IO should be fine. There's enough legit tech companies using .io now that it shouldn't have too much reputation risk. Maybe start out with the .io until you're generating enough revenue to drop $1.5K or $3K on the .com.
Some of our emails always was marked as spam when we were using it for marketing.
Thankfully, because of our organic growth .xyz did not hinder us too much but I personally think it will take a good time before .xyz is being used by commercial companies and hence I would suggest you to refrain from buying a .xyz domain for now.
Focus on your service's quality more than your TLD. You won't regret it.
However... would you trust payment on a .info, .biz etc names?
Some have more trust than others - Nominet do a fair bit of work in the .UK namespace to build that itself to a trustmark. If only someone was doing that internationally!
If they are mobile users, they can type ".com" on their on-screen keyboard.
If they don't remember the domain, they will go to Google and you might have some trouble with people advertising on top of your #1 positiom...
... which will happen only if you're successful, of course.
I totally agree on this: you should focus son the product, not on the name. People will buy your product - name changes are more frequent than we think.
If not, go for the .io at least a lot of reputable sites are using that.
Haven't seen anyone using .xyz in marketing yet.
But don't buy a 1.5K domain before securing the twitter handle and facebook page FIRST.
Don't buy a domain without a match or near match in twitter / facebook (like $domainname + "app" or something like that).
I don't do it.