Last updated: October 15, 2026
This Privacy Policy explains what information is collected when you use khashayaryaghma.ir and its related products — including XerxesAI (at xerxesai.khashayaryaghma.ir) — how we use it, who we share it with, and what control you have over it. These websites are built and operated by me, Khashayar Yaghma. All of these products share a single sign-in and account system, and this policy also governs any other website or product launched in the future using this same system; if a new product collects a materially new type of information, this policy will be updated and the “Last updated” date will change accordingly. By using these services, you agree to this policy.
Account information: the only sign-in method is Google; in that case we receive your name, email address, and profile picture from Google. We never receive or store a password from you. To keep you signed in, technical sign-in data (such as your Google account identifier and the technical tokens issued during sign-in) is also kept in the database.
Conversations on XerxesAI: the text of your messages and the replies, their timestamps, and the conversation title (created from the beginning of your first message) are stored so that you can access your history later.
Memory on XerxesAI: to personalize answers across all your chats, XerxesAI can keep a short list of lasting facts you tell it about yourself (for example your name, field of work, or preferred answer style) — a couple of dozen short notes at most. A note is only saved when you state it in your own message or ask XerxesAI to remember it; passwords and keys, contact details, links, ID and card numbers, and details about health, religion, politics, sexuality, ethnicity or money are filtered out and not saved. The notes belong to your account, and you can view, delete, or switch off memory at any time (see sections 7 and 8). To decide whether a message holds something worth remembering, a simple automatic check runs on it first; for some messages the AI model service (Groq) also reads that message together with your current notes (see section 3). A short counter of how many such checks were made each day is kept to enforce a daily limit.
Images: only images (JPEG, PNG, and WebP) can be attached. Before being stored, each image is resized and re-encoded, and its embedded metadata (such as the location recorded in a photo) is removed; the file name and size are recorded as well. Images that XerxesAI creates for you are retained in the same way as your attachments.
Voice messages: your recording is sent to a speech-recognition service solely to be converted to text, and the audio file is not stored on our servers; only the resulting text is returned to you. If you send that text, it is stored like any other message.
Usage counts: to enforce the daily message and image limits, usage is counted from those same stored messages and images. For voice messages, a short counter record is kept instead — only the time of each transcription and the length of the audio in seconds, with no audio and no text — and it is deleted automatically after 2 days (or together with your account).
Subscription and enrollment information: the account system is able to hold subscription and course-enrollment status (including plan type, active/canceled status, and expiration date); however, no online purchases or paid subscriptions are currently enabled on these sites.
Payment information: if online payment is introduced in the future, transactions will be processed through a licensed bank payment gateway; we will never see or store your card number or one-time password, only the transaction result and a reference ID.
Contact form information: the name, email, subject, message, and any files you attach (up to 3, 4 MB in total) are sent to me by email solely in order to respond to you (they are not saved in the site’s database).
Project requests (the Development page): the project type and features you select, your budget and timeline range, your description, an optional reference link, your name, email, an optional Telegram ID or phone number, and any files you attach (same limits as the contact form) are sent to me by email solely to review and reply to your request. They are not saved in the site’s database. If you are signed in, your name and email may be pre-filled from your account, and you can edit them. Please don’t put confidential information (such as passwords or access keys) in a project request; if a project goes ahead, sensitive material can be shared through a more suitable channel.
Technical and usage data: browser and device type, pages visited, and site performance metrics are collected in aggregate and anonymously through analytics tools (Vercel Analytics and Speed Insights). The hosting provider may also retain technical server logs (such as IP addresses and errors) for a limited time for security and troubleshooting purposes. Browser security reports (for example, a notice that a page tried to load a blocked resource) are also written to the server logs; they contain page addresses and technical details, not your messages.
Site assistant (the “Ask a question” chat on khashayaryaghma.ir): the question you type is processed to produce an answer but is not stored by this site, and the replies are not stored either. To protect the service from abuse and to enforce usage limits, one essential cookie is set in your browser (a random visitor ID signed by the server; it is HttpOnly and expires after 3 days), and a short usage record is kept for each question: the time, the number of AI tokens used, and two one-way (keyed) hashes — one of that random visitor ID and one of your network address (for IPv6, only its first 64 bits) — so your IP address and visitor ID themselves are not stored in that record. These records contain no question or answer text and are deleted automatically after 2 days.
