Privacy

What we collect

• Your email address, from checkout or a sign-in link. It identifies your account and is where we send sign-in links and service notices.
• The site you give us. We fetch its public pages — homepage, pricing, docs, changelog, and a GitHub README and releases when the link is a repository — and store the extracted text and the list of URLs we read. Only pages a normal visitor can reach without logging in.
• Your X connection. When you connect X we store an access token, a refresh token, your X user id, username and display name. We also import your recent public posts and keep them as writing samples, so drafts sound like you.
• The posts themselves — drafts, your approvals and edits, schedule times, and the id and URL of anything published.
• Billing data held by Stripe. Stripe processes payments and stores your card. We never see or store card numbers; we keep the Stripe customer and subscription identifiers and your plan status.
• Operational records — a session cookie, and a usage ledger counting AI tokens and posts published so we can see what an account costs to run.

What we don't do

• We don't sell your data or share it for advertising.
• We don't read your private X messages, and we don't post anything you haven't approved unless you switch autopilot on yourself.
• We don't crawl pages behind a login, and we respect a site that refuses our requests.
• We don't use your product's content or your posts to train our own models.

Who processes it

Running this service means sending some data to companies that do a specific job for us:

• Cloudflare — hosting, database, file storage. Your data lives here.
• Anthropic — the model that reads your site and writes the drafts. Your site text and writing samples are sent as prompts.
• X (X Corp.) — reading your recent posts and publishing new ones on your behalf.
• Stripe — payments and subscription state.
• Resend — sending sign-in links and service email.

How long we keep it

Account and project data stays until you delete it or ask us to. Disconnecting X deletes the stored tokens. Deleting a project removes its crawl text, drafts, published-post records and writing samples. Billing records are kept as long as tax and accounting rules require, which is longer than the rest.

Your choices

• Disconnect X at any time, from the dashboard or from your X account's connected-apps settings. Revoking access there stops us immediately.
• Cancel the subscription and posting stops at the end of the period.
• Ask for a copy of your data, or its deletion, at hello@postautomation.ai. We'll act on it within 30 days.

If you're in the UK or EEA, you have rights of access, correction, deletion, portability and objection under the GDPR, and you can complain to your local supervisory authority.

Cookies

One cookie, xpa_session, which keeps you signed in. It is signed, http-only, and holds nothing but a session identifier. No advertising or analytics cookies.

Security and changes

Access tokens and secrets are stored server-side and never sent to the browser. If we change this policy in a way that matters, we'll say so by email before it takes effect. Material questions, complaints and data requests all go to hello@postautomation.ai.