Bangerkit
Log inStart 3-day trial
Legal

Privacy Policy

Last updated:

1. Who is responsible

The controller of your personal data is Michał Florczak (NIP 5521733765, Poland) (“we”, “us”), operating Bangerkit at bangerkit.io. You can reach us at [email protected].

2. What we collect

Bangerkit works with one X account: the one you sign in with. We keep only what the waitlist, the free account check and the workspace need:

  • Your waitlist application: email address, submitted X profile link, why you want to use the product, and the plan you selected, if any.
  • Free account checks you run on this site, without an account: the X handle you enter, that account's public profile, figures and top posts from its public posts of the last 14 days, the written read, and a keyed hash of your IP address. See Free account check.
  • Free AI slop checks you run on this site, without an account: the X handle you enter, that account's X id, name and profile picture, up to 20 of its latest public posts with the score and the highlighted phrases of each, a one-line reason for those that read most like AI, the verdict, and a keyed hash of your IP address. See Free AI slop check.
  • Your X profile (id, name, username, follower count) and an encrypted access token for your account.
  • Your posts with their public metrics, and the comments under them with the commenter's public profile. Your recent posts are imported once when you start. The app then checks for new comments by itself: every minute on Pro and Power and every 5 minutes on Starter and Creator (a trial as often as its plan) while the app is open, and every 30 minutes while it is closed, up to three times that when nothing new arrives. On Starter these checks stop once 2,500 comments created on X in the last 30 days have been saved, until older ones leave that window.
  • Your followers and the accounts you follow: their X ids, handles, names, profile pictures and verified badges, when the app noticed each follow or unfollow, and the follows and unfollows waiting to be sent for you.
  • Other public X data the app reads for you: posts that mention you (checked when you open the app and every 30 minutes while it is open, every 60 minutes while it is closed), results of Engage and Home searches, the accounts and posts of the niche samples and account analyses you start, with public profile data such as bio and follower counts, and trends.
  • Images you attach to a reply or post, kept on our server for at most 24 hours; they go to X only when you send.
  • Leads, only after you turn Leads on for your connected X profile: replies to your posts, posts that tag or quote you, and the posts found by Leads searches you start yourself. For each we keep the text, the post it answers or quotes, the author's public handle, name, profile picture, verified badge and follower count, and for replies the author's bio, together with a score of whether the author may need what you build and the status you give the person (such as contacted or dismissed). Leads belong to one account and its connected X profile and are never shared with other accounts.
  • Your replies, drafts and goal entries — what you type into the app or send through an assistant you connected.
  • Your Studio journal and facts: the transcript of each voice recording you make in Studio, or the text you type instead, with its language, length and date; the facts about you taken from it or added by you, events with their date; your daily plan settings; the drafts of your daily plan with a copy of the facts each cites; and a theme and form label for each of your own posts. We never store the recording itself.
  • Your products, when you add them in Reply Assistant settings: each link you add, its name and a one-sentence description (filled in by AI from the page or written by you) and whether the page could be read. Products belong to one account and its connected X profile and are deleted when you delete them.
  • Billing status: plan, subscription identifiers from Dodo Payments, payment status, the remaining monthly allowance and the record of what it was spent on.
  • Sign-in data: a hashed session identifier, IP address and browser type in server logs, and any MCP tokens you create (stored hashed).
  • Your send queue, when you use the Queue: for each reply or direct message you queue, the text you wrote, the id of the post you reply to or the X user id of the person you message, their handle and name, a short excerpt of the post you reply to, where in the app you queued it, its status, the id of your reply once the app recognises it, and when it was created, opened and finished.
  • Browsers connected to the Bangerkit Chrome extension: for each, a device label (such as “Chrome on macOS”), when it was connected and last used, when its connection expires, and a SHA-256 digest of its token, never the token itself. While you connect a browser, a one-time pairing code, also stored only as a SHA-256 digest.
  • How you found us: when you arrive through one of our links tagged with campaign parameters (utm_source, utm_medium, utm_campaign, utm_content, utm_term), those tags are stored with your account when you sign up, so we can see which of our posts brought people. The tags describe our link, not your browsing: nothing else about the visit is stored, and signing in later through another tagged link changes nothing. They stay with your account for as long as it exists.
  • Usage statistics: which screens of the signed-in app are opened and a few named actions, counted by our self-hosted Umami without cookies or any account identifier.
  • Optional signed-in analytics: if you allow it, a pseudonymous internal account id, limited product-interaction events and a masked replay of the workspace. We do not include text you enter, posts, replies, drafts, X ids, names, handles, email addresses or other X account details.
  • Optional saved comment analysis: after you separately allow it for your verified X profile, eligible saved comments and their saved ancestor text, pseudonymous roles and ids, the fixed classification result, reply-worth and bot-likeness scores, attempt status and confirmed token usage.

