Legal
Privacy Policy
Effective 6 November 2026
Xakto is a Chrome extension for inspecting, editing and checking web pages, made by Kennedi Avelino ("we", "us"), Mount Wellington, Auckland 1060, New Zealand. This policy says what Xakto reads, what it keeps, and when anything leaves your computer. The Privacy page in the docs says the same in plainer words, with each permission Xakto asks Chrome for.
The short version
- What you look at and change is never sent to us. Xakto reads pages in your browser and keeps what it makes on your computer.
- The free plan needs no account, and on it nothing about you reaches us.
- Paid plans need an account: we keep its email address, your plan, and the browsers it's used in. Paddle, our reseller, handles payment.
- We don't use analytics, advertising or tracking cookies, in the extension or on xakto.app.
- A few things leave your browser, each only when you ask. They're listed below.
What Xakto reads
On a tab you switch it on in, Xakto reads the page's structure, text, computed styles, colours, fonts and images. It needs them to show measurements, spacing and typography, write CSS and component code, take screenshots, check the page, and describe the site's design system.
The broad site access the extension asks for lets it work on any page you point it at. It doesn't read every page you visit: Xakto's code goes into a tab only when you switch it on there.
What Xakto keeps on your computer
All of this stays in your browser's extension storage. Web pages can't read it.
- Settings: theme, selection depth, rulers, the open mode, which tabs Xakto is on, and whether its panel was closed. Kept until you remove the extension.
- The coding-agent pairing token, and whether that feature is on. Kept until you remove the extension. It's shown only in Xakto's Settings and never given to the page.
- Your edits to a page. Kept until the browser closes, removed when the tab closes, and can be forgotten from the panel.
- Usability checks: each checked page's last findings and how many findings each of up to ten checks found, for the 100 pages checked most recently; and, for each site, your decisions on findings and your ticks on the criteria checked by hand. Kept until you remove the extension.
- Your own findings and annotations, each with a small picture of the spot or element it's about. Kept until you remove the extension or delete them.
- Finding numbers for each site (such as A11Y-004), so a finding keeps its name between checks.
- Printable reports: the last few you opened, until the browser closes.
- On the free plan, the pages used this month: the addresses of the pages you checked and whose design system you read, so the monthly allowance of two of each can be counted. Replaced each month, and never sent anywhere.
- On a paid plan: a random install ID for this browser, your signed plan pass, and when it was last renewed (see Accounts, below).
When anything leaves your browser
- Exporting, cloning or saving fetches the page's own images, stylesheets, fonts and icon files again, from where the page loaded them. Icon files from the same site are fetched with that site's cookies, as the page itself would.
- A full site scan (a paid feature) reads up to 40 pages of the site you're on, and its robots.txt and sitemaps, in hidden frames, from that site only. It skips addresses that look like signing out, deleting, paying or changing an account, and anything robots.txt rules out. It runs only when you start it.
- The usability check loads the page you're on once more, in a hidden frame 320 pixels wide, to test reflow. It skips addresses carrying a one-time code, such as a sign-in link. Responsive mode also loads the page again, in its own frame. The checking engine, axe-core, ships inside Xakto.
- Connecting a coding agent is off until you switch it on. Then Xakto answers a relay program running on your own computer (at 127.0.0.1), and, when your agent asks, gives it information about the one tab Xakto is on: your edits, the selection and its clone, matching elements, the design system, the check's findings, pinned notes, or a screenshot. Your agent may send these to its own model provider under that provider's terms. Xakto sends them nowhere else.
- Help and feedback: Help's links open pages on xakto.app; Send feedback and Contact support open an email to [email protected] in your own email app, which you choose to send.
- Signing in and renewing a paid plan, described next.
Xakto also copies text and images to your clipboard when you press its copy buttons.
Accounts and paid plans
You need an account only for a paid plan. For it we keep:
| What | Why | Kept |
|---|---|---|
| Your email address | To sign you in and to reach you about your account | While the account exists |
| Your plan, its status and renewal date | To know whether Pro is on | While the account exists, then as tax law requires |
| The browsers you use it in: a random install ID, the browser's name, when it was first and last seen | To keep the plan to three browsers, and to let you remove one | Until you remove the browser, or 90 days after it was last seen |
| Records of payment events from Paddle (no card details) | To turn your plan on, renew it or end it | As tax and accounting law requires |
To keep your plan on, Xakto renews this browser's plan pass with our server about once a day while you use it, sending its install ID and the pass. It doesn't send what you inspect, edit or check. If renewal can't get through, the pass keeps working offline for a while.
Signing in uses a 6-digit code sent to your email, or Google if you choose it, through Chrome's own sign-in window. With Google we receive only your email address, and use it only to sign you in. Sign-in and the account database are run for us by Supabase.
Payments
Paddle.com is our reseller and Merchant of Record: you buy from Paddle, which handles payment, tax, receipts and refunds under its own privacy notice. We never see your card details. Paddle tells us your email address, country, what you bought, and when it renews, is cancelled or refunded.
The website
xakto.app has no analytics, advertising or tracking cookies. It is served by Cloudflare, which processes each request's address, browser, page and time to deliver and protect the site. We don't keep logs of visits.
Email from us
We email you only about your account: sign-in codes, and important changes to your plan or these terms. Sign-in codes come from [email protected], sent for us by Resend. Paddle sends receipts and renewal notices. We don't send newsletters or product news.
Who we share with
We don't sell or rent personal information, or share it for advertising. We share it only with the service providers who run Xakto for us, under contract, and only what each needs:
| Provider | What it does | What it receives |
|---|---|---|
| Paddle | Payment, tax, receipts, refunds | What you give at checkout |
| Supabase | Sign-in and the account database | Your email address, plan and browsers |
| Resend | Sends your sign-in codes | Your email address and the code |
| Cloudflare | Serves the website | Each request's address, browser, page and time |
We may also disclose information if the law requires it, or to protect our rights or someone's safety.
Xakto's handling of information it reads in your browser follows the Chrome Web Store User Data Policy, including its Limited Use requirements. Information from Google sign-in is used only to sign you in.
Why we may use your information
Where data protection law (such as the GDPR) asks for a legal basis: account and payment information, to perform our contract with you; browser records and request data, for our legitimate interest in keeping plans to their terms and our services secure; tax records, a legal obligation.
Your rights
By writing to [email protected], you can:
- see the personal information we hold about you, and get a copy;
- correct it, including changing your email address;
- delete your account and the information that goes with it, except what tax law makes us keep;
- object to or restrict how we use it.
We answer within 30 days. You can also complain to your data protection authority; in New Zealand, the Privacy Commissioner. Information that never leaves your computer (everything in "What Xakto keeps on your computer") is under your control alone: removing the extension deletes it.
Where information is stored
Our providers may process information in countries other than yours, including the United States, the United Kingdom and countries in the European Union. Where the law requires it, we use safeguards such as the European Commission's standard contractual clauses.
Security
Account data travels encrypted and is stored with providers who protect it. We don't keep passwords: signing in uses a one-time code or Google. Your plan pass is signed, so it can't be altered or moved to another browser.
Children
Xakto is a tool for people who build websites, and is not directed at children under 16. We don't knowingly collect information from them.
Changes to this policy
If what Xakto reads, keeps or sends changes, this policy changes first, with a new effective date. If a change matters, we tell account holders by email before it takes effect.
Contact
[email protected] · Kennedi Avelino, Mount Wellington, Auckland 1060, New Zealand