Privacy Policy

1. What We Collect

We collect only what's necessary to run the Service:

• Account information — your email address and password (hashed, via Supabase Auth)
• X OAuth tokens — access and refresh tokens for your connected X account, stored encrypted
• Subscriber data — X handles and profile info synced from your own X account
• Billing information — handled entirely by Stripe; we never see or store your card details
• Usage data — basic logs for debugging and abuse prevention

2. How We Use Your Data

• To operate and improve the Service
• To sync your subscriber list and send DMs on your behalf via the X API
• To process your subscription and payments via Stripe
• To diagnose bugs and prevent abuse

We do not sell your data. We do not use your subscriber data for advertising or share it with third parties beyond what's required to run the Service.

3. Data Isolation

All data is scoped to your account. You can only see and interact with your own subscribers and connections. Row-level security policies in the database enforce this at the query level — no other user can access your data.

4. Third-Party Services

We rely on the following third parties:

• Supabase — database and authentication
• Stripe — payment processing
• X (Twitter) API — follower sync and DM delivery
• Vercel — hosting and edge functions

Each of these services has its own privacy policy governing how they handle data.

5. Data Retention

We retain your data as long as your account is active. When you delete your account, your data is removed from our systems within 30 days. Stripe may retain billing records as required by law.

6. Your Rights

You can export or delete your data at any time from your settings page. You can disconnect your X account at any time, which removes your stored OAuth tokens. For any other data requests, reach out directly.

7. Cookies

We use cookies only for authentication (session management via Supabase Auth). We do not use tracking cookies or third-party analytics cookies.

8. Security

We use industry-standard practices: HTTPS everywhere, hashed passwords, encrypted OAuth tokens, and row-level security on all user data. No security measure is perfect, and we cannot guarantee absolute security.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after changes constitutes acceptance. We'll notify you of significant changes where possible.

10. Contact

Questions about your data, privacy concerns, or anything else? Reach out on X: @robbiesurfs