We never see your card number; it is entered on Dodo Payments' hosted checkout. We do not read your direct messages, bookmarks or likes.

3. Why we use it

  • To manage early access (legitimate interest): confirming your email, managing your waitlist application, and understanding what applicants want help with.
  • To run the free account check you ask for (legitimate interest): reading a public X account and writing a short read of it, and limiting how often each visitor can start one.
  • To run the free AI slop check you ask for (legitimate interest): reading the latest posts of a public X account, scoring how much they read like AI writing, and limiting how often each visitor can start one.
  • To provide the Service (performance of a contract): building analytics from your saved posts, showing the comments you can answer, publishing the replies and posts (with any images) you send, tracking your followers and who unfollows you, making the follows and unfollows you click or switch on, tracking your goal, and serving your saved data to an assistant you connected.
  • To bill you (performance of a contract, legal obligation): matching payments to your account, issuing the monthly allowance, keeping the record of what it was spent on.
  • To keep the Service secure and running (legitimate interest): sessions, abuse prevention, error and operational logs, uptime monitoring.
  • To see which of our posts bring people (legitimate interest): the campaign tags of the link you signed up through, counted per post and compared with how many of those accounts later subscribed.
  • To see how the app is used (legitimate interest): anonymous screen views and product events counted by our self-hosted Umami, described below.
  • To improve the signed-in beta (your consent): PostHog usage events and masked session replays. This is optional and stays off unless you allow it.
  • To classify eligible saved comments (your consent): after a separate onboarding choice allows it, background processing automatically checks three fixed beta workflows for product purpose questions, beta access requests and missing-invitation reports at comment time. Under the same choice, it also scores whether a new comment is worth a reply, whether its author looks like a bot, and whether it is an important comment (a question, request or complaint), a simple reaction or an answer to a question you asked, using the root post, the thread, the comment and the same author's other recent comments. Posts that mention you are sorted the same way, from their own text. Declining keeps this processing off and does not change your workspace analytics choice.
  • To keep your send queue (performance of a contract): showing the replies and direct messages you prepared in the Chrome extension, opening each one on X for you to send yourself, and marking it sent when you confirm it or when the app recognises your reply in its normal sync. A sent reply then counts as answered in Engage, clears its Home task and, for a lead you had not marked yet, marks the person as contacted.
  • To write with AI when you ask (performance of a contract): the AI buttons for replies and posts, Always improve with AI, Patterns post ideas and niche reports, account analyses, Home's “What should I do next?” and the Leads profile chat send the data listed under “Who else receives it” to OpenAI. This is separate from background comment analysis. AI never publishes by itself: only your send action does, including Improve & reply when Always improve with AI is on, Reply Assistant drafts you approve, and automatic Reply Assistant replies where enabled for your account (described below).
  • To answer simple reactions with Reply Assistant (performance of a contract, after you switch it on and confirm): for comments and mentions sorted as simple reactions, for comments that answer a question you asked or share an opinion about your post if you switch those on, and for other comments from people who, according to your saved follower list, don't follow you if you switch on People who don't follow you, OpenAI writes a short reply from the comment, its conversation and examples of your own recent replies, and TypeSafe AI checks the reply. A reply to someone who doesn't follow you ends with an invitation to connect and always waits for your approval. By default every reply waits as a draft until you approve it, and the Service then publishes it from your X account; if you switch on Send on its own and confirm, it is published without approval. We keep each draft and reply, its status and the comment it answers, so you can see what Reply Assistant did.
  • To group questions and comments people leave you (performance of a contract, after you accept the Reply Assistant terms): unanswered comments and mentions of the last two days are sent to OpenAI with a short excerpt of the post they answer, to sort them into questions, opinions, complaints and noise and to group those that one answer from you fits. When you answer a group, OpenAI receives your answer with the comments of everyone in it and writes their replies together, and TypeSafe AI checks each reply; they wait as drafts for your approval. If you skip comments sorted as noise, they are hidden in your inbox. We keep the groups, your answers and which comment belongs to which group. If you added products, OpenAI also receives their names, descriptions and links when it sorts the comments, to recognise a group asking where to find or how to get one of them; such a group is answered with that product's name and link, and OpenAI receives them again to write the replies. A reply that carries a link is never published without your approval.
  • To describe your products (performance of a contract, when you add a product link or ask to read it again): OpenAI's web search opens that page to fill in the product's name and a one-sentence description, which you can change. At most 20 pages are read per account in 24 hours.
  • To write your daily plan in Studio (performance of a contract): when you record or type a journal entry, OpenAI transcribes the recording and takes facts about you from the text; when you generate a plan, add drafts or ask for follow-ups, OpenAI writes post drafts from your facts, your own posts with their numbers and recent posts of your niche, and TypeSafe AI checks each draft. After you generate a plan, OpenAI also labels your own posts by theme and form in the background, so the plan learns what works for you. Studio never publishes: a draft is scheduled only when you press Schedule.
  • To find people who may need what you build (legitimate interest), only after you turn Leads on: TypeSafe AI judges whether the author of a reply, a mention or a post from a Leads search you started describes a problem that the product described in your Leads profile would help with, so you can decide whom to contact yourself. Nothing is sent to X or to the person: Leads never replies, follows or sends messages, and Reply only opens X for you to write and send yourself. Anyone whose posts are kept, including you, can object to this processing by writing to [email protected].
  • To answer your requests (legitimate interest, legal obligation): support, data requests, disputes.

