Privacy Policy

§1 What This Covers

This policy describes how SlackXO ("we," "us") collects, uses, and stores information when you install the SlackXO app, use the SlackXO dashboard, or interact with our website.

§2 Information We Collect From Slack

When you install SlackXO and grant it access, we collect and store:

• Messages, threads, and files from channels and direct messages the app has been added to
• Basic workspace member information (name, user ID) used to attribute messages when displaying search results and exports
• Channel and workspace metadata (channel names, IDs, workspace name)

We only access what Slack's API scopes permit, and only for content the app has been explicitly invited into.

§3 Information We Collect Directly

• Account and billing information (for Hosted plan subscribers), processed through our payment provider — we do not store full payment card numbers ourselves
• Usage and audit log data — every backup, search, export, and restore action is logged with a timestamp, for the tamper-evident audit trail feature itself
• Basic website analytics via Google Analytics

§4 How We Use This Information

• To provide the archiving, search, litigation hold, and restore functionality you've signed up for
• To maintain the tamper-evident audit trail that is core to the product
• To process billing for Hosted plan subscriptions
• To communicate with you about your account, service changes, or support requests

We do not sell archived Slack content, or any personal information collected through the product, to third parties.

§5 Where Your Data Is Stored

Hosted plan: archived data is stored on Railway, a U.S.-based cloud hosting platform — workspace metadata in a managed Postgres database, and archived Slack content on persistent storage attached to our application server. Access is protected by encryption of stored credentials and workspace-scoped isolation in our database.

Self-Hosted plan: your archived data never leaves infrastructure you control. We do not have access to it.

§6 Third-Party Services

We rely on the following third parties to operate SlackXO:

• Slack — for the API access that makes archiving possible. Your use of Slack is separately governed by Slack's own privacy policy.
• Stripe — for payment processing on the Hosted plan. We do not store your card details directly.
• Railway — for infrastructure hosting the Hosted plan (application server, database, and persistent storage), located in the United States.

§7 Data Retention

Archived Slack content is retained according to the retention period you configure, or indefinitely if placed on litigation hold. Upon account cancellation, your data remains accessible — you can still log in, search, and export — for 90 days, after which it is permanently deleted.

§8 Your Rights and Choices

You can export your archived data at any time via the Search Archive feature. You can place or remove litigation holds. You can uninstall the app from Slack at any time, which revokes our access to new data going forward. [Insert any additional rights relevant to your jurisdiction — access, deletion, correction requests, etc.]

§9 Security

Slack access tokens are encrypted at rest. Every search, export, backup, and restore action is logged to a hash-chained audit trail, so unauthorized alterations to that log are detectable. Hosted-plan infrastructure runs on Railway, with workspace data isolated by account in our database.

§10 Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email.

§11 Contact

Questions about this policy or your data: hello@slackxo.com