Privacy Policy

§1 What This Covers

This policy describes how SlackXO ("we," "us") collects, uses, and stores information when you install the SlackXO app, use the SlackXO dashboard, or interact with our website.

§2 Information We Collect From Slack

When you install SlackXO and grant it access, we collect and store:

• Messages, threads, and files from the channels the app has been invited to, and from direct messages sent to the app itself. Slack does not make direct messages between other people available to apps, so those are not collected.
• Basic workspace member information (name, user ID) used to attribute messages when displaying search results and exports
• Channel and workspace metadata (channel names, IDs, workspace name)

We only access what Slack's API scopes permit, and only for content the app has been explicitly invited into.

§3 Information We Collect Directly

• Account and billing information (for Hosted plan subscribers), processed through our payment provider — we do not store full payment card numbers ourselves
• Usage and audit log data — every backup, search, export, and restore action is logged with a timestamp, for the tamper-evident audit trail feature itself
• Website analytics and advertising measurement on our marketing website (slackxo.com) via Google Analytics and the LinkedIn Insight Tag, which use cookies and similar technologies to collect page-visit information. These tools are not loaded in the SlackXO dashboard and never receive archived Slack content.

§4 How We Use This Information

• To provide the archiving, search, litigation hold, and restore functionality you've signed up for
• To maintain the tamper-evident audit trail that is core to the product
• To process billing for Hosted plan subscriptions
• To communicate with you about your account, service changes, or support requests

We do not sell archived Slack content, or any personal information collected through the product, to third parties.

§5 Where Your Data Is Stored

Hosted plan: archived data is stored on Railway, a U.S.-based cloud hosting platform — workspace metadata in a managed Postgres database, and archived Slack content on persistent storage attached to our application server. Archived messages, attachments, and stored credentials are encrypted at rest, and access is protected by workspace-scoped isolation.

Self-Hosted plan: your archived data never leaves infrastructure you control. We do not have access to it.

§6 Third-Party Services

We rely on the following third parties to operate SlackXO:

• Slack — for the API access that makes archiving possible. Your use of Slack is separately governed by Slack's own privacy policy.
• Stripe — for payment processing on the Hosted plan. We do not store your card details directly.
• Google Analytics and LinkedIn — website analytics and advertising measurement on our marketing website only, as described in §3.
• Railway — for infrastructure hosting the Hosted plan (application server, database, and persistent storage), located in the United States.

§7 Data Retention

Archived Slack content is retained according to the retention period you configure, or indefinitely if placed on litigation hold. Upon account cancellation, your data remains accessible — you can still log in, search, and export — for 90 days, after which it is permanently deleted.

§8 Your Rights and Choices

You can export your archived data at any time via the Search Archive feature. You can place or remove litigation holds. You can uninstall the app from Slack at any time, which revokes our access to new data going forward. After cancellation, your data is deleted after 90 days.

To request access to, correction of, or earlier deletion of your data, email hello@slackxo.com. We'll respond within 30 days. Archived Slack content belongs to the workspace that installed SlackXO, and we process it on that workspace's behalf, so requests about individual messages may need to be directed to the workspace administrator.

§9 Security

Slack access tokens, archived messages, and downloaded attachments are encrypted at rest. Every search, export, backup, and restore action is logged to a hash-chained audit trail, so unauthorized alterations to that log are detectable. Hosted-plan infrastructure runs on Railway, with workspace data isolated by account in our database.

§10 Changes to This Policy

We may update this policy from time to time. For material changes, we will email the workspace administrator and post a notice in the dashboard at least 14 days before the changes take effect.

§11 Contact

Questions about this policy or your data: hello@slackxo.com