We do not sell your data, do not use it for advertising, and do not use it to train machine-learning models.

4. What we do on X

When you sign in, X asks you to grant these scopes:

  • users.read: to sign you in and refresh your profile.
  • tweet.read: to read your own posts and their metrics.
  • tweet.write: to publish the replies and posts you send.
  • media.write: to upload the images you attach to them.
  • follows.write: to follow and unfollow accounts, as described below.
  • follows.read: requested together with following and unfollowing. We read your follower and following lists through TwitterAPI.io, not with your X access.
  • offline.access: to keep your access working without signing in again, so that the background work described below, such as automatic follow-back, keeps working between your visits.

Bangerkit never likes, reposts, quotes or sends direct messages, and has no access to your direct messages. Replies and direct messages you put in the Queue are sent by you: the Bangerkit Chrome extension opens each one on x.com in your own signed-in browser with your text filled in through X's own link, and you press Post or Send yourself (see “The Bangerkit Chrome extension” below).

Replies and posts are published only when you press send, or at the time you chose when you schedule a post, and each shows first what it will take out of your month. An MCP assistant you connected can draft replies, but you send them. If you switch on Always improve with AI in Replies, the Reply button becomes Improve & reply: AI rewrites your text, and its version is published when you press it, without another review.

Follows and unfollows: you can follow or unfollow an account with one click on any plan. On Pro and Power you can also switch on automatic follow-back of new followers and automatic unfollow of accounts that stop following you. Both are off by default, need your confirmation, are limited to 50 automated follows and unfollows in 24 hours on Pro and 150 on Power, and can be switched off at any time.

Reply Assistant: separately for comments and for mentions, the Service can write short AI replies to comments and mentions sorted as simple reactions (such as congratulations or thanks) and, if you switch it on, to comments that answer a question you asked or that agree, share an experience or joke about your post. If you also switch on People who don't follow you, it replies to other comments from people who don't follow you, questions and disagreement included: such a reply reacts to the comment, ends with an invitation to connect and always waits for your approval. It never replies to important comments, to questions waiting for your answer in Questions or to a reply to one of your replies, and to other questions or disagreement only in a reply to someone who doesn't follow you. By default they wait for your approval and the replies you approve are published in the background, one every few seconds; where enabled for your account on request, they can be published without approval, except on Starter, where Reply Assistant only drafts. It is off by default, needs your confirmation, is limited to 20 replies in 24 hours on Starter and Creator, 100 on Pro and 300 on Power, uses actions like your own replies and can be switched off at any time. A reply that carries a link to one of your products always waits for your approval.

