Privacy Policy

Account information. When you sign in with Google or Apple, or register with an email and password, we store your email address and, when available, your name and profile image. If you register with a password, it is stored only as a secure bcrypt hash — we never keep the plaintext.

Security data. If you enable two-factor authentication (2FA), your TOTP secret is stored encrypted (AES-256-GCM). Any access/API keys you create are stored only as a hash, plus a short non-secret prefix; the full key is shown to you once and never saved.

Conversations. The messages you send, the AI responses, the chosen model and mode, project instructions, and token counts. We store these so you can see your chat history and so we can apply usage limits.

Usage data. Daily message counts (including per AI provider) and any extra credits you purchase.

Billing data. When you subscribe or buy credits, payment is processed by Stripe. We store your Stripe customer and subscription identifiers, plan, and trial status. We never see or store your full card number.

Optional integrations. If you connect SimBrief, we store the SimBrief username / Pilot ID you provide.

To provide and operate the service, maintain your chat history, and personalize responses with your project instructions.

To enforce free/PRO plan limits and track usage and credits.

To process subscriptions, trials, and one-time credit purchases through Stripe.

To secure your account (authentication, 2FA, access keys) and prevent abuse.

To communicate essential service information related to your account.

To generate responses, we send your prompts and the relevant conversation context to the AI provider that powers the model you selected — OpenAI, Anthropic, and/or Google. These providers process that content solely to return a response and are bound by their own terms and privacy policies. Please do not submit sensitive personal data you would not want processed by a third-party AI provider.

Payments are handled by Stripe under its own privacy policy.

If you use SimBrief features, the flight-plan details you enter are sent to Navigraph's SimBrief service. X-Shop AI is not affiliated with SimBrief or Navigraph.

Weather and airport information is fetched from the NOAA Aviation Weather Center using the ICAO codes you enter; no personal data is sent. All aviation features are for simulation and virtual aviation only — not for real-world flight operations.

We use a strictly necessary session cookie to keep you signed in, and a language-preference cookie (xshop-locale) to remember your chosen interface language. We do not use advertising or third-party tracking cookies.

We keep your account data while your account is active. Conversations are retained until you delete them or close your account. When an account is deleted, its associated data (conversations, messages, usage records, projects, keys) is removed.

Data is transmitted over encrypted connections (HTTPS). Passwords are hashed (bcrypt), 2FA secrets are encrypted at rest, and access keys are stored only as hashes. API keys and other secrets are kept server-side and are never exposed to the browser.

You may access, correct, export, or delete your personal data, and withdraw consent where applicable. To exercise these rights, contact us using the details below.

X-Shop AI is not directed to children. You must be at least 16 years old (or the age of digital consent in your country) to use the service.

We may update this policy from time to time. Material changes will be reflected by the “Last updated” date at the top of this page.

For privacy questions or to exercise your rights, contact us at privacy@aviashop.online.