Cookies and browser storage: a session cookie for single sign-on (SSO) across khashayaryaghma.ir and its subdomains, such as xerxesai.khashayaryaghma.ir; a few technical cookies required by the sign-in process; and preferences such as language, light/dark mode, and a message draft written before signing in (kept on your own device only). The contact form and the site assistant use Google reCAPTCHA, which may set its own cookies; the site assistant also sets the one essential cookie described above. We do not use advertising or marketing tracking cookies.
Your information is used primarily to run the services properly: authenticating you, showing your conversation history, generating replies and images, enforcing usage limits and preventing abuse, and responding to messages sent through the contact form.
To protect the security and improve the quality of the services, part of the stored information — including conversation content — may be reviewed by the system administrator to the extent necessary; for example, to identify and fix technical faults and security vulnerabilities, to detect and prevent abuse, to evaluate the quality of responses, and to improve the websites and products. This review is carried out to maintain and develop the system, not to monitor individuals, and follows the principle of data minimization — only as far as is needed for that purpose.
We may also use usage data — such as which features are used most or which errors occur — to resolve issues and build new features, in aggregate where possible and without focusing on your individual identity. Your conversation content is never sold or rented to any third party for advertising, and is not used to train AI models.
XerxesAI’s replies are generated by the AI models of an external service, so with each message some of your information is sent to that service. Normally this includes: your new message, part of the most recent messages in the same conversation (to preserve context), any images attached to that message, your name (so it can address you), and — if memory is on — the short notes saved in your memory (see below). Your email address and your other conversations are not sent.
Once sent, the processing of that information by the model service is governed by that service’s own policies. For this reason, we recommend that you do not enter highly sensitive information — such as passwords, bank card numbers, national ID numbers, or identity documents — into conversations or images. Conversations are not end-to-end encrypted. Likewise, please do not enter other people’s personal information, photos, or voice recordings into XerxesAI without their permission.
If you request an image, your description is first rewritten into a short English prompt by the AI model service (Groq), and that prompt is then sent to the image-generation service (Cloudflare). The resulting image is stored in your account like your attachments (see sections 1 and 7).
Site assistant: when you ask a question in the “Ask a question” chat, the question (up to 300 characters) is sent to the AI model service (Groq) together with a few short extracts of this website’s own text that seem related to it, solely to write the answer. The assistant is designed to answer only from this website’s content and never receives your account data, your XerxesAI conversations or your email address. Questions and answers are not stored by this site, but, as with XerxesAI, the processing by the model service is governed by that service’s own policies, so please do not type personal or sensitive information into it. Answers are generated automatically and may be wrong; they are not legal, financial or professional advice and never a quote or an offer.
Memory: if memory is on, the short notes saved about you are included in the instructions sent with each message, so the answer can take them into account. When a message of yours looks like it contains something lasting about you (for example “my name is…” or “remember that…”), that message and your current notes are also sent once to the AI model service (Groq), solely to decide what to add, update, or forget. Automatic filters then remove sensitive details before anything is saved, but they are not perfect — so please don’t tell XerxesAI anything you wouldn’t want kept, and delete any note you don’t want from the memory window. Notes are created automatically and may be inaccurate; you can delete them at any time.
To provide the services, some information — only what is necessary for the specific task — is shared with the providers below. This information is never sold to them, and none of them receives it for advertising purposes. Each provider has its own independent privacy policy, and processing on their side is governed by those policies:
Google — for authentication (sign in with Google) and to verify that the contact and project request forms are not being submitted by a bot, and that the site assistant is used by real visitors (reCAPTCHA); messages from those forms are also received in my Gmail inbox.
Groq — the AI model service: message text, attached images (via a temporary signed link), and voice recordings are sent to it to generate replies and transcribe speech; for the site assistant, the visitor’s question together with short extracts of this website’s text.
Cloudflare (Workers AI) — only when you request an image: the image description is sent to create it.
Neon — the PostgreSQL database in which accounts, conversations, and messages are stored.
Backblaze B2 — for secure storage of images; this storage is private, and files are reachable only through short-lived, signed links (never a public link).
Resend — for delivering contact form messages and project requests to me by email.