Some reads run in the background, without a click, mostly through TwitterAPI.io:

  • new replies under your posts: every minute on Pro and Power and every 5 minutes on Starter and Creator (a trial as often as its plan) while the app is open, and every 30 minutes while it is closed, up to three times that when nothing new arrives; on Starter only until 2,500 comments created on X in the last 30 days have been saved;
  • posts that mention you: when you open the app and every 30 minutes while it is open, every 60 minutes while it is closed;
  • the follower watch, while it is on: on Pro and Power your follower count every 10 minutes, your newest followers when the count grows, your full follower list every 6 hours (every 12 hours from 10,000 followers, every 24 hours from 50,000) and the list of accounts you follow every 24 hours. On Creator your follower count is read every 20 minutes, your newest followers when the count grows and at least every 60 minutes, your full follower list every 12 hours (every 24 hours from 10,000 followers, every 48 hours from 50,000) and the list of accounts you follow every 24 hours. On Starter your follower count is read every 60 minutes, and the rest runs only while it is 1,000 or fewer: your newest followers when the count grows and at least every 4 hours, your full follower list every 48 hours (and at most every 12 hours after the count drops), and the list of accounts you follow every 24 hours;
  • refreshed counts of the comments you may answer and, if you include replies in Analytics, of your replies, and a daily snapshot of your recent posts' numbers for Home;
  • while Home is open: recent posts of the people you talk to most on each visit, and your recent posts' numbers every 10 minutes;
  • once a day, the accounts of the niche sample you started in Patterns;
  • once, when you start: an import of your recent posts (made with your X access) and of your followers. Opening Analytics for the first time runs the same posts import if it has not run yet.

These background reads, automatic follow-back and unfollow, and the automatic AI checks of your comments and Leads run only while you have used Bangerkit in the last 7 days in a browser where you are still signed in. Signing out in every browser, or not opening the app for 7 days, pauses them; automatic follows and unfollows that were waiting are not sent meanwhile. Your next visit resumes them, and the inbox then catches up on replies from the last 48 hours. Signing out in one browser while you are still signed in in another pauses nothing.

You can revoke our access at any time in your X settings. This stops everything done with your X access, including follows and unfollows. The background reads through TwitterAPI.io do not use your X access; they pause as described above.

5. The Bangerkit Chrome extension

The extension is optional. It shows your Queue in Chrome's side panel next to x.com. When you press Open, it copies your text to the clipboard and opens the reply or message on x.com in your own signed-in tab, with the text filled in through X's own link (x.com/intent/post for a reply, x.com/messages/compose for a direct message). Your browser loads that link like any other X link, so X receives your text under its own privacy policy; it does not pass through our servers on the way. You press Post or Send yourself, then mark the item sent in the panel, or the app recognises your reply when it later sees it through its normal sync. The extension never posts, never clicks or types on X, and never reads your timeline, posts or messages.

It asks Chrome for:

  • sidePanel: to show the queue next to x.com.
  • storage: to keep, on your computer, its token, the address of the Bangerkit app it is connected to and your Follow before replying settings in Chrome's local extension storage, and, until Chrome closes, the X tabs it opened, the progress of a running series and the request id of each item's follow in Chrome's session storage.
  • clipboardWrite: to copy the text of the item you open, so you can paste it if X does not fill it in.
  • Access to x.com, for three things. To open each reply or message in its X tab and see that tab's address. To read which X account is signed in in your browser (the value of X's twid cookie, which is your X user id), so it can warn you, or pause a series, when that account differs from the one connected to Bangerkit. And, while a reply you opened waits for you to post it, to see whether X created it: it looks only at X's own request that publishes a reply (CreateTweet) and X's answer to it, takes from the request just the id of the post you are replying to and from the answer just whether it contains your new reply, and never stores or passes on your reply text, headers, cookies or any other request. These checks happen only in your browser; nothing from x.com is sent to us. When X confirms the reply, the extension marks the item sent with Bangerkit, as Sent → next does.
  • Access to the Bangerkit app: to load your queue, record when you open, send or skip an item and, when Follow before replying is on, ask us to follow the person a reply answers; and, on the app's Queue tab, to receive the one-time pairing code when you connect it and to show that it is installed.

To connect it, the Queue tab creates a one-time pairing code valid for 2 minutes, which the extension exchanges for its own token. Its requests to us carry that token, a device label such as “Chrome on macOS” when it connects, and the items you open, send, skip or have followed; your IP address and browser type appear in our server logs as described above. Opening, sending and skipping use no actions and make no request to X or to any AI provider.

Follow before replying is off by default. If you switch it on in the panel, then before each queued reply opens, Bangerkit follows the author of the post you reply to through X's API with your X access, as a follow you make yourself (see “Follows and unfollows” above): it counts as one action, charged only once X confirms the follow, and is kept like your other follows. Someone you already follow is not followed again, and with Only verified accounts an author X did not show as verified is skipped; neither makes a request to X or uses an action. We follow the person saved with the queued item, never one the extension names. Direct messages never lead to a follow.

