Privacy policy

Effective date: 9 November 2026

Who we are

GForce Learning Corp, a Utah corporation ("we", "us"), sells Xogogy and runs the services described here. Contact: support@xogogy.com.

For anything about your privacy, write to privacy@xogogy.com.

The short version

• Your courses are read, edited and saved on your computer.
• There is no account, no telemetry and no advertising. Neither the app nor its command line makes a network call in the background.
• The app contacts only our own services, and only when you start the action: activating or checking a licence, publishing to ReviewMyElearning, sending a problem report, and checking for a new beta. If you turn on the start-up beta check in Settings, the app also makes that check when it starts, at most once a day.
• The app contains no AI model and sends nothing to one.
• This website, not the app, uses PostHog analytics. It sets an analytics cookie only if you accept; see Cookies and analytics.

What the app sends, and when

Other things the app does without sending anything itself:

• Help › Help website and "Claim your free year" open a page in your own web browser.
• Help › Send feedback opens a draft in your mail program with the product, version, build date and operating system. You decide whether to send it.

What stays on your computer

• Your courses, their media and their history.
• The signed licence file: the licence id, the name given at checkout, a one-way hash of your email address (not the address itself), when it was issued, the id of the key that signed it, the date updates run until, the device limit and the computer it is bound to.
• Your licence key and your ReviewMyElearning API key, kept in the operating system's credential store (Windows Credential Manager or the macOS Keychain). Neither is written to a project, a package or a log.

AI agents you connect

The command line and the local server let an AI agent you choose read and change your courses. They work only on your computer, over a channel only your user account can open, with no network port. The one network request the command line makes is the licence check when a publish is run, described above; the local server makes none. Anything your agent sends to its own provider, such as course text, is covered by your agreement with that provider, not by us.

When you buy a licence

Stripe takes the payment on its own checkout page and handles your card details under its own privacy policy. We never see or store your card number.

From the purchase, our licence service keeps:

• Your email address and the name given at checkout.
• Stripe's references for the checkout, payment, charge and customer, so a refund or dispute can be matched to the licence.
• A hash of your licence key (not the key itself), the major version, the device limit and whether the licence is active or revoked.
• The single-use ReviewMyElearning Basic code issued with the licence and whether it was issued, used or cancelled.
• For each activated computer: the computer hash, the operating system and app version at activation, and when it was activated and deactivated.

We use this to issue, activate, check, refund and support your licence, and to email you your key and your ReviewMyElearning code.

We never use your purchase details for marketing. We send product news only if you opt in separately, and you can opt out at any time.

Problem reports

• An attached course file is stored privately and deleted 30 days after the report.
• Attachments whose upload did not finish within 24 hours are deleted with them.
• The note, the details and the screenshot are kept with the report. Our support team gets an email with the note, the details and download links to the attached files.
• The note, the details and the screenshot are deleted 2 years after the support conversation about the report closes.

This website

The Xogogy app sends no analytics and no telemetry. What follows is about this website only.

Cookies and analytics

• This website uses PostHog, a US-hosted analytics service that processes the data for us, to see how people use the site.
• It records the pages you view, the links and buttons you click, how you arrived (the referring site and any utm_ campaign tags on the link), your browser and device type, and an approximate location worked out from your network address.
• Until you choose, and if you choose Decline, it counts your visit without cookies: nothing is stored in your browser and visits are not linked across days. If you choose Accept, PostHog sets a cookie so repeat visits are counted as the same visitor.
• Your choice itself is kept in your browser’s local storage so the banner does not ask again.
• Nothing you type into the early-access form is sent to PostHog: not your email, name, other tools or note. When a sign-up goes through, PostHog is told only which tools you ticked and the course-count range you chose.
• To change your choice, use Cookie settings at the bottom of any page. Clearing this site’s cookies and storage also resets it.

Search and fonts

• The feature search and the help search send what you type to our search service, which asks OpenAI which features or help articles match. We do not store or log your text; OpenAI processes it under its API data terms. Both searches also work without this service, using keyword matching in your browser.
• Pages load their fonts from Google Fonts, so your browser contacts Google when a page opens.

Download links

Our download links count each download with the date and time, the file, the country and whether the browser runs on Windows, a Mac or something else, and store no IP address and nothing that identifies you.

Early-access sign-up

When you send the early-access form, we store the email address, name, tools, course count and note you give, when you agreed to be contacted, and the campaign tags of the link you arrived by (the five utm_ values) with the address of the site that sent you there, not the page. To remember those tags while you look around, this site keeps them in your browser’s session storage until you close the tab; it is not a cookie and nothing else reads it. To stop repeated sign-ups we keep a one-way hash of your network address, which cannot be turned back into the address and is deleted after two days; we do not store the address itself. It is stored in our database at Supabase, and our support team gets an email copy of each new sign-up, sent through Resend. To write your welcome email, your first name, the tools you ticked, the text you type in the “other tools” box and your course count are sent to OpenAI; your email address, the rest of your name, your note and the campaign tags are not. OpenAI processes them under its API data terms, we ask it not to keep the email it writes, and we do not log what you typed. We use the sign-up only to invite you and email you about early access. We do not otherwise share it, and we do not sell it. Write to support@xogogy.com and we delete it.

Services that process data for us

• Stripe: payments, refunds and disputes.
• Supabase: hosts the licence service, the problem-report service, the early-access sign-ups and their database and file storage, in the United States (US East).
• Resend: sends the licence email and support notifications, including the copy of each early-access sign-up.
• Render: hosts this website.
• PostHog: website analytics, in the United States. Not used by the app.
• OpenAI: ranks results for the website searches, and writes the welcome email for an early-access sign-up from the first name, tools, other-tools text and course count.
• Google Fonts: serves the website's fonts.
• ReviewMyElearning: our own review service, when you publish to it.

These providers may keep standard connection logs, such as IP addresses, under their own terms. Our own licence and report services do not store IP addresses.

How long we keep licence records

We keep licence, activation and Stripe records for as long as the licence exists, because a perpetual licence must still activate years later. Payment records are kept for as long as tax law requires.

Your choices and rights

Write to privacy@xogogy.com to get a copy of what we hold about you, correct it, or delete it. We answer every request within 30 days. Deleting your licence record means the licence can no longer be activated on a new computer.

In the EU and the UK (GDPR and UK GDPR) you may also ask us to restrict or stop using your information, object to a use, receive your information in a portable form, and withdraw any consent you gave. You may complain to your data protection authority. We use your information:

• to sell, activate, check, refund and support your licence, and to answer problem reports, because we need to for our contract with you;
• to keep payment records, because tax law requires it;
• to stop abuse, such as repeated sign-ups or floods of problem reports, because we have a legitimate interest in keeping our services working;
• to count visits to this website without cookies, because we have a legitimate interest in knowing how the site is used; and to count them with a cookie only if you accept;
• for the early-access sign-up and product news, because you agreed to it.

Our services run in the United States, so your information is processed there.

In California (CCPA) you may know what personal information we collect and why, and ask us to delete or correct it. We do not sell your personal information or share it for advertising. We never treat you differently for using these rights.

Children

Xogogy is made for professional use and is not directed at children under 16. We do not knowingly collect information from children under 16. If you think a child has given us information, write to us and we delete it.

Changes to this policy

We post changes on this page with a new effective date. If a change uses your information in a new way, we email licence holders before it takes effect.