← epigraphia.appPrivacy Policy — EpigraphIA
Xolo Beaver Studios Inc. respects your privacy. This Policy explains what information is handled when you use the EpigraphIA desktop application, how it is used, and what your rights are. EpigraphIA is designed around the principle of minimal data collection.
1. Core principle: your content lives on your computer
EpigraphIA is a local-first application. We do not collect, store or have access to your Content —your novels, sketches, images, projects, designs, ideas or prompts—. All of it remains 100% on your computer. We keep no copies or backups of it, we have no access to it, and no server of ours receives it.
The Application runs without telemetry: it sends no usage analytics and no automatic reports. Your Content never leaves your PC to reach us. The Application only communicates with our services in the specific, limited cases described in section 2 bis (validating your license, checking for updates and, if you choose to, sending us a report).
Note about the Beta Program: during the Beta Program (prior to commercial launch and still active until September 2026 for invited participants) a proxy operated by Xolo Beaver Studios Inc. temporarily processes certain AI provider requests to let participants try the product without configuring their own keys. This proxy keeps only aggregate usage counts (to manage granted credits) and transient IP addresses for a maximum of 30 days. Full details are in the Beta Program Addendum invited participants receive by email. This mechanism DOES NOT apply to purchased licenses (those operate 100 % local-first as described in this policy).
2. Information the Application does NOT collect
Except as described in section 2 bis, EpigraphIA does not collect, transmit or store on our servers:
- The text of your works, sketches, images, projects or designs.
- Your prompts or the AI-generated output.
- Location data, biometric data, health or financial information.
- Browsing or activity history.
- Usage analytics or automatic crash reports (there is no telemetry).
2 bis. Information the Application does send, and when
There are three situations in which the Application communicates with services operated by us or by our providers. None of them sends your Content, except for whatever you yourself choose to include in a report.
a) License validation. When you activate EpigraphIA, and periodically afterwards to confirm that your license is still valid, the Application sends:
- your license key;
- a technical identifier of your device, transformed with a cryptographic function (hash) so that it does not reveal your computer's name or details; it is used to enforce your license's device limit;
- the Application version.
This data goes through our license server and is checked with our Merchant of Record (Polar), which returns the license status and the email address associated with the purchase. If you take part in the Beta Program, your beta code and email address are sent instead of the license key.
b) Checking for updates. The Application contacts our download server to find out whether a new version is available and, if so, downloads it. As with any internet connection, the server receives your IP address and technical connection data (for example, your operating system and the Application version). We do not use them to identify or profile you.
c) Reports you choose to send. If you use the option to report a bug or AI-generated content, the report includes what you write, the part of the Application where it happened, the Application version, a screenshot only if you attach one and, optionally, an email address or code so we can reply to you. The report reaches us as an email. Review the screenshot before sending it: it may show part of your Content.
3. API keys (BYOK)
The API keys you configure (OpenAI, Anthropic, Google, Replicate, Pixabay, etc.):
- Are encrypted locally on your machine (using the operating system's secure storage).
- Are never stored in plain text and are never sent to our servers.
- Are visible only to you within the Application.
- Are used to call the provider's API directly from your computer; that traffic goes from your machine to the provider, not through us.
Any content you send to those APIs is additionally subject to the corresponding provider's privacy policy.
4. Information related to purchases and support
In addition to what is described in section 2 bis, information may exist in connection with your purchase of a license or your contact with us, handled outside the Application:
- Purchase: processed by Polar Software, Inc. (Delaware, USA), our Merchant of Record (MoR). Polar Software collects your email, payment and tax details under its own privacy policy. We receive only your email address, your name if you provide it, and your country (for licensing and billing purposes) and do not store your card details.
- Support / contact: if you write to us (support, legal, privacy), we receive your email address and the content of your message so we can respond.
- Reviews: after your purchase we may email you an invitation to review the product. If you leave a review, we store the text, the rating and the name you choose to display; it is published only if you approve it and it passes our moderation.
We use that information for:
- Necessary purposes: processing your purchase, validating your license, responding to your requests and reports, sending you important notices about your license, and complying with legal obligations.
- Optional purposes (you may object): sending you notices about new product versions and inviting you to leave a review. To stop receiving them, write to legal@xbstudios.ca. Opting out does not affect your license.
We do not sell it, we do not use it for advertising or profiling, and we do not use it to train AI models.
5. Sharing with third parties
We only share information with providers that process it on our behalf, and only to operate the service:
- Polar Software, Inc. (USA): payment processor and Merchant of Record; validates licenses.
- Vercel Inc. (USA): hosts our license and report server.
- Resend (USA): sends emails (license notices, review invitations and the reports you send us).
- Supabase (USA): database for Beta Program codes and reviews.
- Cloudflare, Inc. (USA): hosts the download and update server.
- Authorities, only where there is a valid court order or legal obligation.
These providers are located outside Mexico and Canada, mainly in the United States, so your data may be processed in those countries under the security measures each provider offers.
We do not share with: AI providers (API calls go straight from your PC), advertisers, data brokers, social networks or AI training services.
6. Data retention
- Purchase/support data: retained for as long as necessary for the purpose and for applicable accounting/legal obligations, and deleted once no longer needed.
- Reports: retained while the report is being handled and for up to 12 months afterwards, to follow up on recurring bugs; you may ask us to delete them sooner.
- Technical validation and update data (IP address, hashed device identifier): only for as long as needed for verification and the security of the service, in line with each provider's logs.
- API keys: remain on your machine for as long as you choose; you can delete or reset them at any time from Settings.
- Your Content: we do not have it; if you delete it from your PC, it is gone.