You can revoke a connected browser at any time in the app's Queue tab. Disconnect in the panel removes the token from that browser, and uninstalling the extension deletes everything it stored in your browser.

6. Who else receives it

  • X Corp. — receives every request made with your X access: signing in and refreshing your profile, reading your own posts and their metrics, publishing your replies and posts, uploading the images you attach, and the follows and unfollows you make or switch on. X's own privacy policy applies.
  • Dodo Payments — merchant of record: checkout, subscription billing, invoices, taxes, refunds. Sends us payment status only.
  • TwitterAPI.io (Prism Digital, LLC) in the United States — reads public X data for the reply inbox and mentions checks, your follower and following lists, the follower watch and the check before an unfollow, the import of your followers, Engage, Leads and Home searches, trends, Patterns, role models, account analyses, the free account check and the AI slop check on this site and refreshed post and comment metrics. It receives your X handle and id, the ids of your followers and of the accounts you follow, and the search queries, such as the handles of accounts in your niche or the keywords you saved, never your account credentials.
  • PostHog Cloud EU — only when signed-in analytics is configured and you consent. It receives the pseudonymous product events and masked workspace replay described below.
  • TypeSafe AI, Inc. in the United States — checks and classifies text; it does not write what is published. It receives:
    • for saved comment analysis, only after you separately allow it for your X profile: the eligible saved comment and saved ancestor text with pseudonymous roles and ids to run the three fixed classifications, and, to score whether a comment is worth a reply, whether its author looks like a bot and whether it is important or a simple reaction, the root post, the thread, the comment and the same author's other recent comments; and, to sort a post that mentions you, that post and the post of yours it quotes;
    • for Reply Assistant, while you have it on: each automatic reply it wrote and the comment it answers, to check the reply;
    • when you ask AI for a reply, and for each reply draft your connected assistant saves: the draft and the comment it answers, to check the draft;
    • when you use AI to write a post or ask Patterns for post ideas: each written post, to check it;
    • after you start a niche sample in Patterns: the text of the sampled accounts' posts, to recognise their hooks and formats;
    • in Engage, only when fit scoring is on or you ask for it: the product description you saved and the posts found, to judge how well they fit;
    • for Studio, only when you generate a plan, add drafts or ask for follow-ups: each draft with the facts it cites and excerpts of your own posts, to check whether it sounds written by AI and whether it stands on your facts;
    • for Leads, only after you turn Leads on for your X profile: the text of each reply, mention or Leads search post with the post it answers or quotes, the author's bio, and the description of your product from your Leads profile, to judge whether the author may need what you build.
    TypeSafe states that it does not train or fine-tune artificial intelligence or machine-learning models on API input.
  • OpenAI — only for the AI features you use. It receives:
    • for a reply suggestion: saved conversation text with pseudonymous roles, not your profile identifiers, and your draft when you use Rewrite draft with AI or Always improve with AI;
    • for a suggested reply to a post on Home or a mention: that post and your draft, if any;
    • for Reply Assistant, while you have it on: the comment or mention it answers, its saved conversation with pseudonymous roles and examples of your own recent replies;
    • for Reply Assistant's Questions: unanswered comments and mentions of the last two days with a short excerpt of the post they answer, to sort and group them; and your answer to a group with the comments of everyone in it, to write their replies together; and, if you added products, their names, descriptions and links;
    • for your products in Reply Assistant: the link you add or ask to read again; OpenAI's web search reads that page;
    • for the composer's AI button: your best posts, the post you are writing about and your draft;
    • for Patterns post ideas: your statistics, your best posts and example posts of your role models;
    • for a niche report: aggregated statistics of the sample you started, when it finishes or when you regenerate the report;
    • for an account analysis you start: that account's public profile and up to 200 of its posts;
    • for the free account check on this site: the checked account's public profile, the figures computed from its posts and up to 200 of its posts from the last 14 days;
    • for the AI slop check on this site: only the text of the checked account's posts, each cut to 1,000 characters, without the handle, the name or anything about you;
    • for Home's “What should I do next?”: aggregated counts only, with your goal, language and local time;
    • for the Studio journal: each voice recording, only to transcribe it, and the transcript or the text you typed with your current facts, to take new facts about you from it;
    • for a Studio plan, only when you generate one, add drafts or ask for follow-ups: up to 40 facts about you and 40 events of the last 14 days, your posts' statistics by theme and form with examples and their numbers, up to 16 of your own posts for your voice, your posts of the last 3 days, the drafts already in the plan, up to 30 posts of the last 48 hours from your niche sample and, for follow-ups, your post they continue with its numbers; and, for 7 days after you generate a plan, your own posts in batches of up to 120, to label their theme and form;
    • for the Leads profile chat, where Leads is available: your website address and the chat; OpenAI's web search reads your website.
    It never receives your account credentials. Processing may take place outside the European Union; the API data controls described below apply.
  • Grafana Cloud (Grafana Labs) — receives our server logs and metrics for monitoring, including the sign-in data in server logs described above. Processing may take place outside the European Union; details are available on request.
  • An email delivery provider (currently Resend) — sends the waitlist confirmation and invitation emails. It receives your email address and the message.
  • Cloudflare — network delivery and access control in front of the app and this site. It processes your IP address and the requests your browser makes.
  • Infrastructure providers in the European Union for hosting. They run the servers; they are not given your data for their own advertising.

