Privacy Policy

Last updated: September 26, 2026

XYZebra is a local-first app. There is no XYZebra account and no XYZebra server that your notes and Cards pass through — this policy explains what that means in practice.

What we store, and where

Everything you capture — photos, handwriting, Cards, categories, and settings — is saved in your browser's own local storage (IndexedDB and localStorage), on your device only. We do not operate a database of user content, and we cannot see, access, or recover it. If you clear your browser's site data, uninstall the app, or switch devices without exporting first, that data is gone; use the Data & Recovery panel in Settings to back it up yourself.

Access codes

Using XYZebra requires entering a license code. A code is a small piece of cryptographically signed data recording only which access level it grants and when it was issued — it carries no name, email, or other personal information, and is checked entirely on your own device. Entering a code doesn't send anything to us or anyone else, and we have no way to know who is using any particular code unless we separately choose to keep our own record of who we gave it to.

There are two kinds of code. A learner code opens Search, Check, Sort and Build, and the learner's parts of Settings: Display & comfort, How XYZebra Works, interface language, and this policy and the Terms. A tutor code also opens Catch, where lessons are captured, and the rest of Settings, including Data & Recovery (backup and restore). Choices made in Display & comfort are saved only on your device, like everything else.

Optional AI features

Some features (like reading handwriting from a photo) can call a third-party AI provider — currently Anthropic or Groq, whichever you choose in Settings. These calls go directly from your browser to that provider using an API key you supply and store locally; XYZebra has no server in that path either. Any image or text you send this way is handled under that provider's own privacy policy and terms, not ours — review theirs before enabling the feature if that matters to you. If you don't set up an API key, these features simply don't run.

Analytics

We use Vercel Analytics to see aggregate, anonymized usage of the app (such as which pages are visited and roughly how often), so we can tell if something is broken or unused. It does not use cookies and is not used to build a profile of you individually.

What we don't do

We don't sell your data — we don't have it to sell. We don't run ads, ad trackers, or third-party marketing pixels. We don't require an email address, phone number, or any other account information to use the app.

Children's privacy

XYZebra is not directed at children under 13 and does not knowingly collect information from them, consistent with it not collecting information from anyone.

Changes to this policy

If this policy changes, we'll update the date at the top. Continued use of the app after a change means you accept the updated policy.

Contact

Questions about this policy can be sent to the maintainer via the project's repository.