Security and Data Handling
Last updated: October 12, 2026
This document is for security reviewers evaluating Xakar. It describes, feature by feature, what data goes where. We do not only list what stays on your machine — we list everything that reaches our servers, too.
1. Summary
- Source files (video, PDF, HTML) are never uploaded when you build a package. Reading files and assembling the ZIP happen entirely in the author’s browser.
- What reaches our servers while building is text: titles and settings. If you add a quiz, its questions, choices and answers pass through our servers (they are not stored).
- If you use hosting features — “Save to My Content”, learning sites, xAPI learning records — files and learning records are stored on our servers from that point on. If you don’t, nothing is stored.
- Finished packages can be built to open in an LMS with no internet access. See air-gapped LMS.
2. Building a package: processed only in your browser
The following runs in the author’s browser. Neither the source nor the result is sent to our servers.
- Reading source video, PDF, HTML and image files
- Reading and converting subtitle files (SRT, VTT). Subtitle text never leaves the browser.
- Reading metadata embedded in videos (to pre-fill form fields)
- Analyzing frames to suggest a theme color
- ZIP compression and download
3. Building a package: what is sent to our servers
The player page (HTML) is generated by our server and returned to the browser, so the information shown in that page is sent to the server. The table below is the complete list.
| Item | Content sent | Purpose | Retention |
|---|---|---|---|
| Player request | Title, description, author and copyright notice, file names, player settings (theme, language, watermark, completion rule, etc.), subtitle language and label (not the text), chapter titles | Generate the player page; deduct credits | The request is not stored. The credit history records the package type and title. |
| Quiz questions (quiz and course packages) | Questions, choices, correct answers | Generate the quiz page | Not stored, unless you save them to a question bank (see below). |
| Packaging history | Title, format, file name, file size, chapter and question counts, player settings | Show the “My Packages” list | Deleted with the account. |
| Settings templates (only when saved) | Player settings | Reuse settings | Until you delete them |
| Question banks (only when saved) | Questions, choices, correct answers | Reuse questions | Until you delete them |
When a PDF package is built in bundle mode (the default), the author’s browser downloads the PDF viewer library (PDF.js) and the extra files that document needs (character maps, image decoders) from a public registry (unpkg.com) and puts them in the ZIP. Those requests carry no document content; which files are needed is decided inside the browser.
4. Features that store data (only when used)
These features run only when you turn them on or invoke them. If you don’t, the data below is never created.
| Feature | What is stored | Retention |
|---|---|---|
| Save to My Content (hosting) | The full package ZIP (including video and PDF), thumbnail images | Until you delete it or delete your account |
| Learning sites | Site configuration, learner names and email addresses, enrollments | Until the site owner deletes it or deletes the account. Individual learner deletion is performed by the site owner. |
| xAPI learning records (LRS) | Learner identifiers and learning activity such as progress, scores and watched segments | After 12 months the raw statement is cleared and only summary values remain. Intermediate events such as play and pause are deleted after a plan-specific period. |
| Site AI editing | Site configuration (JSON) and your request are sent to the Anthropic API for a response. | Conversations are not stored on Xakar servers. Only credit usage is recorded. |
Hosted video is delivered to learners only through signed URLs that expire after 6 hours.
5. Accounts, payments and inquiries
- Accounts — Email address and password. Passwords are stored only as one-way hashes. Sign-in records are kept for 3 months.
- Payments — Processed by Lemon Squeezy as Merchant of Record. Card details never reach Xakar.
- Contact form — Name, email, phone and message are stored and a notification email is sent. Cloudflare Turnstile is used against spam. Resolved inquiries are destroyed after one year.
- Analytics — Vercel Web Analytics counts page visits without cookies.
6. Third parties that process data
| Provider | Role | Data processed | Location |
|---|---|---|---|
| Supabase Inc. | Authentication, database, file storage | Account data; the stored data in sections 3 and 4 | United States |
| Vercel Inc. | Hosting, analytics | IP address, browser information, request content (not stored) | United States |
| Lemon Squeezy (Sold Through Link, LLC) | Payment processing | Email, billing country, amount | United States |
| Resend (Plus Five Five, Inc.) | Inquiry notification email | Contact form content | United States |
| Anthropic, PBC | Site AI editing (when used) | Site configuration, your request | United States |
| Cloudflare, Inc. | Contact form spam protection | IP address, browser information | United States |
7. Safeguards
- All traffic is encrypted with HTTPS (TLS).
- Stored data is covered by Supabase’s encryption at rest (AES-256).
- Every API checks that the signed-in user owns the requested data before responding.
- Data past its retention period is destroyed automatically every month.
- Deleting an account deletes its file storage, learning records, content, sites and credit data. Only transaction records that the law requires us to keep are held separately and destroyed afterwards.
8. When a finished package connects to the internet
Once uploaded to an LMS, a package calls an external address on the learner’s screen only in these cases:
- Video packages — Load nothing from outside.
- PDF packages — The default (bundle mode) puts the viewer and the character maps and image decoders that document needs inside the ZIP, so nothing loads from outside. The viewer loads from a CDN only if the author chose CDN mode.
- PDF translate button — Loads Google Translate when the learner presses it.
- xAPI packages — Send learning records to the LRS you configure. Keep the LRS on your internal network and nothing leaves it.
See SCORM packages for air-gapped LMS and the Privacy Policy for details.