Privacy Policy

We collect only what is needed to operate the Service:

• Account information: your email address and basic profile details from Google when you sign in.
• X (Twitter) connection: OAuth access and refresh tokens for your connected X account, and public post and engagement metrics returned by the X API.
• OpenAI API key: the key you provide so the Service can generate content on your behalf.
• Content & settings: your subject, style, and schedule configuration, generated drafts, approvals, and published posts.
• Usage data: estimated OpenAI spend, token counts, and operational logs used to run and improve the Service.

• Generate AI post options and images using your OpenAI key.
• Publish posts and replies to your X account after your explicit approval.
• Sync and display your engagement analytics.
• Send approval and reminder emails.
• Operate, secure, and improve the Service.

We do not sell your personal information, and we do not use your content to train third-party models beyond the AI providers you explicitly enable through your own API key.

Each user can access only their own records, enforced by row-level security. API keys and OAuth tokens are encrypted at rest and are never returned in full to the frontend. Access to production data is restricted and transmitted over encrypted connections.

The Service relies on the following providers, each with their own privacy policies:

• Google (authentication)
• X / Twitter (publishing and analytics)
• OpenAI (content generation, via your own API key)
• Supabase (database, authentication, and storage)
• Resend (transactional email)
• Vercel (hosting)

You can disconnect your X account, remove your OpenAI key, or request deletion of your account and associated data at any time. When you delete your account, we remove your personal data except where retention is required by law.

For any privacy questions or data requests, please contact the account administrator for your workspace.