SpaceXAI (Grok) Data Report Card

Score moved 1 from 2. The 2 rested on one FAQ sentence: "We do not sell your data or share it with third parties for marketing or advertising purposes." On 30 September 2026 SpaceXAI replaced it with "We do not sell your data to third parties as defined by applicable laws" and removed the line that there was nothing to opt out of. Sells 2 requires a plain no-sell and no-share statement (R3); a sale-only statement scoped to legal definitions is not one. The policy lists targeted advertising among its uses, and the site’s cookie banner offers a working "Reject All" opt-out with a "Privacy choices" control — the opt-out rung, matching Spotify, Reddit and OpenAI. Data Practices moves from 9 to 8 (B to C).

The SpaceXAI policy (effective Aug 24, 2026; event ev-2026-0001) states deleted conversations and deleted accounts are removed "within 30 days" unless retention is required for legal, compliance, or safety purposes, and Private Chat auto-deletes within 30 days. A stated post-deletion purge timeline with clear scope is the distinction that earns a 2 — the same standard OpenAI and Anthropic meet with their stated 30-day purges.

The 0 rested on the April policy’s statement that xAI "by default uses your X posts, profile data, and Grok conversations" to train. The SpaceXAI policy (event ev-2026-0001) drops X data from scope — SpaceXAI states it is a separate company from X Corp, and Grok on X is governed by X’s own policy. What remains is training on your Grok conversations by default with a documented opt-out ("Improve the model" in Settings, Private Chat excluded) — the same trains-by-default-with-opt-out shape that scores OpenAI and Anthropic a 1. X’s own sharing of public posts stays scored on the X report card, where it keeps its 0.

The April policy’s no-sell sentence is not in the SpaceXAI policy; the plain commitment now lives in the Consumer FAQs: "We do not sell your data or share it with third parties for marketing or advertising purposes." The score holds at 2 on that statement. Noted in the cell: the policy lists targeted advertising among its uses and the site’s cookie banner describes ad-partner targeting cookies — a tension the FAQ statement currently outweighs.

Re-verified against the SpaceXAI policy: the privacy portal and the access, correction, and deletion rights carry over, and some rights are now exercisable in the Service. Score unchanged; Portability and Friction & speed cells re-worded the same day for the same reason — the policy no longer names portability, and requests still require full legal name, location, and identity verification.