Updated October 26, 2026 · iOS Safari 1.6
xgoose operates in the Safari page where you use it. You choose which websites the extension can access. Built-in skills read page content and make requests using that website’s session. This iOS release executes packaged skills; it does not install community scripts or run AI-authored JavaScript. Navigation, refresh and closing the page end an active run.
When you send a message, your messages, relevant page or skill results and selected images are sent over HTTPS to the AI provider you choose. BYOK can use Google Gemini, OpenAI-compatible services or a custom HTTPS endpoint. Your provider’s terms and retention policy apply. Images are resized and re-encoded locally; diagnostic transcript uploads omit image bytes.
Hosted AI uses your verified xgoose account and available credit. After you agree to use Hosted AI, conversations—including messages, responses, tool inputs and outputs, website hostname and usage—are uploaded to xgoose. They are stored in a private database and object storage for up to 90 days. Authorized administrators can access conversation records for support, operations and abuse investigation; access is audited. Recognized secrets and authorization headers are redacted, but do not submit content you do not want processed by the service. BYOK conversations are not uploaded to xgoose by this iOS client.
API keys and account tokens are saved in a shared, device-only Keychain item. Ordinary settings are shared between the app and extension through an App Group. Local conversation history, images and website memory are retained in extension storage. Unsupported older custom scripts and conversation archives are preserved for export. Website scripts cannot read the extension’s credentials.
Optional usage analytics are disabled on a fresh iOS installation. If enabled in Personalization, first-party usage events may include feature names, model/provider identifiers, account identifier, timing and error categories. They do not include your email, message bodies, images or API keys. Analytics are not used for advertising or cross-company tracking. You can disable them in the app.
Open the app → Account → Delete account & cloud data. Confirming submits a permanent erasure request. We immediately disable the account and revoke its sessions, then remove associated account data, cloud conversations and owned published skills. Temporary storage failures are retried automatically. Local history and exports on your devices remain under your control; remove local conversations or uninstall the app to remove its local container data. Keychain credentials can be removed through the app’s connection settings. Account deletion cannot be undone and does not refund used inference credit.
For privacy questions or requests, contact xgoose@xgoose.org or visit xgoose support.