We do not sell your data. Write to [email protected] for current processor and international-transfer details.

7. How long we keep it

  • Your workspace data (posts, comments, replies, goal, Studio sessions and plans, send queue items of any status): as long as your account exists.
  • Studio voice recordings: never stored; we discard each recording as soon as OpenAI has transcribed it, and it is never written to our logs. Journal transcripts: until you delete the journal entry. Facts about you: they stay when their journal entry is deleted; archiving a fact hides it and keeps it out of new plans, but it is kept so the drafts that cite it still show it, until your account is deleted or you ask [email protected] to delete it.
  • Browsers connected to the Chrome extension: a connection stops working when you revoke it in the Queue tab or after 90 days without use; its record (label, dates and token digest) stays as long as your account exists. Pairing codes work once and only for 2 minutes; codes older than a day are deleted when the next code is created.
  • Public posts of other X accounts that Studio kept before October 2026: all deleted, except one that became part of a Studio session, which stays in that session as workspace data. Posts saved for Patterns, role models and trends follow the workspace data period above.
  • Leads: a reply, mention or search post that did not qualify is deleted 7 days after it was saved, and one that qualified after 30 days. Posts of people you marked as contacted, replied or customer are kept while they have that status, and for every person you marked, dismissed included, the newest post and your status stay so the person is not shown to you as new again. Turning Leads off stops new processing and keeps what was already saved.
  • Your followers and the accounts you follow: the lists, your follower activity (who followed or unfollowed you and when) and your unfollow history stay as long as your account exists. The raw checks of the follower watch are deleted after 90 days, except those behind an entry in your follower activity.
  • Niche readings: the daily readings of the accounts in a niche sample you started are deleted after 60 days.
  • Images you attach: at most 24 hours on our server.
  • Free account checks: 30 days, then deleted together with the hash of the IP address that started them. The posts read for a check are deleted as soon as it finishes.
  • Free AI slop checks: 7 days, then deleted together with the hash of the IP address that started them. The posts read while a check runs are deleted as soon as it finishes; the scored posts stay with the check.
  • X access token: as long as your account exists. Revoking access in your X settings makes it unusable at once. Logging out ends the session in that browser only; it does not disconnect X, but signing out in every browser pauses the background work (see below).
  • Server logs: 30 days. Sessions: 30 days without activity.
  • Billing records: as long as tax and accounting law requires.
  • Analytics data and replays: for the retention periods configured in our self-hosted Umami and PostHog Cloud EU projects. Write to [email protected] for the current periods or to request deletion.

There is no delete button in the app. To delete your account and its data, write to [email protected]. We confirm by email; encrypted backups expire on a rolling schedule and the data disappears with them. Data is encrypted in transit; tokens are encrypted or hashed at rest.

Background reads and automations run only while you have used the app in the last 7 days in a browser where you are still signed in. Signing out everywhere, or not opening the app for 7 days, pauses them until your next visit. Revoking our access in your X settings stops everything done with your X access. To stop everything for good, ask us to delete your account.

8. Analytics and session replay

On these public landing pages, self-hosted Umami on our infrastructure records page views, referrers, screen size, browser and country as aggregated traffic statistics. A sample of public-page visits is recorded as clicks, scrolling and navigation for replay and heatmaps. Text entered into a field is masked, and the address shown after joining the waitlist is blocked from recordings.

