrapped with a key derived from that password instead (PBKDF2, 210,000 iterations) and the site cannot open those entries without it. Unlocking a password-protected journal lasts 30 minutes of inactivity in your session. There is no password reset for a journal: if you forget it, those entries cannot be recovered.
9. Cookies and local storage
- A session cookie keeps you signed in while you use the site.
- If you tick "Stay signed in for 30 days" at login, a remember-me cookie (xerion_remember) signs you back in on that browser until it expires or you log out.
- When you register, a trial cookie (xerion_trial_claimed, one year) is set on that browser and, together with the signup IP address, enforces one free trial per person.
- Your light or dark theme choice is kept in your browser's local storage. Members' seasonal theme choice is also saved on their account so it follows them between devices.
- If you use one of the free tools without an account and click "Create free account" or "Log in", a copy of your unsaved work is kept in your browser's local storage for up to 24 hours so the tool can restore it after you sign in. Nothing is sent to Xerion by this.
- Plausible sets no cookies. We set no advertising cookies.
10. Third parties and hosting
Our database and uploaded files live with our hosting provider. Beyond that, the only third parties that receive anything are Stripe (payments), Plausible (web analytics) and ip-api.com (country lookup of IP addresses for administrator analytics), each described above. Fonts are loaded from Google Fonts, so your browser requests them from Google's servers when a page loads. We show no advertising and we do not sell personal information. We do not share your content with anyone except where necessary to operate the Service or where required by law.
11. Where we operate and your rights
Xerion is operated from Ontario, Canada, and handles personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).
Data is stored with our hosting provider in North America.
You can view and change your username, email address, password, two-factor settings and the devices where you are signed in at any time on your Account page. Export My Data builds a ZIP of your records: a CSV file for every tool store that holds something of yours, the same data as one JSON file, your uploaded receipts, business logo, avatar, book covers and brand-kit logo, and your creative project files. Journal entries are included only as the encrypted text we store (section 8). Usage records, sign-in attempt records and your password and two-factor secrets are never part of it. One export can be built every five minutes. To have your account deleted, email support@xerionsoft.net from the address on your account; there is no self-service delete button, so a member of staff runs the deletion routine for you. Section 12 and your Account page say exactly what it removes and what it keeps.
12. Retention and deletion
Your account and everything saved in it are kept for as long as the account exists. Registrations that are never email-verified are removed when the same username or email address registers again. Failed sign-in records are cleared after about two days. Email verification links expire after 48 hours and email-change links after 24 hours. "Stay signed in" tokens expire after 30 days or when you sign a device out.
When your account is deleted, the deletion routine removes, in one step: the account itself, its signed-in devices and API tokens, everything you saved in the tools, your public pages (bio page, blog, countdowns, RSVP events and their responses, short links and their click records), your notifications, achievements, dashboard settings and support tickets, and the files you uploaded (receipts, business logo, avatar, book covers and brand-kit logo). Three kinds of record are kept with your account detached from them: subscription payment records and Stripe order records, because accounting rules require them, and moderation records for content that was reported. One line is written to our security log saying an account was deleted; it carries no name, email address, IP address or content. An account with a live subscription is not deleted until the subscription is cancelled, so renewals stop.
13. Security
Passwords are stored as one-way hashes. Database queries are parameterised, and forms and actions that change your data carry anti-forgery tokens. You can switch on two-factor authentication (an authenticator app plus recovery codes) from your Account page, and a warning is emailed to your old address whenever the email on your account changes. Repeated failed sign-ins are throttled. Uploaded receipts are served only after checking that the request comes from the account that owns them. No system is perfectly secure and we cannot guarantee absolute security, but we take reasonable steps to protect your information.
14. Changes to this policy
We may update this policy as the Service changes. Material changes are reflected by updating the date at the top of this page.
15. Contact
Questions about this policy, access or correction requests and deletion requests can be sent to support@xerionsoft.net. Signed-in members can also open a support ticket from their dashboard.