Xcelcor Guardian

Privacy & Security

Exactly what Guardian collects

Last updated 9 October 2026

Guardian has to know who is trying to connect to your computer, and whether anybody approved it. It does not need to live the rest of your life.

What can leave the PC

  • Remote connection attempts: the address they came from, the remote-support tool involved, and the time
  • What was decided about each attempt, who decided it, and whether the session was allowed or dropped
  • Your whitelist and your Blocked IPs list, which are held against your account so they survive a reinstall
  • Security-relevant activity inside a session you approved, including a transferred installer or an attempt to run with higher privileges
  • The small amount of information required to send an approval request or an alert to a Trusted Guardian
  • A short description when Guardian warns about a web page, or holds a session because of one, without the page's address

What Guardian does not take

  • Your personal documents
  • Your photos
  • Your passwords
  • A continuous recording of your screen
  • A product that sells your browsing history

Web pages, checked on the PC

These scams usually start with a fake warning page or a fake support number, and end on a banking or payment page. So Guardian looks at the browser on the PC itself.

  • Every few seconds it reads the title and address of the browser window in front. While a remote session is going on, it reads every open browser window.
  • It compares them, on the PC, with lists of known scam sites and phone numbers that it downloads from xcelcor.com, and looks for the wording fake warning pages use.
  • If a banking or payment page is open during a remote session, Guardian treats that session as higher risk.
  • When something matches, the PC keeps a short note of it for 7 days: which site, not the full address.
  • If Guardian warns about a page or holds a session because of one, xcelcor.com gets a short description such as "A banking site was opened during a remote session". Not the address, and not a list of the sites you visit.
  • Pages that don't match anything aren't recorded, and nothing about them leaves the PC.

How that is handled

  • Detection is local-first. The decision to hold a connection is made on the PC.
  • Communication off the PC is encrypted.
  • Personal data is not sold.
  • Connection and incident records are kept so Guardian Story can explain what happened, for as long as the account exists. You can ask support@xcelcor.com to delete account data.

Your account

Which PCs are linked to your account, your whitelist, and your Blocked IPs are stored against your account on this website rather than on the PC. That is deliberate: if they lived on the machine, someone who had taken control of the machine could change them.

Trusted Guardians

A Trusted Guardian is asked to approve or refuse a connection, and can be told that something serious happened. That request carries the address, the tool, and the time. They are not given your screen, messages, documents, passwords, or banking information.

If a future build ever needed a new category of data, this page would have to change first. The table on the homepage is the promise.

Who is responsible for your data

Pragmio LLC, a company registered in New Jersey and based in Scotch Plains, New Jersey, United States, runs Xcelcor and Xcelcor Guardian. It decides how your personal data is used, which makes it the “controller” under the EU General Data Protection Regulation (GDPR). For anything about your data, write to support@xcelcor.com.

What we use it for, and why we’re allowed to

The GDPR asks us to name a legal reason for each use. The article numbers are from the GDPR.

  • Running your account and Guardian. Your email address, your password (stored only as a one-way hash we can’t read back), your Google account ID if you sign in with Google, your linked PCs, the connection records above, your whitelist and Blocked IPs, and the approvals and alerts sent to Trusted Guardians. Reason: we need it to provide the service you signed up for (Article 6(1)(b)).
  • Taking payment. Stripe handles your card. We keep your plan, its status and renewal date, and your card’s brand and last four digits, so your account can show them. Stripe keeps your billing address and any tax ID. Reason: providing the service you pay for (Article 6(1)(b)). Keeping payment records and invoices is also a legal requirement (Article 6(1)(c)).
  • Emails about your account. Confirming your address, approval requests, alerts, password resets and billing notices. Reason: providing the service (Article 6(1)(b)).
  • Product news and the Scam Watch email. Only if you ask for them. Reason: your consent (Article 6(1)(a)). You can withdraw it at any time with the unsubscribe link or by writing to us.
  • Sending someone the download link, and business enquiries. The email address you give, the name you type and when you sent it. Reason: our legitimate interest in sending the message you asked us to send, or answering your enquiry (Article 6(1)(f)).
  • Seeing how the website is used, if you allow it. With your OK, our public pages use Google Analytics. It sets cookies and sends Google your IP address, your browser and device details, and the pages you look at, so we can see which pages help people and how they found us. It never runs on account, admin, approval or password pages. Reason: your consent (Article 6(1)(a)). You can withdraw it at any time under “Cookie settings” at the bottom of every page.
  • Keeping the service safe. Server logs with IP addresses, limits on how often someone can try to sign in or submit a form, and signed records of each approval. Reason: our legitimate interest in stopping attacks and fraud (Article 6(1)(f)).

