x1

GDPR overview

There is no mention of the GDPR anywhere on the site. Neither the privacy policy nor the terms refer to the General Data Protection Regulation, the European Union or the EEA, standard contractual clauses, a Data Processing Agreement or an Article 27 representative. The framework x1 actually documents is Californian: the CCPA as amended by the CPRA. It grants rights to know, to obtain a portable copy, to correct, to delete, to opt out of sale or sharing, to limit the use of sensitive information, and not to be discriminated against for exercising them. x1 undertakes to acknowledge a request within ten business days and answer within forty-five, extendable once. Global Privacy Control signals are honoured for analytics and advertising. Data is processed in the United States, and users abroad are told it will be transferred there. Requests go to founders@x1.new.

Who owns the data?

Under the Terms of Use you own Your Content — your idea, prompts, answers, uploads, brand assets and configuration — and you own the Output: the designs, screens, application code and the app itself, provided you have paid the fees for the plan under which it was generated. x1 claims no ownership of the app you build. In return you grant x1 a worldwide, non-exclusive, royalty-free licence to host, store, copy, transmit, display and process that material, solely to operate, secure, support and improve the Service. x1 keeps ownership of its own platform, agents, prompts, models, templates and starter code, and may show your project publicly in examples or marketing unless you object by email.

Reuse rights

Yes, within stated limits. On any paid plan you can export the full React Native source as a ZIP, then archive it, push it to GitHub, open it in a code editor, run it locally, hand it to an engineer or agency, and continue development outside x1. You may keep, refine, extend and monetize the app without asking permission, and you publish it under your own Apple Developer account, remaining the developer of record. Three restrictions apply. The 100 free credits do not include source export. You may not resell, sublicense or provide the Service itself to third parties without written agreement. And you may not extract x1's starter code or templates to build a competing app-generation product. x1 also warns that Output is not unique: similar prompts can produce similar results for other customers, so nothing generated is guaranteed to be original to you.

Data retention & training

Hosting summary

x1 states that it is based in the United States and processes personal data there, as do its service providers, some of which operate in other countries. Users outside the United States are told their information will be transferred there and that local privacy laws may differ. No specific data centre, region or data-residency option is named, and no European hosting is offered. The privacy policy names its processors rather than publishing a separate subprocessor page. The model providers are Microsoft Azure OpenAI Service, Google, Anthropic and Perplexity. Stripe handles payments, PostHog analytics and session replay, Sentry error monitoring, alongside Vercel Analytics and Google Ads. Other categories, such as cloud hosting, database and backend providers, email delivery and support tooling, are described but not named. On security, x1 cites encryption in transit and at rest, isolated execution environments for generated code, access controls and least privilege, secret scrubbing in error reports, and monitoring for unusual activity. No certification is claimed: the site never mentions SOC 2, ISO 27001 or HIPAA, and no Data Processing Agreement is published or offered.