xgoose privacy

Updated October 25, 2026 · Chrome 0.2

What the extension accesses

The floating agent reads and acts on the current page when you use it. Installed skills and JavaScript tools can access page content and make requests using the page’s session. Navigation, refresh or closing the page ends the run. Local chat history is stored in extension storage. Skill recommendations match cached catalog metadata locally; they do not send each visited URL to our website.

Images you attach to a conversation

In the Chrome extension, you can choose or paste an image. Before sending, the extension resizes and re-encodes it locally. Sending the message shares that image with the selected AI provider, including luna when you use Hosted AI. Attached images remain in local conversation history. Diagnostic transcript uploads include attachment metadata and omit image bytes.

Hosted conversations are saved automatically

Using Hosted Luna automatically uploads and saves complete conversations: user messages, model answers, actual tool inputs and outputs, errors, interruptions and context summaries. These may contain page content you ask the agent to read, including personal communications, financial records or health information when you select such content. The extension removes credentials, cookies, authorization headers and recognized sensitive fields before upload. Do not include information you do not want processed by the service.

We store conversation indexes in an account-isolated database and bodies in private object storage. Records expire after 90 days. For requests about stored conversations, contact support. Deleting conversation records does not refund usage. Operational measurements include success, error, latency, usage and completeness. Chat bodies are not sent to Google Analytics or included in public test artifacts.

BYOK

When using your own provider or LiteLLM endpoint, model requests go to your configured provider. Conversation upload to xgoose is off by default. After signing in, you may separately opt in. Provider privacy terms also apply to the data sent for inference.

Storage and staff access

Conversation storage is part of the Hosted Luna service and does not require a separate upload setting. Turning off optional BYOK uploads stops future uploads and clears pending uploads when the extension next connects. Administrators may review stored conversations to provide support, diagnose failures and maintain service quality. Cloud transcript viewing is restricted to authenticated administrators, and every read is audited. Ordinary users keep their chat history locally in the extension.

Usage analytics

Transcripts may include the website hostname to help diagnose site-specific issues; this metadata is restricted to administrators with the transcript. The website records public page paths, documentation visits and visible reading time, game starts and results, product actions and timing. First-party product events are retained for 30 days. The website also uses a separate Google Analytics 4 web stream for visitor and session counts, approximate location, device categories and acquisition sources. Referral data is limited to the referring website origin; campaign labels use validated UTM values. Analytics page locations exclude query strings and fragments, including search terms and authentication tokens. You can disable website usage analytics from the footer; Do Not Track is respected. We use this data to understand site usage and diagnose failures. Advertising personalization and Google signals are disabled. Private URLs, email addresses, messages and keys are excluded. The extension has a usage analytics setting that can be turned off in Settings. When enabled, interaction events, provider choice, errors, platform and a persistent installation identifier are sent through our analytics endpoint to Google Analytics 4. Signed-in events may include a pseudonymous account ID. Conversation bodies, tool bodies, API keys and authentication tokens are not included in these analytics events. Hosted billing and service reliability records remain necessary to operate the service.

Accounts, credit and security

We retain account and session information, including IP address and user agent, to authenticate users, revoke devices, prevent abuse and account for usage. We do not request precise GPS location. Trial credit is automatically issued once per verified account, expires after 30 days and is subject to a platform spending cap. Provider credentials and internal service credentials are server secrets and are not shipped in the extension.

Contact

For privacy requests, use Support. If a tool output or transcript is incomplete, the service records that limitation rather than treating it as a complete account of the run.