Privacy policy
Last updated: 30 October 2026.
This policy explains what personal data XDive collects, why, who else sees it, how long we keep it, and what you can do about it. XDive (https://xdive.dev) is a web-data API for developers and AI agents, operated by Mehdi Sadeghian ("we", "us"). To reach us about anything in this policy, use the contact form.
The short version
- We collect what we need to run your account and the API: your name and email, a hashed password, your API keys (stored hashed), how much you use the service, and the requests you make.
- We do not run advertising or analytics trackers, and we do not sell your data.
- Pages you ask us to fetch are processed to give you the result. You can ask us to keep nothing (
zero_data_retention) or to fetch nothing new (lockdown). - You can delete your account yourself, under Profile in the app.
What we collect
| Data | Why | Notes |
|---|---|---|
| Account: name, email address, password | To create and secure your account | The password is stored only as a bcrypt hash. We cannot read it. |
| Organization: name, members and their roles | To run teams and shared quotas | |
| API keys | To authenticate your requests | Only a hash of each key and its first characters are stored. The full key is shown once, when you create it. |
| Usage: pages fetched, searches, browser seconds, per organization and month | To apply quotas and per-key budgets | |
| Requests and results: the URLs and options you send, and the results of crawls and scrapes you run from your account | To show your history, let you export results, and run schedules and monitors | Standard scrapes keep the URL in the audit log. With zero_data_retention the URL is left out and the page is not cached. |
| Schedules and monitors: URLs, intervals, webhook addresses and signing secrets | To run them for you | Secrets are stored encrypted. |
| Security and audit events: sign-ins, key creation and revocation, settings changes, request IDs | To keep accounts safe and investigate abuse | |
| Technical data: IP address and request headers | To apply rate limits, block abuse and debug problems | |
| Messages you send us through the contact form: name, email, company, message | To reply to you |
We do not knowingly collect special categories of personal data, and the service is not directed at children under 16.
Cookies and local storage
XDive does not set advertising or analytics cookies and loads no third-party tracking scripts. The app keeps your sign-in session, your chosen theme and language, and a few interface preferences in your browser's local storage. Clearing it signs you out.
The websites you ask us to fetch
When you scrape, crawl, map or search, we fetch public web pages on your behalf and return the result. That content belongs to its publishers, and you are responsible for having the right to fetch and use it (see the terms). We respect robots.txt unless you turn that off for a request.
- Cache. Fetched pages are cached for a short time, by default five minutes, so repeated requests are fast and cheap. Some deployments keep a longer-lived cache; it is optional and expires automatically.
- Zero data retention. With
zero_data_retention, the page is kept out of the cache and the response is markedno-store. - Lockdown. With
lockdown, we serve only what is already cached and make no outbound request. - Redaction. With
redact_pii, emails, phone numbers, card numbers, SSNs, IBANs and IP addresses in the returned text are replaced with tokens. - Your history. Results of crawls you run are stored in your organization's history so you can view and export them. They stay until you delete the organization or your account.
Who else handles your data
We use a small number of providers to run the service. Each receives only what its job requires.
| Provider | What it does | What it receives |
|---|---|---|
| Hetzner | Hosts the servers and database | Everything the service stores |
| Cloudflare | DNS and network protection in front of xdive.dev | Web traffic to xdive.dev, including IP addresses |
| Serper | Web search results (Google) | The text of search queries you run, and queries we generate for research |
| Language-model providers, through OpenRouter or an endpoint you configure | AI features: research answers, extraction, summaries | The question and the page text needed to answer it. If you set your own model key, requests go to your provider instead. |
| Residential proxy provider | Reaching sites that block data-centre networks | The address of the page requested, only for organizations an administrator has allowed to use it |
| Apify | LinkedIn and Indeed connectors | The query or URL of the connector request, only if you use a connector |
| Email delivery (when enabled) | Verification, password-reset and notification emails | Your email address and the message |
| Stripe (when paid plans are enabled) | Payments | Billing details you enter on Stripe's pages. We never see or store card numbers. |
XDive does not take payments today. We do not sell personal data or share it for advertising. We may disclose data if the law requires it or to protect the service and its users.
How long we keep data
- Account and organization data: until you delete the account. Deleting your account removes it, and removes organizations you solely own together with their keys, history, schedules and monitors.
- Cached pages: minutes by default, or the optional longer window an operator sets, then they expire automatically.
- Idempotency records, sign-in device codes and OAuth client records: short-lived, and cleared automatically.
- Audit log: kept with the organization it belongs to, until that organization is deleted.
- Backups: we take a copy of the database before each software release so we can roll back. These copies are kept for a limited time, so deleted data can remain in a backup until it is replaced.
- Contact messages: until we have answered and no longer need them.
Your choices and rights
- See and change your name and email under Profile.
- Export the results of any crawl from its page in the app or through the API.
- Delete your account under Profile. This is immediate and cannot be undone.
- Revoke API keys, and connected apps such as AI assistants, under API Keys.
If you are in the European Economic Area, the United Kingdom or another place with data-protection law, you may also have the right to access, correct, delete, restrict or object to our use of your personal data, to receive it in a portable format, and to complain to your local data-protection authority. Use the contact form and we will respond within a month.
Security
Connections use HTTPS. Passwords are hashed, API keys are stored hashed, and webhook, connector and browser-profile secrets are encrypted at rest. Requests that fetch pages are protected against reaching private networks. No system is perfectly secure; if you find a vulnerability, please tell us through the contact form before disclosing it.
Changes to this policy
When we change this policy we update the date above, and for significant changes we will tell account holders by email or in the app.