Evidence Report: xAI / Grok — Reflexion Software

What we observed

Fact — measured

Each Grok session generates approximately 12KB of telemetry metadata beyond the conversation content itself, including keystroke timing, scroll velocity, hover dwell times, and clipboard access patterns, batched and transmitted at session end.

Fact — captured

The analytics pipeline uses a rotating endpoint schema, which has the practical effect of evading simple DNS-based blocking rules.

Inference — most likely interpretation

Keystroke-timing and interaction data of this granularity can support inference of user emotional state and cognitive load. Whether xAI performs such inference is not established by our captures.

Opinion — our judgment

Behavioral collection at this resolution belongs in the privacy policy in plain words, whatever the engineering justification.

Open questions — under review

Disclosure status: whether any of these collection classes are covered by the current privacy policy text.
The rotation cadence and whether it is designed for blocker evasion or infrastructure load management.

Provenance & methodology

Session-scoped traffic capture with payload classification by content type.
Endpoint inventory across repeated sessions to establish rotation behavior.

Report status

Status

Investigation active

Metadata volume

~12KB/session

Last updated

2026-09-13

Endpoint rotation analysis, keystroke-timing proof of concept, and the full metadata breakdown are being finalized for open publication.

Correction & changelog

We do not silently rewrite findings. If a claim changes, the change stays visible.

2026-09-13 — Copy overhauled to evidence-state vocabulary (OBSERVED / REPRODUCED / INFERRED / UNDER REVIEW). Legal-conclusion phrasing narrowed to bounded claims. No findings were removed.
2026-05-07 — Initial publication of preliminary findings.

Get protected — free All vendor audits Counter-evidence? Talk to us