7. Your rights (PIPEDA · CCPA/CPRA · LFPDPPP · GDPR)
Depending on your jurisdiction, you have the right to access, rectify, delete and object to the processing of the personal data we may hold in connection with your purchase or support, as well as the right to data portability where applicable.
- How to exercise them: write to legal@xbstudios.ca, state which right you are exercising and verify your identity (the email associated with your purchase). We will respond within 30 days.
- Important: as for your creative Content, we cannot give you access to it or a copy of it because we do not have it (it lives on your computer).
8. Security
We protect the data we handle by applying the operating system's secure-storage encryption for sensitive data (such as API keys), TLS for data in transit to processors, and the principle of minimal data collection. No security measure is 100% infallible; you are responsible for keeping your machine and your third-party credentials secure.
9. Cookies and analytics
The EpigraphIA desktop application does not use cookies or web tracking. If you visit the epigraphia.app website, anonymous web analytics tools may apply; see the site's own notice.
10. Incident notification
If we detect unauthorized access to personal data we handle, we will notify the affected individuals and the authorities where required by law, within the applicable legal timeframes, describing what happened and the recommended measures.
11. Rights by jurisdiction
- Canada (PIPEDA): all of the rights above apply.
- U.S. — California (CCPA/CPRA): the right to know, delete, correct, and to no sale of personal data (we do not sell data).
- U.S. — other states: we comply with applicable state regulations.
- Mexico (LFPDPPP): ARCO rights (Access, Rectification, Cancellation, Objection); see also the LFPDPPP Privacy Notice (separate document).
- European Union, European Economic Area and United Kingdom (GDPR / UK GDPR): the rights described in section 12 apply.
12. Users in the European Union, EEA and United Kingdom (GDPR / UK GDPR)
If you are located in the European Union, the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and the UK GDPR grant you the following rights with respect to the personal data we may process (remember that the Application does not collect your content; personal data is limited to what is associated with your purchase, your license, your reports or your contact with support — see sections 1 through 4).
12.1 Data controller
The data controller is Xolo Beaver Studios Inc. (a Canadian federal corporation incorporated under the Canada Business Corporations Act, based in Vancouver, British Columbia). Contact: legal@xbstudios.ca.
EU representative (Art. 27 GDPR): EpigraphIA is currently not available to residents of the European Union or the European Economic Area. Our Merchant of Record (Polar Software, Inc.) applies a geo-restriction at checkout to block purchases from those territories. As a result, and since we do not offer products or services to EU/EEA residents, the obligation of Art. 27 GDPR does not apply. When we expand availability to that region we will designate a representative in compliance with Art. 27 and update this section with their name and physical address.
UK representative: EpigraphIA is available to UK residents. Under UK GDPR, the data controller remains Xolo Beaver Studios Inc. (contact address in section 14). Complaints may be filed with the UK's ICO (Information Commissioner's Office) at ico.org.uk.
12.2 Legal basis for processing
We process your personal data on the following lawful bases:
- Performance of a contract (Art. 6(1)(b)): processing your purchase and providing you with the EpigraphIA license and support.
- Legal obligation (Art. 6(1)(c)): keeping accounting and tax records.
- Legitimate interest (Art. 6(1)(f)): ensuring product security, preventing fraud and responding to your requests; always balanced against your rights.
- Consent (Art. 6(1)(a)): for optional communications about updates; you may withdraw it at any time without affecting the lawfulness of prior processing.
12.3 Your rights under the GDPR
You have the right to:
- Access your personal data.
- Rectification of inaccurate or incomplete data.
- Erasure ("right to be forgotten").
- Restriction of processing.
- Portability of your data in a structured, commonly used format.
- Object to processing based on legitimate interest.
- Not be subject to automated individual decision-making with legal effects (we do not carry out such decisions or profiling).
- Withdraw your consent at any time.
- Lodge a complaint with a supervisory authority (section 12.5).
To exercise them, write to legal@xbstudios.ca. We will respond without undue delay and, at the latest, within one (1) month, extendable as provided by the GDPR where the request is complex.
12.4 International transfers
Because Xolo Beaver Studios Inc. is located in Canada and our providers (see section 5) are located outside the EEA/United Kingdom, data associated with your purchase, license, support or reports may be transferred outside the EEA/United Kingdom. Such transfers rely on valid GDPR mechanisms, such as adequacy decisions (Canada holds a partial adequacy decision from the European Commission for entities subject to PIPEDA) or Standard Contractual Clauses (SCCs) with the corresponding providers. Remember that your content is not transferred because it never leaves your computer.
12.5 Supervisory authority
You have the right to lodge a complaint with the data protection authority of your country (for example, your national Supervisory Authority in the EU/EEA, or the ICO in the United Kingdom), without prejudice to any other remedy.
12.6 Retention
We retain data associated with purchases and support only for as long as necessary for the purposes described and to comply with legal obligations; it is then deleted. We do not retain your creative content (we do not possess it).
13. Children's privacy
EpigraphIA is not directed at children under 13. Between 13 and 17 years of age, the consent of a responsible adult is required, and that adult may request access to or deletion of associated data. Children under 13 may not use the Service. (In GDPR jurisdictions where the age of digital consent is higher, the applicable local age applies.)
14. Changes to this Policy
We may update this Policy. If there are material changes, we will publish the version with its date and, where reasonable, announce it within the Application. Continued use after the changes take effect constitutes acceptance.
15. Contact
For privacy questions or requests:
Email: legal@xbstudios.ca
Xolo Beaver Studios Inc. — Registered address and address for service of notices: 653-5515 Boundary Road, Vancouver, British Columbia, Canada V5R 0E3
Response time: up to 30 days.
This document is a general reference and does not constitute legal advice. It should be reviewed by a professional before commercial publication.