XiaPlay is operated under the 91 Agent brand ("XiaPlay," "we," "us," or "our"). This Policy explains how we collect, use, store, share, and protect personal information when you use the XiaPlay website, desktop application, account system, and related services.
For questions about this Policy or our data practices, or to exercise your privacy rights, contact support@91agent.tech.
1. Scope
This Policy applies to the XiaPlay website, desktop application, account sign-in, subscriptions, and related cloud services. Third-party models, messaging platforms, plugins, skills, or websites that you connect are governed by their own privacy policies.
2. Information We Collect
Google Sign-In information
When you choose “Sign in with Google,” we request only the openid, email, and profile scopes. We may receive and store:
- your Google Account's unique identifier;
- your email address and email verification status;
- your display name and profile picture.
We use this information only to create or identify your XiaPlay account, complete sign-in, display basic account information, maintain login security, and provide customer support. Google Sign-In does not give us access to your Gmail, Google Drive, contacts, calendar, or Google Account password.
The Google access token is used transiently during sign-in to retrieve the basic profile described above. Our current basic sign-in flow does not retain that access token as a long-term credential.
Account and service information
We may process your XiaPlay account identifier, sign-in method, plan and entitlements, login time, sessions, support requests, and security-related information such as IP address, device type, operating system version, and application version.
Local data and content you submit
XiaPlay conversations, memories, workspace settings, model keys, and some runtime data are stored on your device by default. If you enable cloud models, synchronization, remote collaboration, messaging channels, or other third-party capabilities, information needed to perform your request may be sent to the relevant service at your direction.
Payment and subscription information
If you purchase a paid plan, we may process the order number, plan, amount, payment status, and transaction time. Full payment instrument details are generally processed directly by payment providers; we do not store full card numbers.
3. How We Use Information
- create accounts, verify identity, and maintain signed-in sessions;
- provide XiaPlay features, subscription entitlements, and customer support;
- protect account, service, and payment security and detect fraud or abuse;
- troubleshoot issues and improve performance and user experience;
- comply with legal obligations and lawful requests.
We do not sell Google user data or use it for advertising. Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.
4. How We Share Information
We share limited information only when necessary:
- with cloud hosting, email, payment, security, or support providers that are bound by confidentiality and security obligations;
- at your direction, with model providers, messaging platforms, skills, or other third parties needed to perform your request;
- to comply with law, court orders, or lawful government requests, or to protect the rights and safety of users and the public;
- as part of a merger, acquisition, or asset transfer, subject to reasonable safeguards and legally required notice.
5. Storage and Retention
Local data generally remains on your device until you delete it through the product or operating system. Account and basic Google profile information is retained for as long as necessary to provide the account service. After you request account deletion, we delete or de-identify personal information that is no longer needed within a reasonable period, except transaction, security, and dispute records that must be retained by law. Residual backup copies are removed through our backup rotation cycle.
Because we use international infrastructure and service providers, information may be processed outside your country or region. We use safeguards required by applicable law.
6. Security
We use transport encryption, access controls, least-privilege practices, credential isolation, logging, and other reasonable safeguards. No network or storage system can be guaranteed completely secure. If a security incident requires notification, we will respond and notify affected users as required by applicable law.
7. Your Choices and Rights
Depending on applicable law, you may request access, correction, export, deletion, or restriction of your personal information, object to certain processing, or withdraw consent. Send requests to support@91agent.tech. We may need to verify your identity.
You can revoke XiaPlay's Google access in your Google Account third-party connections. Revocation prevents future use of that authorization but does not automatically delete your XiaPlay account. Contact us separately to delete your account and associated information.
8. Children
XiaPlay is not directed to children under 13, or a higher minimum age where required by local law. If we learn that we collected a child's information without valid parental consent, we will take reasonable steps to delete it.
9. Policy Updates
We may update this Policy as our product, laws, or data practices change. We will provide notice of material changes through the website, in-product notice, or another appropriate channel and update the date at the top of this page.