Privacy Policy

Last updated: 12 November 2026

Who we are

xRay is made by Impaktfull BV, Oudesteenweg 51 B1103, 2060 Antwerpen, Belgium, company number BE0803678850 (“impaktfull”, “we”). We are the controller of the personal data described on this page.

Questions and requests about your data: [email protected].

This page covers xRay only. You sign in to xRay with your impaktfull account, which is described in the impaktfull account privacy policy. For impaktfull’s website and other services, see the impaktfull privacy policy. How you may use xRay is in the Terms and Conditions.

What xRay does not collect

The xRay SDK runs inside your own Flutter app. What it captures (network calls, logs, stored values, files) goes only to the xRay desktop apps on your network that connect to your app. That data never reaches impaktfull or any other server.

If that data contains personal data of your app’s users, your company is the controller of it and decides how it is used. Use xRay only in development and internal test builds, with test accounts where you can. The Quick Start explains how.

The website (xrayinspector.dev)

• Hosting. The website runs on our server at Hetzner Online GmbH in Germany. Cloudflare, Inc. (USA) sits in front of it to deliver and protect it. Both process your IP address and browser details to deliver the pages; Cloudflare may do so in the USA, under the EU-US Data Privacy Framework. Our server’s access logs, which contain your IP address, are deleted after at most 14 days. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
• Fonts and scripts. The fonts, the cookie banner and the site’s scripts are served from xrayinspector.dev itself. Nothing is loaded from a third party unless you accept analytics.
• Analytics, only with your consent. If you accept analytics cookies, we use Google Analytics 4 (Google Ireland Ltd. and Google LLC) to count visits and see which parts of the site are used: pages viewed, clicks on links and buttons, how far you scroll. Google receives your IP address and device information and may process them in the USA, under the EU-US Data Privacy Framework. We turned off Google signals and ad personalisation, and we never send your email address or other details you type. Google keeps this data for 14 months. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time under Cookie settings at the bottom of every page; the analytics cookies are then deleted. See the Cookie Policy for the cookies themselves.
• Access requests. When you request access to xRay, we store your email address, the date and our decision, to review your request and email you the outcome. Legal basis: steps you ask us to take before using xRay (Art. 6(1)(b) GDPR). We keep the request and our decision until you ask us to delete them, so we recognise a repeat request.

The documentation (docs.page)

The documentation at docs.xrayinspector.dev is hosted on docs.page, run by Invertase Limited, Banks Sheridan, Datum House, Electra Way, Crewe, CW1 6ZF, United Kingdom. To deliver the pages, Invertase processes your IP address and request headers and keeps them in its security logs for up to 90 days. It also counts page views on its own server, without building profiles of visitors. We add no analytics or scripts of our own to the documentation. Invertase describes this in the docs.page privacy policy.

Your xRay account (desktop app and admin portal)

You sign in with your impaktfull account. impaktfull’s sign-in service passes xRay your email address, your name, an account identifier and the link to your impaktfull profile picture. The desktop app loads the picture from the sign-in service itself; xRay keeps the link from your last sign-in, which the admin portal shows. Your impaktfull account itself (sign-in codes, sessions, security logs, connected Google or Microsoft accounts) is described in the impaktfull account privacy policy.

For xRay, we store:

• your email address, name, account identifier and the link to your profile picture;
• when you signed in, on which days you used the desktop app, and from which installations, including when your account moved from one computer to another: the device name set on your computer (often its host name), platform, app version and, for the admin portal, your browser’s user agent;
• whether you have access, your access requests and our decisions;
• which version of the Terms and Conditions you accepted, and when;
• your licenses (which one, from when and until when, and where it came from) and the promo codes you redeemed;
• wrong promo codes you tried: when, from which IP address, and only the first four characters of what you typed;
• the service emails we send you, only until they are sent.

Legal basis: providing xRay to you (Art. 6(1)(b) GDPR) and our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR).

How long we keep it:

• your account, sign-ins, installations and access: until you delete your account;
• access requests and our decisions: until you ask us to delete them;
• licenses and redeemed promo codes: until you delete your account;
• wrong promo codes: 30 days. We use them only to stop people from guessing codes, which is our legitimate interest in keeping the service secure (Art. 6(1)(f) GDPR);
• service emails: not kept; each is removed as soon as it is sent.

A desktop sign-in stays valid for 90 days after you last used the app.

The xRay platform runs on our server at Hetzner Online GmbH in Germany, behind Cloudflare, like the website.

Deleting your account

You can delete your xRay account in the desktop app under Settings → Account → Delete account, or ask us at [email protected]. This deletes your xRay account, installations, sessions and access, and removes your address from our records.

Deleting your xRay account does not delete your impaktfull account, which you may use for other impaktfull products. You delete that one under Profile → GDPR on account.impaktfull.com.

The desktop app

The desktop app does not send analytics or crash reports. It contacts:

• our server (api.xrayinspector.dev) to sign you in, to check your access and to check for updates, sending the version of the app you use;
• impaktfull’s sign-in service (auth.impaktfull.com) when you sign in, and to load your profile picture;
• GitHub (api.github.com and github.com) to show the roadmap and changelog and to download updates, which shows your IP address to GitHub.

What you inspect, export and configure in the app stays on your computer. Settings → Account → Clear local data removes the history the app keeps on your computer.

If you switch on the MCP server (Settings → MCP, off by default), the app serves what you inspect, with your redaction rules applied, to the AI assistant you connect on the same computer. The app itself sends none of it anywhere. Whether the assistant sends it on to its AI provider depends on that assistant, and your company decides whether to use one with your app’s data.

Emails

We only send service emails, such as the decision on your access request, a reminder before your license ends, and notifications to our admins, through Brevo (Sendinblue SAS, France). We do not send marketing emails.

Who receives personal data

• Hetzner Online GmbH (Germany): our server, for the website and the xRay platform;
• Cloudflare, Inc. (USA): delivering and protecting the website and the xRay platform;
• Brevo (Sendinblue SAS, France): service emails;
• Google: website analytics, only with your consent;
• GitHub, Inc. (USA): the roadmap, the changelog and app downloads;
• Invertase Limited (United Kingdom): documentation hosting on docs.page.

Sign-in runs on impaktfull’s own sign-in service, so your sign-in data stays with impaktfull.

We do not sell personal data. Where data leaves the European Economic Area, the transfer relies on an adequacy decision (such as the EU-US Data Privacy Framework, or the one for the United Kingdom) or, as a fallback, the European Commission’s standard contractual clauses.

Your rights

You can ask us for access to your data, to correct or delete it, to restrict its processing, or for a copy to take elsewhere, and you can object to processing based on our legitimate interest. Email [email protected]; we answer within one month.

You can also lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.

Children

xRay is a tool for developers and is not meant for children under 16.

Changes

When we change this policy, we publish the new version on this page with a new date.