Vercel — for site hosting and anonymized traffic/performance analytics (Vercel Analytics and Speed Insights), without cross-site tracking cookies.
A bank payment gateway — only if online payment is introduced in the future.
The AI model provider or other services may change in the future, or new services may be added; if so, this list will be updated.
If required by law or by an official request from a competent authority, I will disclose information only to the extent strictly necessary and in accordance with applicable regulations.
Some of the providers listed in section 4 (including Google, Groq, Cloudflare, Neon, Backblaze, Vercel, and Resend) run their infrastructure outside Iran. As a result, some of your information may be processed or stored on servers located outside the country. We try to work only with providers that maintain reasonable security standards, but by using these services you accept this transfer.
User data is kept in a managed, access-restricted database, and traffic between your browser and the site is encrypted (HTTPS). Images are kept in private storage and are accessible only through short-lived (a few minutes) links, and only to their owner. That said, no system is completely secure and absolute security cannot be guaranteed; in the event of a security breach affecting your personal data, you will be notified where possible and as required by applicable law.
Deleting a conversation: when you delete a conversation, it is hidden from your view and your accessible history immediately. Its record — including its messages and images — is then kept for 30 days, to protect against accidental deletion and to help identify potential abuse, after which it is permanently erased automatically from both the database and file storage.
Deleting your account: when you delete your account from the account page, it is scheduled for deletion and stays recoverable for 30 days — you can cancel the request at any time during that period. After 30 days, your account and all of its conversations, messages, images, memory notes, and related sign-in data are permanently erased automatically. Images you attach but never send are removed automatically within about 24 hours.
Deleting memory: notes you delete from the memory window (one by one, or all at once) are removed immediately. Deleting a conversation does not delete the notes XerxesAI learned from it — memory is managed separately, from the account menu in XerxesAI. If you switch memory off, nothing new is learned or used, but notes already saved stay until you delete them (or delete your account).
Site assistant usage records (time, token count and the two one-way hashes described in section 1) are deleted automatically after 2 days. The assistant’s cookie is a technical cookie that expires on its own after 3 days; you can also delete it at any time in your browser settings, after which you are simply treated as a new visitor.
The automatic cleanup runs once a day, so the timings above are approximate and a technical problem may delay them by a few days (it is simply retried on the next run). Backups: to protect your data from being lost (for example through a technical failure, human error, or a faulty update), I may take backups of the database from time to time (or make a temporary copy of it to test an update safely), and the infrastructure services (such as the database and file storage) may also keep their own backups or internal technical history. Because of this, data you delete may remain in a backup (or temporary test) copy for a limited time after deletion, until that copy expires or is replaced. Backups are kept with restricted access, are used only for recovery or testing, and old copies are deleted when they are no longer needed; and if one has to be restored, I will re-apply deletions that were already completed (including deleted accounts and conversations) as far as reasonably possible.
Messages sent through the contact form and project requests (including their attachments) are kept in my email only as long as necessary to respond and follow up; if a request becomes an actual project, related correspondence may be kept for as long as the collaboration and any related obligations require. You can ask me to delete them at any time (see section 8). If online payment is introduced, financial transaction records may be kept for a longer period as required by accounting and legal obligations.
You can delete your XerxesAI conversations at any time (see section 7).
You can view, delete, or switch off XerxesAI’s memory about you at any time from the account menu in XerxesAI (see sections 3 and 7).
You can delete your account from the “Account” page on khashayaryaghma.ir. To request access to, correction of, or deletion of your data, you can also email the address below; a response will be provided within a reasonable time as far as possible. If a paid subscription is active in the future or legal/financial obligations remain, we may need to coordinate with you before full deletion.
You can revoke this app’s access to your Google account at any time from your Google account settings; note that doing so, on its own, does not delete the data we have already stored — to delete it, follow the steps above.
These services are not intended for users under 13, and we do not knowingly collect information from children under that age. If you believe your child has provided us with information without your consent, please contact us at the email below so that we can delete it.
This policy may be updated from time to time — including to cover new products or services. The “Last updated” date at the top of this page reflects the most recent version. In the case of material changes, notice will be given by email or a notice on the site where possible.
For any questions about this policy or your data, including to exercise the rights in section 8, you can reach me at khashayaryaghma@gmail.com.