Privacy Policy

Xtok Inc. (“Company,” “we,” “us”) operates the Goxi platform. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our Service. We are committed to transparency and to protecting your data.

By using Goxi, you consent to the practices described in this Policy. If you do not agree, please discontinue use of the Service.

Information You Provide

• Account details — name, email address, payment information.
• Content you upload — videos, images, scripts, brand assets.
• Workspace settings — preferences, integration configurations, team roles.
• Communications — support requests, feedback, survey responses.

Information Collected Automatically

• Device data — browser type, operating system, IP address.
• Usage data — features used, Crew interactions, content generated, session duration.
• Analytics — performance metrics, error logs, aggregated usage patterns.

Information from Third Parties

When you connect third-party platforms (YouTube, Instagram, TikTok, Slack, etc.), we receive data authorized through those integrations, such as channel analytics, engagement metrics, and content metadata.

YouTube API Services

When you connect your YouTube channel, you authorize Goxi, through Google OAuth, to access your channel’s data using the YouTube Data API and the YouTube Analytics API. This includes your own channel and video information and the private channel analytics available to you as the owner, such as impressions, click-through rate, watch time, audience retention, audience demographics, and traffic sources. We request read-only access and never post, edit, delete, upload, or manage anything on your account. We use this data only to show your own analytics back to you inside your Goxi Workspace. You can disconnect at any time in your settings, or revoke access at myaccount.google.com/permissions; when you disconnect we delete the associated access and refresh tokens.

Goxi’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Our use of YouTube API Services is also subject to the YouTube API Services Terms of Service and the Google Privacy Policy.

• Service Delivery — operating your Workspace, running Crew agents, processing and distributing content.
• Improvement — analyzing usage patterns to enhance features, train models, and improve content quality.
• Communication — sending account notices, product updates, and responding to support requests.
• Security — detecting fraud, preventing abuse, and protecting the integrity of the Service.
• Legal Compliance — fulfilling legal obligations and responding to lawful requests.

We do not sell your personal information. We may share data with:

• Service Providers — cloud hosting, payment processing, analytics, and AI model providers who process data on our behalf under contractual obligations.
• Third-Party Integrations — platforms you explicitly connect to your Workspace (YouTube, Instagram, TikTok, Slack, etc.).
• Legal Requirements — when required by law, subpoena, or government request.
• Business Transfers — in connection with a merger, acquisition, or sale of assets, with notice to you.

We retain your data for as long as your account is active and as needed to provide the Service. After account termination, we retain data for up to 30 days before permanent deletion, unless longer retention is required by law or necessary to resolve disputes.

Aggregated, anonymized data that cannot identify you may be retained indefinitely for analytics and service improvement.

We use cookies and similar technologies for authentication, preferences, analytics, and security. You can manage cookie preferences through your browser settings. Disabling certain cookies may limit Service functionality.

We use analytics providers to understand how users interact with the Service. These tools may collect information sent by your browser, including page views and feature usage.

We implement industry-standard measures to protect your data, including encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, regular security audits, and incident response procedures.

No method of transmission or storage is 100% secure. If you become aware of a security vulnerability, please report it to security@goxi.ai.

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of your personal data.
• Correction — update inaccurate or incomplete data.
• Deletion — request removal of your personal data.
• Portability — receive your data in a structured, machine-readable format.
• Opt-Out — unsubscribe from marketing communications at any time.
• Restriction — limit certain processing of your data (GDPR).

To exercise any of these rights, contact us at privacy@goxi.ai. We will respond within 30 days. California residents have additional rights under the CCPA, including the right to know what data is collected and the right to opt out of data sales (we do not sell data).

Your data may be transferred to and processed in the United States or other countries where our service providers operate. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) for transfers from the EEA/UK.

Goxi is not directed to children under 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a child, we will promptly delete it. If you believe a child has provided us with personal data, please contact privacy@goxi.ai.

Goxi uses AI models to process your content and generate outputs. Your User Content may be used to improve the quality and relevance of AI outputs within your Workspace. We do not use your content to train general-purpose AI models shared with other customers without your explicit consent.

AI processing is integral to the Service. If you have concerns about how your data is used for AI purposes, please contact our Data Protection Officer at dpo@goxi.ai.

Goxi uses the YouTube Data API v3 to power free creator analytics reports available at goxi.ai/report/youtube/@{handle}. Our use of YouTube API Services is subject to the YouTube API Services Terms of Service.

What Data We Access

• Channel metadata — name, description, subscriber count, topic categories, and keywords set by the channel owner.
• Video statistics — view count, like count, comment count, and video duration.
• Video metadata — titles, descriptions, tags, and publish dates.
• Playlist data — upload playlist to retrieve a channel’s video IDs.
• Search results — to identify similar channels and trending content in a creator’s niche.
• Comment threads — to analyze audience sentiment on public videos (public data only).

How We Use This Data

• We only access publicly available channel and video data — the same information visible to any visitor on YouTube.
• We generate creator analytics reports showing content performance patterns, niche benchmarking, and video idea suggestions.
• All data displayed in reports links back to the original YouTube content. We do not replicate YouTube’s video player or create an alternative viewing experience.
• We do not download, store, or redistribute raw video or audio content.
• We cache YouTube API responses for up to 24 hours to minimize redundant requests and respect API quota limits.
• We display YouTube branding in accordance with YouTube’s Brand Guidelines.
• We do not sell or share YouTube API data with third parties beyond what is necessary to operate the Service.

Creator Consent & OAuth Access

Free channel reports are generated from publicly available YouTube data. No login or authorization is required to generate a free report — creators who discover a report about their channel have not been scraped; only public data is used.

Creators who choose to unlock the Full Report connect their channel via Google OAuth, which grants Goxi access to private YouTube Analytics data (audience retention, CTR, revenue, demographics). This access is voluntary, explicitly authorized by the creator, and scoped only to the permissions they approve.

Revoking Access

You may revoke Goxi’s OAuth access to your YouTube channel at any time through your Google Account Security Settings. Upon revocation, we will delete all associated private analytics data within 30 days.

Google’s Privacy Policy applies to data accessed via YouTube API Services: policies.google.com/privacy.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-product notice at least 15 days before they take effect. The “Last updated” date at the top reflects the most recent revision.

If you have questions about this Privacy Policy or how we handle your data:

Xtok, Inc.
Privacy: privacy@goxi.ai
DPO: dpo@goxi.ai
Support: support@goxi.ai
Website: goxi.ai