Xero

Privacy

Local-first by design.

Xero runs on your machine. Your projects, journals, and keys stay there. This page spells out what we touch and what we don't.

Last updated · April 2026

Plain-English summary

Xero is a desktop app. Your projects, sessions, and journals stay on your machine. The API keys you paste live in the operating system keychain — we never receive them, and they aren't written in plain text on disk.

When an agent calls a model, the request goes from your machine straight to the provider (Anthropic, OpenAI, Google, OpenRouter, GitHub, Azure, Bedrock, Vertex, or local Ollama). We are not in the middle of those calls.

What data Xero handles

The desktop app touches three categories of data, all locally:

  • Project files. Whatever paths you point Xero at. Nothing is uploaded; agents read and write under those paths only.
  • Session journals. A local record of agent calls, tool results, diffs, and approvals. Stored under your user profile.
  • Provider credentials. API keys and OAuth tokens, kept in the OS keychain (Keychain on macOS, Credential Manager on Windows, Secret Service on Linux).

What we collect

The website you're reading uses standard analytics to understand which pages get used (Vercel Analytics) — page-level only, no personal identifiers, no cross-site tracking.

The desktop app sends optional, anonymized crash reports if you opt in. You can disable them under Settings → Diagnostics — they contain stack traces and version info, never your prompts or files.

When you email team@xeroshell.com we hold the contents of your email to reply. That's it.

Model providers

Each provider you connect has its own privacy and data-retention policy. Xero is a thin client over their APIs — your prompts and outputs are subject to whichever provider you chose for that call.

If you need full isolation, point Xero at a local Ollama instance. No request leaves your network in that mode.

Cloud plans (when they ship)

Pro and Solana Pro will be opt-in cloud plans. When they ship we'll publish a dedicated processing addendum covering hosted runs, sync, and run history. Until then, there is no Xero cloud holding your data.

Your rights

The data Xero holds about you (locally) is yours. Delete the app and the journals go with it. For anything we hold server-side — emails to support, the analytics record of your page views — you can request access or deletion at team@xeroshell.com.