Security and privacy: where your courses live

Your course data stays on your computer

Projects are folders on your own disk: the course file, its media and its history. Xogogy has no cloud workspace and no account.
A course leaves your computer only when you send it somewhere yourself: you publish to ReviewMyElearning, you tick "Attach the original course file" in a problem report, or you copy a package to your LMS.
Your licence key and your ReviewMyElearning API key are kept in the operating system's credential store (Windows Credential Manager or the macOS Keychain). The app never writes either one to a project, a package or a log, and no part of the editor can read them back.

Every network call the app makes

All of them are HTTPS requests made by the app's native shell to an address built into the app. The editor window itself cannot reach any outside address: its content security policy allows connections only to the app. Requests use your operating system's own TLS and certificate store, follow no redirects, keep no cookies and carry the user agent Xogogy.

Host	When	What is sent
`hymgrwerqxhvsergivrq.supabase.co` Our licence service	You press Activate or Deactivate this computer.	Your licence key, a salted SHA-256 hash of the computer's identifier (never the identifier itself), the operating system and the app version.
Same host	You start a publish or export, press Check installed licence, or run `xogogy publish` from the command line. Once per publish.	The licence id from the licence file on your computer and the same computer hash. If the service cannot be reached, the publish goes ahead on the offline licence check.
Same host	You press Send in Report a problem.	Your note, the details shown in the dialog before you send, your licence id if you have one and the computer hash (used only to limit how many reports one computer sends). The screenshot and the original course file only if you include them.
`reviewmyelearning.com` ReviewMyElearning, our review service	You publish to ReviewMyElearning, or open or answer its review comments. While the Publish dialog waits for a new upload, it asks for its status every 5 to 10 seconds, for up to 10 minutes.	The published package, its title, the course's own id and file name, your comment replies, and your ReviewMyElearning API key.
`xogogy.com` This website	You choose Help › Check for new beta…, or you turned on "Check for a new beta when Xogogy starts" in Settings (off until you turn it on; then at most once a day).	One request for a small public file, `/beta/latest.json`, with only three headers, Host, User-Agent `Xogogy` and Accept `application/json`: no course data, account, licence, app version, computer identifier or cookie. As with any connection, the website host sees your network address.

That is the whole list. The app makes no other request: nothing at start-up unless you turned on the beta check, nothing in the background, and no licence check-ins between publishes.

Some menu items open a page in your own web browser instead, so the app itself sends nothing: Help › Help website, the beta download page, and the ReviewMyElearning free-year link. Help › Send feedback opens a draft in your mail program for you to send or discard.

On Windows, if the computer has no Microsoft Edge WebView2 runtime, the installer downloads Microsoft's WebView2 installer from Microsoft. Windows 11 includes WebView2, so this happens only on computers that lack it.

No telemetry or analytics in the app

The app sends no usage data, crash reports, analytics or advertising identifiers. Problem reports go only when you press Send.
Automated checks in our build fail if the editor's content security policy gains an outside address, or if any code outside the app's service modules makes a network request.
This website is separate: it uses PostHog analytics, without cookies until you accept them. The app does not use PostHog. Details are in our privacy policy.

The AI connection is local, and the app contains no AI

Xogogy contains no AI model, sends nothing to one and holds no AI keys. You bring your own assistant, such as Claude, ChatGPT or Cursor.
Your assistant connects through the Xogogy MCP server, which your assistant app starts on your computer and talks to over standard input and output. The server makes no network request of its own.
To work on the course open in the app, the server joins the app over a channel only your user account can open: a named pipe on Windows that refuses remote clients, or a socket in a private folder on a Mac. Each connection must present a random 32-byte session key that changes every time the app starts. There is no TCP or UDP port.
Every change an assistant makes goes through the same checked operations as the editor, is labelled with the assistant's name in the course history, and can be undone in one step.
What your assistant sends to its own provider, such as course text, is covered by your agreement with that provider.

Published courses make no calls home

A published package holds our player, the course file, the course's own media and the open-licence fonts it uses, with the manifest your LMS needs.
The player has no third-party code at all and contains no request to GForce Learning or any other host we run.
Tracking goes only to the system that launches the course: SCORM courses talk to the LMS page they run in, and xAPI and cmi5 courses send statements to the learning record store your LMS names at launch.
The only outside content a course loads is content its author put there, such as a web object that shows another site, or the course's own JavaScript.

Course content is data

When Xogogy imports or edits a course, and when an assistant or the command line works on it, scripts and actions inside the course are read as text and never run.
A course's own JavaScript runs in the learner's browser, inside the published course, as it does with the tools the course came from. A course can turn its scripts off.
Preview runs course scripts inside a separate frame with no access to the app, your files, browser storage, pop-ups or web requests. One limit remains: a script there can open a WebRTC connection. You can clear Run course scripts in Preview to keep scripts off.
Open in browser writes a temporary preview copy and opens it in your default browser, where the course's scripts run as they would for a learner. The copy is deleted when you close Xogogy.

Updates and signing

Xogogy has no automatic updater. It never downloads or installs anything by itself. Check for new beta tells you a newer build exists and opens the download page on this website; you download and run the installer yourself.
Mac: builds from 4 November 2026 are signed with our Apple Developer ID and notarised by Apple, so macOS checks every download before it opens. Our Mac build fails unless the signature, the Gatekeeper check and the stapled notarisation ticket all pass.
Windows: the installer is not code-signed yet, so Windows SmartScreen warns on first run. Code signing through Microsoft's Azure Artifact Signing is under way, and this page will say when it ships.
Your licence is a file signed with an Ed25519 key, checked on your computer with a public key built into the app. A licence file that does not verify is never installed.

Personal data we hold

We hold it in our Supabase project in the United States (US East). Its tables are closed to public access: only our own service functions can read or write them, and none of them has a field for an IP address.

When you buy: your email address, the name given at checkout, Stripe's references for the payment, a hash of your licence key (not the key), the licence status and device limit, and your ReviewMyElearning code. Stripe handles your card; we never see the card number.
For each computer you activate: the computer hash, the operating system and app version, and when it was activated and deactivated.
When you send a problem report: the note, the details shown before you sent it, your licence id, the computer hash and, if you included them, the screenshot and the original course file. Files are stored in private storage. An attached course file is deleted automatically 30 days after the report, and files from a report that never finished uploading are deleted after 24 hours. Our support team receives the report by email, sent through Resend.
On this website: early-access sign-ups and analytics, described in the privacy policy.

We do not hold your courses, how you use the app, or anything from your computer beyond the list above. The privacy policy sets out how long we keep each record and how to have it deleted.

Report a vulnerability

Email security@xogogy.com. Please include the Xogogy version and operating system, the steps to reproduce, and what an attacker could do. We confirm every report within three business days, keep you told as we fix it, and credit you when the fix ships if you would like that.

In scope: the Xogogy app, its command line and MCP server, published course packages, our licence and problem-report services, and this website.
Please do not access or change other people's data, run denial-of-service or social-engineering tests, or test Stripe, Supabase, PostHog or other providers directly; report issues in their services to them.
If you act in good faith and follow these rules, we will not take legal action against you for your research.
We do not run a paid bug bounty.

Our security.txt carries the same contact.

Documents on request

Xogogy Security Overview: architecture, data flow, network calls, threat model, supply chain and roadmap. Print it or save it as a PDF from your browser.
Third-party software notices: the open-source components Xogogy uses and their licences. They install with the app, and we email a copy on request.
Our privacy policy, terms and refund policy.

Write to security@xogogy.com for any of them, or with questions from your security review. Xogogy is made and sold by GForce Learning Corp.