Privacy Policy

XstreamAI is operated by Christian Nicoletti (“we”, “us”), who is responsible for your personal information. This policy explains what we collect when you use the XstreamAI website, app, Academy and partner program, and the choices you have. It works together with our Terms of Service.

• Account details: your email address. If you sign in with Google or Apple, we also receive the name and profile photo they share.
• What you create: titles, prompts, voiceover scripts, settings, images you upload, saved templates, and the videos, thumbnails and audio we generate for you.
• Billing: your plan, credit balance and history, and the IDs Stripe gives us for your customer record and subscription. Stripe collects and stores your card details; we never see your full card number.
• Partner program: your referral code, who referred you, the customers you referred, and commission records. On the public leaderboard your name (or the start of your email address, if you haven’t set a name) is masked, for example “C***ann”.
• Technical data: your IP address, browser type and request logs, which our hosting and security providers process to deliver the site and stop abuse. We don’t use analytics or advertising trackers.
• Messages: anything you send us by email.

• To create your account, sign you in and render your videos.
• To manage credits, subscriptions, the free trial and refunds of failed renders.
• To track referrals and calculate partner commissions and the weekly leaderboard.
• To send emails about your account: render and credit updates, a reminder if you haven’t used your free credits, and partner milestones.
• To prevent fraud and abuse, enforce our Terms, and keep the Service secure.
• To answer your questions and fix problems.

We use your information because it’s needed to provide the Service you signed up for, because we have a legitimate interest in keeping it secure and improving it, or because the law requires it. We don’t sell or rent your personal information, and we don’t share it for targeted advertising. We don’t use your prompts, images or videos to train AI models.

We share information only with service providers that help us run XstreamAI, and only what each one needs. They process it on our behalf under their own security and privacy terms:

• Supabase · Database, sign-in and video storage
• Stripe · Payments, subscriptions and invoices
• Fal.ai · AI video generation and upscaling (receives your prompts and any image you upload)
• ElevenLabs · AI voiceovers (receives your voiceover script)
• Inngest · Runs the render pipeline and scheduled emails in the background
• Resend · Sends account and render emails
• Upstash · Rate limiting to stop abuse (uses your account ID)
• Vercel · Website hosting
• Cloudflare Turnstile · Bot protection on sign-in, when turned on
• Google or Apple · Only if you choose to sign in with them

We may also share information if the law requires it, to protect people’s safety or our rights, or as part of a sale or reorganisation of the business, in which case this policy would continue to apply to your data.

• Your videos are private by default.
• If you make a video public, anyone with its link can watch it, along with its title.
• If you publish a video to Templates, other users can see it and reuse its prompt and settings.
• Partners who referred you see that a referral signed up or paid, but not your email address.
• The partner leaderboard shows masked names and commission totals only.

We only use cookies the Service needs to work. There are no advertising or analytics cookies.

• Supabase sign-in cookies (sb-…)Until you sign out or the session ends

  Keep you signed in

• xs_ref90 days

  Remembers which partner referred you, so they get credit and you get your bonus

• xs_promo30 days

  Remembers a promo code from a link until checkout

• xs_bar_dismissed30 days

  Hides the announcement bar after you close it

• xs_first_video_seen1 year

  Makes sure the first-video welcome message only shows once

• xs_academy_done (local storage)Until you clear your browser data

  Remembers which Academy lessons you've finished. Stays on your device and isn't sent to us

You can delete cookies in your browser settings. If you delete the sign-in cookies you’ll be signed out.

We keep your account information and creations while your account is open. When you ask us to delete your account, we delete or anonymise your personal information within 30 days, except records we must keep for legal, tax, accounting or fraud-prevention reasons (such as payment and commission records), which we keep only as long as required. Stripe keeps its own payment records as the law requires.

Wherever you live, you can ask us to show you, correct, export or delete the personal information we hold about you, or to stop sending non-essential emails. Email [support email: add before launch] from the address on your account and we’ll respond within 30 days. We may need to confirm it’s really you first.

Depending on where you live (for example California, the EU or the UK), you may have additional rights, such as objecting to or restricting some uses of your data, and complaining to your local data protection authority. We won’t treat you differently for using these rights.

We protect your data with encryption in transit, access controls that limit each account to its own data, and private storage for your videos, which are shared through short-lived links. No online service is perfectly secure, so please use a secure email account and tell us right away if you notice anything unusual.

XstreamAI is for adults. We don’t knowingly let anyone under 18 create an account, and we don’t knowingly collect personal information from children under 13. Kidpreneurs projects are made by a parent, guardian or teacher, who should only include what a project needs about a child. If you believe a child has given us personal information, email us and we’ll delete it.

We and our providers process data in the United States and other countries. When information is transferred from your country, we rely on our providers’ safeguards, such as standard contractual clauses, to protect it.

If we change this policy we’ll update the effective date above, and tell you by email or in the app before any significant change takes effect.

For privacy questions or requests, email [support email: add before launch]. XstreamAI is operated by Christian Nicoletti.