The signed-in app uses the same self-hosted Umami for anonymous screen views and a few named product events, such as starting a checkout, sending a reply or running a search. Instead of the page address it records only the name of the app screen you are on (for example “Replies”), the event name and, for a switched setting, its new state, with screen size, browser, language and country. It receives no query, referrer, text you enter, post or reply content, X ids, handles, email addresses or account identifier. Umami sets no cookies, does not track you across other sites and does not store your IP address as such, and the data stays on our own server. Nothing is recorded while your browser sends Do Not Track.

Separately, the signed-in workspace can use an optional service: PostHog Cloud EU. The PostHog software is not loaded and no request is sent to it until you choose Allow analytics. After consent, it receives named product-interaction events, the known workspace section you visit and masked session replays, associated with a pseudonymous internal account id.

We do not send text you enter, post or reply content, drafts, query strings, arbitrary addresses, referrers, page titles, X ids, names, handles, email addresses or other X account details. All text, inputs and element attributes are masked in replays. Images and private-content subtrees are blocked, and link attributes are masked. PostHog may also process ordinary IP, network and browser metadata when your browser contacts its EU service.

Your allow-or-reject choice is stored for that account and browser in local storage. When allowed, PostHog also uses local storage, not cross-domain cookies. You can change the choice at any time through Privacy settings in the signed-in app; Turn off analytics stops future collection and resets the local analytics identity. Refusing or withdrawing does not limit the Service.

9. Optional saved comment analysis

Saved comment analysis is separate from workspace analytics. The signed-in app asks you to allow or decline it for your verified X profile; nothing is sent for this purpose until you allow it. Once allowed, background processing automatically selects eligible comments whose original identity is verified. Each comment may be sent once, with only its saved ancestor chain, to TypeSafe AI in the United States for the three fixed beta classifications described above. Under the same choice, new comments you have not answered are also scored for whether they are worth a reply, whether their author looks like a bot and whether they are important or simple reactions; for this TypeSafe AI receives the root post, the thread, the comment and the same author's other recent comments. Posts that mention you are sorted the same way from their own text and the post of yours they quote. The analysis itself never generates a reply or post; only Reply Assistant, if you switch it on, answers comments sorted as simple reactions, answers to your questions or friendly opinions, and other comments from people who don't follow you.

TypeSafe's published privacy policy says it does not train or fine-tune artificial-intelligence or machine-learning models on prompts or other input. We do not promise zero retention or a separately negotiated processing arrangement. See TypeSafe's privacy policy for its terms.

You can change this choice through Privacy settings in the signed-in app. Turning analysis off stops future comments from being admitted for external processing. A request already admitted may finish. We retain its once-only attempt status and any valid result with your workspace data so an uncertain or completed comment is not sent again; re-enabling does not reset it.

10. Optional AI reply suggestions

The AI button requests one suggestion for the selected comment. We send its saved text, the saved original post and a bounded set of saved ancestors to OpenAI. We do not fetch more X data for this action. Your unsent working draft is sent too when you use Rewrite draft with AI, or when Always improve with AI is on and you press Improve & reply. Each suggestion is also sent with the comment it answers to TypeSafe AI in the United States, which checks it. Opening a conversation or reloading the app does not request a suggestion. The returned text becomes an editable draft in your browser; only your separate send action publishes it. With Always improve with AI on, pressing Improve & reply is that send action: the improved text is published without another review.

Requests use OpenAI's API with response storage disabled. This is not a promise of zero retention: OpenAI may retain abuse-monitoring logs, normally for up to 30 days, subject to its published exceptions. OpenAI states that API data is not used for model training unless the API customer opts in. See OpenAI's API data controls.

11. Studio journal and daily plan

Studio sends nothing when you open or reload it. When you record a journal entry, your browser asks for access to your microphone and records for at most 5 minutes. The recording is sent through our server to OpenAI only to be transcribed; we discard it as soon as the transcript is back and never store or log it. The transcript, or the text you type instead, is kept as a journal entry. OpenAI then receives it with your current facts about you and your events of the last 14 days, to take new facts from it without repeating them; they are saved at once, and you can edit or archive each of them. Telling Studio about yourself in About me works the same way.

Only when you press Generate plan, Add more or Write follow-ups, we collect what the drafts are written from and send it to OpenAI: up to 40 facts about you and up to 40 events of the last 14 days; statistics of your own posts by theme and form with examples of your best posts and their impressions and replies; up to 16 of your own posts, so the drafts are written the way you write; your posts of the last 3 days and the drafts already in the plan, so nothing repeats; up to 30 of the most engaged posts of the last 48 hours from the niche sample you started in Patterns; and, for follow-ups, your post they continue with its numbers. TypeSafe AI in the United States checks each draft against the facts it cites and excerpts of your own posts; a draft that fails is rewritten once by OpenAI and checked again. Each draft keeps a copy of the facts it cites. Studio makes no request to X of its own: it uses posts already saved in your workspace.

