X-Filer
Download

Privacy Policy

Last updated

X-Filer is a desktop app for Windows and macOS: a file manager with cloud drives built in and a view of the projects your AI agent works on. This policy covers the app and this website, x-filer.com. "We" means the developer of X-Filer.

The short version

  • X-Filer has no servers of its own and no user accounts. Your files, settings and sign-in tokens stay on your device.
  • The app sends anonymous usage statistics and crash reports only if you allow it, and you can turn them off at any time. The website has no analytics and sets no cookies.
  • When you connect a cloud drive or a server, X-Filer talks to it directly from your device. Nothing passes through us.
  • We do not sell, rent or share your data, and we do not use it for advertising or to train AI models.

What stays on your device

  • Settings — tabs, Spaces, preferences and the list of drives you connected, in the app's own folder.
  • Sign-in tokens, passwords and keys for cloud drives, servers and GitHub — in the macOS Keychain on a Mac, encrypted with Windows Data Protection (DPAPI) on Windows. Removing a drive in X-Filer deletes them.
  • Logs — a local log file for troubleshooting. It is never sent anywhere; you can attach it to a bug report yourself if you want to.
  • Downloaded files — a cloud file you open or copy is downloaded to your device, as with any file manager.

Connections the app makes

X-Filer connects to the internet only for these:

  • Cloud drives you connect — Google Drive, Yandex Disk. The app sends requests to the service's API to list, open, upload, move, rename and delete files when you ask it to.
  • Servers and storage you connect — SFTP, FTP, WebDAV, S3-compatible storage, SMB network folders — at the addresses you enter, for the same actions. iCloud Drive and WSL are folders on your device; the system handles their connections.
  • GitHub, if you sign in to work with a project hosted on GitHub. The app reads and writes that repository on your behalf.
  • Update check — the app looks for new versions in the public releases of XFiler-Community/XFiler on GitHub and downloads the update from there.
  • Usage statistics and crash reports, only if you allowed them — see the next section.

Each of these services receives your IP address and the requests the app makes, and handles them under its own privacy policy: Google, Yandex, GitHub. A server or storage you connect yourself is run by you or your provider, under their rules.

Usage statistics and crash reports

They are off until you say yes. Once, X-Filer asks in a small card whether to send anonymous usage statistics and crash reports; you can change your answer at any time in Settings → General. Turning them off stops sending at once and deletes crash reports that have not been sent yet.

  • Usage statistics go to Amplitude. They are a few events — the app was installed or opened, a drive or a project was connected, a folder was opened, a quick preview or a file operation was used for the first time in a session — with the type of drive (for example "sftp") or operation (for example "rename"). Each event carries a random install id made on your device, the app version, the operating system and its version, the processor architecture and the interface language. Never file names, paths, folder or drive names, server addresses, accounts or tokens.
  • Crash reports go to Sentry. When the app crashes or hits an error, the report carries the error, where in the app's code it happened, the last steps the app logged (their message templates, not the values), the app version, the operating system, the processor architecture and the interface language. Your home folder in any path is replaced with ~, so your user name is not in it; the computer name, user name, email and IP address are removed before sending. The text of an error may still name the file it happened on.

We use them only to find bugs and to see whether people get as far as connecting a drive or a project. We do not combine them with other data, sell them or use them for advertising. Amplitude and Sentry receive your IP address when the app connects to them.

Google user data

This section describes how X-Filer accesses, uses, stores and shares data from your Google account when you connect Google Drive.

What X-Filer accesses

When you add Google Drive, Google asks you to allow X-Filer to see, edit, create and delete your Google Drive files (the https://www.googleapis.com/auth/drive scope). With that permission X-Filer reads:

  • the names, folders, sizes, dates and other metadata of your Drive files, to show them like a local disk;
  • the contents of files you open, copy, move or download;
  • the version history of files in a project folder on Drive, to show what changed since your last visit and restore an earlier version;
  • the email address of your Drive account, to label the connected drive and tell several accounts apart.

X-Filer needs access to your whole Drive because it is a file manager: you browse any folder, and every file you see can be opened, renamed, moved or deleted. A narrower permission would only show files X-Filer created itself.

How X-Filer uses it

Only to show your Google Drive in X-Filer and to carry out the actions you take in the app — browsing, opening, uploading, downloading, copying, moving, renaming, deleting and restoring files. X-Filer does not change anything on your Drive unless you ask it to.

How it is stored

Google user data is stored only on your device. The sign-in token is kept in the macOS Keychain or encrypted with Windows DPAPI. Files you open are downloaded to your device. Nothing is stored on servers run by us — we have none.

Sharing

We do not receive your Google user data, so we do not share, transfer or disclose it to anyone. It travels only between your device and Google. We do not sell it, use it for advertising, use it to develop, improve or train generalized AI or machine learning models, and no person reads it.

Limited Use

X-Filer's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access and deleting data

  • Remove the drive in X-Filer: the app deletes its token from your device and stops accessing your Drive.
  • Revoke access at any time on your Google account's permissions page.
  • Files X-Filer downloaded stay where you saved them; delete them like any other file.

This website

x-filer.com is a static site. It has no analytics, no trackers, no sign-in and sets no cookies. Our hosting provider keeps standard server logs (IP address, requested page, browser) for security and operation. Download links lead to GitHub, where GitHub's privacy policy applies.

Email

If you write to us, we keep your message and email address to reply and to follow up on your request. We do not add you to any mailing list.

Children

X-Filer is not directed at children under 13, and we do not knowingly collect their data.

Changes

When this policy changes, we update the date at the top and, for significant changes, say so in the release notes.

Contact

Questions about privacy: hello@x-filer.com.