Privacy Policy

This policy applies to XubaoClub (出海寻宝社). Updated October 23, 2026.

When you sign in with Google, we receive your Google account identifier, name, email address and profile picture to create and identify your account. We request basic identity information, without access to your Gmail, Google Drive or contacts. Sessions may also record your IP address, browser information and information needed for security.

Private research

Research settings, reference terms, target markets, experience summaries, search history and results that you choose to save are stored in a Cloudflare database with access restricted by account. Search history and deduplication terms are retained for 90 days, then deleted during scheduled cleanup or workspace access. The interface currently shows the latest 10 searches. Private records are not automatically published in the public editorial reports.

Research notes and keywords collected directly into projects share a 500-record allowance; references to the same note are not counted twice, and the built-in example is excluded. Notes, projects, intent groups and page plans are stored by account in Cloudflare, with a 4 MiB text allowance. They remain until you delete them and are not subject to the 90-day search-history cleanup. Sign in on another device to read the saved version, or export JSON backups and page-plan CSV files.

Browsers retain account-specific cached data and pending drafts. Existing local data is uploaded when the cloud workspace is empty. Updates on both sides require a merge that keeps conflicting records as copies. Connection or save failures display a pending status. Clearing browser data may remove drafts that have not uploaded; saved cloud versions remain available. Image and PDF attachment uploads are disabled. txt / md imports extract experience summaries only, up to 8,000 characters.

xAI API keys and search requests

You may provide your own xAI API key. The server encrypts the stored key; normal API responses and browser storage do not expose its plaintext value. Encryption cannot eliminate every security risk. Do not place keys in notes or public content.

The server calls xAI using your key only when you deliberately start a private search. Requests include your research direction, reference terms, market, experience summary, selected sources and known terms for deduplication. Do not include sensitive information that you do not want the model provider to process. Requests are configured not to store responses with xAI; its processing remains subject to its own policies.

Single-keyword assessments send only the keyword and the market and language you specify, without your experience summary or other notes. You can save the returned sources and page proposal to your research workspace.

Agents you connect

You may create a personal MCP credential valid for 90 days to let your chosen Agent read and write your research notes, website projects and page drafts. This connection does not return your Grok key, account profile or private search history and cannot start paid searches. The credential is shown once at creation and can be revoked in the workspace.

Your chosen Agent and its provider may process the research data it reads under their own data policies. Revocation blocks future access but does not delete copies already obtained. You also decide whether to send copied research tasks or results to another AI service.

Providers and essential storage

Cloudflare provides hosting, databases and related infrastructure.
Google provides authentication when you choose Google sign-in.
xAI processes requests when you deliberately start a private search.
Cookies or local storage support sign-in and saved preferences. Advertising, visitor analytics and newsletter features are not currently enabled.

Retention, access and deletion

We retain information needed to provide accounts, research history and security features. You can manage settings, keys, notes and projects in the workspace; deletions sync after a successful cloud save. Manage device caches and exported backups separately. To request access, correction or deletion of account information, contact the address below. We will verify your identity and explain any information retained for security, backups or applicable requirements.

Updates and contact