After you generate a plan, and for 7 days after that, our server sends your own posts of the last 90 days that have no label yet, without replies or reposts, to OpenAI in batches of up to 120, each cut to 280 characters. OpenAI gives each a theme and a form (such as a question or a story); the labels feed the statistics above.

Nothing is published or scheduled without your click: a draft is scheduled only when you press Schedule and is then published at the time you chose, and a draft you open in the editor is published only by your separate send action there. The OpenAI API data controls and TypeSafe's privacy policy described above apply to these requests.

12. Free account check

The account check on the home page reads any public X account for free, without signing in. When you run one:

  • TwitterAPI.io receives the handle you enter and reads that account's public profile (name, handle, profile picture, bio and follower counts) and up to 200 of its own public posts from the last 14 days, without replies or reposts.
  • OpenAI writes the short read from that profile, the figures we compute and those posts.
  • Your IP address is stored only as a keyed hash, to allow one new check per visitor every 30 days and to limit how many checks a visitor can start in a day. The limit on tries per minute is kept in memory only.

Each check is kept for 30 days and then deleted with that hash. The posts read for it are deleted as soon as it finishes; the profile, the figures, up to three top posts and the written read stay for those 30 days. Checks are not published and have no public link, but anyone who enters the same handle within those 30 days is shown the stored check instead of a new one. Profile pictures in the result load straight from X's image server (pbs.twimg.com), which receives your IP address. The image you can copy or download is drawn in your browser and never sent to us.

The OpenAI API data controls described above apply. We run the check on the basis of legitimate interest: showing what the product does and keeping a free tool from being abused. The owner of a checked account can ask us to delete its check by writing to [email protected].

13. Free AI slop check

The AI slop check scores how much the latest posts of any public X account read like AI writing, for free and without signing in. When you run one:

  • TwitterAPI.io receives the handle you enter and reads that account's public profile and up to 20 of its latest public posts of its own from the last 12 months, without replies or reposts.
  • OpenAI scores the posts: it receives only their text, each cut to 1,000 characters, without the handle, the name or anything about you. It returns a score and the phrases that read like AI writing for each post, a one-line reason for those that read most like AI, and a one-sentence verdict.
  • Your IP address is stored only as a keyed hash, to allow one new check per visitor every 24 hours and to limit how many checks a visitor can start in a day. The limit on tries per minute is kept in memory only.

Each check is kept for 7 days and then deleted with that hash. It keeps the account's X id, name, handle and profile picture address, the scored posts with their dates, scores, highlighted phrases and reasons, and the verdict; the posts read while it runs are deleted as soon as it finishes. Anyone who enters the same handle within 24 hours is shown the stored check instead of a new one; after that the account is read again. A shared link opens the account's newest stored check within those 7 days. Profile pictures in the result load straight from X's image server (pbs.twimg.com), which receives your IP address. The image you can copy is drawn in your browser and never sent to us. Nothing is ever posted to the checked account.

The OpenAI API data controls described above apply. We run the check on the basis of legitimate interest: showing what the product does and keeping a free tool from being abused. The owner of a checked account can ask us to delete its check by writing to [email protected].

14. Cookies

One strictly necessary cookie keeps you signed in. Our self-hosted Umami statistics set no cookies and store nothing in your browser. If you arrive through a tagged link, its campaign tags are kept in your browser's session storage until you close the tab, so they can reach the app when you sign up. Optional PostHog analytics uses local storage only as described above, and the browser also stores your allow-or-reject choice. The Chrome extension, if you install it, keeps its token, the app address and its settings in Chrome's local extension storage, keeps the state of its X tabs and a running series in Chrome's session storage until Chrome closes, and sets no cookies. We do not use advertising cookies.

15. Your rights

If you are in the European Economic Area, the United Kingdom or another jurisdiction with similar rules, you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and you can lodge a complaint with your supervisory authority. To exercise a right, write to [email protected]; we answer within one month.

16. Changes

We may update this policy. Material changes are announced in the Service or by email at least 14 days before they take effect. The date at the top shows the current version.

17. Contact

Michał Florczak, NIP 5521733765, Poland
Email: [email protected]