If you install Guardian on someone else’s PC, records about connections to that PC are kept for your account. Our terms require that the person who uses it knows Guardian is installed and who approves its connections.

Cookies

On your first visit we ask whether we may use Google Analytics. Until you say yes, it doesn’t load at all. Nothing is ticked in advance, and saying no is as easy as saying yes. You can change your mind at any time with “Cookie settings” at the bottom of every page. If your browser sends a Global Privacy Control signal, we take that as a no and don’t ask.

  • Needed to run the site, always on. xg_session keeps you signed in. xg_verify and xg_oauth finish signing up or connecting an app. xg_admin and xg_unlock protect the admin area. xg_consent remembers your cookie choice for 12 months.
  • Google Analytics, only with your OK. _ga and _ga_… count visits to our public pages. They last up to a year, and Google’s advertising features are switched off. If you say no later, they’re deleted.

We keep a record of each choice (a random ID, the choice and the date, without your IP address) so we can show the choice was asked for. There are no advertising cookies. You can also block Google Analytics with Google’s add-on at tools.google.com/dlpage/gaoptout.

Who else handles your data

  • Stripe (Stripe, Inc. and Stripe Payments Europe, Ltd.) takes card payments and runs the billing pages.
  • Google (Google Workspace) sends our emails. If you choose to sign in with Google, Google also confirms who you are.
  • Google (Google Analytics) counts visits to our public pages, if you allow it.
  • Our hosting provider runs the server in the European Union that holds this website and its database.

They only handle your data to do that work for us. Nobody else gets it, unless the law requires us to hand it over. We don’t sell personal data, and we don’t share it with advertisers.

Where your data is

The website and its database run on a server in the European Union. Pragmio LLC is a US company, so the people who run Xcelcor also reach it from the United States, and Stripe and Google may handle data in the US. Stripe and Google take part in the EU-US Data Privacy Framework, which the European Commission recognises as protecting EU data properly.

How long we keep it

  • Your account, linked PCs, connection records and lists: while your account exists. When you close it, we delete them within 30 days. Our nightly backups are kept for 14 days, so they’re gone from those 14 days later.
  • Payment records and invoices: as long as tax and accounting law requires, usually up to 7 years.
  • Sign-ups that were never confirmed: 7 days. Password reset links: until they expire. One-time codes for linking a PC: 90 days.
  • Product news and Scam Watch: until you unsubscribe.
  • Email addresses left on our forms without asking for product news, such as a download link sent to someone or a business enquiry: 12 months.
  • Server logs: 14 days.
  • Your cookie choice: 12 months in your browser, and our record of it 13 months.
  • Google Analytics: Google keeps visit data for up to 14 months.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, or to send it to you or to another service in a format a computer can read. You can object to anything we do on the basis of our legitimate interests, and where we rely on your consent, you can withdraw it at any time.

Write to support@xcelcor.com, from the address on your account if you have one. We answer within one month.

To have an account you need to give an email address. Everything else is up to you. No decision with legal or similarly significant effects is made about you by a computer alone: Guardian holds remote connections automatically, but whether one is allowed is decided by a person.

If you think we’ve handled your data wrongly, you can complain to the data protection authority in the country where you live or work. In Poland, that’s the Personal Data Protection Office, UODO (uodo.gov.pl). The European Data Protection Board lists the authority for every EU country. In the UK, it’s the ICO (ico.org.uk).

If you live in the United States

Some US states, California among them, give you extra privacy rights. In their terms:

  • What we collect. Identifiers (your email address, IP address, and the IDs Guardian gives your PCs), commercial information (your plan and payments) and internet activity (the connection records described above and, if you allow it, which of our pages you visit). Where each comes from and why is set out above.
  • We don’t sell or share it. We don’t sell personal information, and we don’t share it for advertising based on what you do on other sites. Sensitive information, such as your account login, is only used to provide the service.
  • Your rights. You can ask to know what we hold about you, for a copy of it, and for it to be corrected or deleted. We won’t treat you differently for asking. A Global Privacy Control signal from your browser is taken as a no to Google Analytics.
  • How to ask. Write to support@xcelcor.com. We check it’s you through the email address on your account, and answer within 45 days. Someone you authorise in writing can ask for you.

Children

Xcelcor accounts are for adults: you must be 18 or over to create one. The site isn’t meant for children, and we don’t knowingly collect information from anyone under 13.

Changes to this page

When this page changes, the date at the top changes too. If a change matters, we email account holders before it takes effect.