Minimal data by design.

XGuard stores an irreversible hash of the operator key, encrypted credential material, scoped capability state, billing-event identifiers, balances and ledger entries needed to provide the service. It does not use customer email as the account key and does not return reusable upstream credentials to agents.

Payment details are collected by Lemon Squeezy, not by XGuard. Avoid placing personal data in labels, paths, headers or request bodies.