Privacy Policy

Who runs XXT

XXT (powered by MiniMax H3) is run by Yiru Tech (Singapore). This policy explains what we collect, how we use it, where it is stored and for how long.

If you have any questions, email hi@xxt.ai.

What we collect

Your email address, to sign you in and contact you.

If you sign in with Google: the email address, name, profile picture and Google account ID that Google shares with us, used only to sign you in. We do not read anything else in your Google account.

Sign-in records: the IP address and browser information of each sign-in. We use the IP address to limit how often codes and requests can be sent, to prevent abuse.

What you submit: prompts, uploaded images and audio, and the videos generated for you; and, when you make songs, the lyrics, style and lyric-writing conversations you enter and the songs generated for you.

If you create "My voice": two recordings of your own voice (an a cappella singing clip and a spoken verification phrase) and the voice model built from them. A voice model may involve biometric information, and we collect it only with your explicit consent.

Job and credit records: the settings and status of each job, and every change to your credit balance.

API keys: we store only each key's name, its first few characters, a hash and when it was last used. The full key is shown once when you create it and is never stored.

If you use the creative assistant in the studio, your conversations with it are also saved in your account.

How we use it

Only to sign you in, generate videos, bill credits and prevent abuse.

Videos are generated on cloud computing servers that we rent.

Prompts and uploaded images are sent to a third-party large language model for content moderation. Prompts written in Chinese are sent to a third-party large language model to be translated into English. When you use the creative assistant, your conversation is sent to a third-party large language model to generate replies.

When you make a song, the lyrics, style and lyric-writing conversation you enter are sent to the third-party large language model configured by our administrators, to help write lyrics and style. The lyrics and style are sent to a third-party song-generation service to generate the song; we download the finished song and store it ourselves.

When you create "My voice", your two recordings are sent to the third-party song-generation service to verify that the voice is yours and to build a voice model; when you make a song with "My voice", that voice model is used to sing it.

When moderation blocks something, we keep a record of it (the prompt text, or a fingerprint of the image) to deal with abuse.

Sign-in codes are sent through an email delivery service. When you sign in with Google, Google confirms who you are.

When you buy credits online, payment is handled by Stripe: your card details go directly to Stripe, and we never receive or store them. We only receive the order number, amount, currency and payment result, and we give Stripe your sign-in email so it can send you a receipt.

Where it is stored and for how long

Accounts, jobs and credit records are kept in a database on our own server. Traffic to the website passes through Cloudflare.

Uploaded files, generated videos and songs are stored in Cloudflare R2. Videos, songs and uploaded files are kept for 8 hours after the job ends, then deleted automatically. Please download them in time.

The photos and voices of your characters are kept until you delete the character, the photo or the voice; after you delete them, files that no job is using are removed from storage within 8 hours, and files still used by a job are removed within 8 hours after that job ends.

Screenshots attached to a feedback note are kept with the note so we can look into the problem; only our administrators see them. Screenshots uploaded but never attached to a note are deleted automatically after 6 hours.

The two recordings used to create "My voice" are deleted right after the voice is built; recordings that were never used (for example, if you gave up halfway) are deleted automatically after 6 hours at the latest. The voice model stays at the third-party song-generation service until you (or an administrator) delete your voice; you can delete it at any time on the Songs page or through the API, and we ask the service to delete it as well.

Your account, job records and credit history are kept until you ask us to delete your account.

What we don't do

We do not sell your data.

We do not use your prompts, images, audio, videos, lyrics, style descriptions or songs to train any model.

We do not share your data with anyone other than the third parties we need to run the service, including the services named above and the providers of the servers and computing capacity we rent, unless the law requires it.

Deleting your account

To delete your account, email hi@xxt.ai from the address you signed up with. Once we confirm it is you, we delete your account and the data associated with it.

Cookies

We only use the cookies needed to keep you signed in. There are no analytics or advertising cookies.

The interface language you choose is stored in your own browser.

Contact

For any privacy question or request, email hi@xxt.ai.