1. The short version

• We do not sell your data. Ever. Not your account, your voice, your photos, or your face and voice patterns.
• We do not record or replay your sessions. There is no session recording, no screen replay, and no surveillance of how you use the app.
• Sensitive data is encrypted. Your face and voice patterns are encrypted, scrambled so they cannot be linked to your name, and are never shown to anyone in a readable form.
• Analytics are optional and off by default. If you turn them on, they help us fix performance problems and improve the experience. They never include your name, contacts, photos, or what you said.
• You are in control. You can see, export, or delete your data at any time.

2. Who we are

Xheight ("we," "our," or "us") builds Aion, an AI assistant that helps blind and low-vision people understand their surroundings through a voice-first, zero-text interface. This policy covers our website at xheight.ai, the Aion app, and connected assistive devices.

We are the data controller. Contact: support@xheight.com. Postal: Xheight Privacy Office, Tel-Aviv, Israel .

3. What we collect and why

In short: we collect only what Aion needs to help you, plus optional data you can choose to share to make it better.

3.1 Account information

Your email and sign-in identity, so you can log in and sync across devices.

3.2 What Aion processes to assist you

• Voice: your spoken requests, so Aion can listen and answer.
• Camera: images from your device, so Aion can describe scenes, read text, help you navigate, and recognize objects or people you have chosen to save.
• Location: used only while navigating, for directions and hazard awareness. We do not keep a history of everywhere you go.

3.3 Face and voice patterns (biometrics)

If you choose to let Aion recognize people, it creates a mathematical pattern of a face or voice. These patterns are encrypted, scrambled so they cannot be tied to a name, and never shown to anyone in readable form. They are used only to help you, never sold, and you can delete them at any time. Full details are in our biometric data policy.

3.4 Optional analytics (performance and experience)

In short: analytics are turned off until you choose to turn them on. They exist to help us find and fix performance problems and to improve the experience — not to watch you.

• Off by default: nothing is collected for product analytics unless you opt in.
• Performance optimization: anonymous signals such as crashes, errors, load times, and which features are used help us make Aion faster and more reliable.
• Optional UX data: if you opt in, aggregated usage patterns help us improve the experience for blind and low-vision users.
• No private data: analytics never include your name, email, contacts, precise location, photos, or the content of what you said or saw.
• No session recording: we do not use session replay, screen recording, or surveys.

You can turn analytics on or off at any time in Settings, under Privacy. See our cookie and tracking policy.

4. Our legal bases

In short: we only process data when the law allows it.

• Contract: to provide the account and features you asked for.
• Consent: for biometrics and optional analytics. You can withdraw consent at any time.
• Legitimate interests: to keep the service secure and working, balanced against your rights.
• Legal obligation: when the law requires it.

We rely on the GDPR and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), and the Illinois Biometric Information Privacy Act (BIPA), among others.

5. Who we share with

We do not sell, rent, or trade your personal information. We share it only with service providers that help us run Aion, and only as needed:

• Service providers: hosting, AI processing, payment, and support partners. See the full list in our subprocessors page.
• Legal requirements: only when properly required by law. See law enforcement requests.
• Business transfers: if we merge or are acquired, with notice to you.

6. How we protect your data

• Encryption: data is encrypted in transit and at rest. Biometrics use AES-256-GCM encryption and are scrambled with a keyed hash.
• Fail closed: if a biometric cannot be encrypted, it is discarded rather than stored in the open.
• Isolation: each person's data is kept separate. We never mix data between users.
• Least data: we collect only what is needed and delete it when it is no longer needed.

7. Your rights and choices

In short: your data is yours. You can see it, correct it, take it, or delete it.

• Access, correct, delete, export, restrict, or object to processing.
• Withdraw consent for biometrics or analytics at any time.
• Opt out of any sale or sharing — though we do not sell. See do not sell or share.

To use these rights, email support@xheight.com or use the in-app controls. Full details and timelines are on our your data rights page.

8. Children

Aion is for people aged 16 and older. We do not knowingly collect data from anyone under 16. See our children's privacy page.

9. International transfers

We operate from Israel and use providers in the United States, the European Union, and elsewhere. When data crosses borders, we protect it with Standard Contractual Clauses and equivalent safeguards.

10. Changes to this policy

If we make material changes, we will update the date above and, where required, tell you in the app or by email.

11. Contact us

12. Related policies

• Legal center
• Terms of service
• Biometric data policy
• Cookies and tracking
• Accessibility statement