Privacy Policy

1. Information We Collect

When you use XReposter, we collect:

• Account Information: Your email address and basic profile information provided when you sign in with X, Google, or a magic link
• Post Data: Your public posts and their engagement metrics (likes, replies, reposts, views)
• OAuth Tokens: Encrypted access tokens to post on your behalf
• Usage Data: How you interact with our service (schedules created, reposts executed)
• Website Analytics: Aggregate traffic information such as pages visited, referral source, browser, device type, and approximate location

2. How We Use Your Information

We use your information to:

• Provide the XReposter service (scheduling and reposting content)
• Display your post history and engagement metrics
• Send requested sign-in links and essential service communications
• Improve our service and fix bugs
• Comply with legal obligations

3. Data Storage & Security

Your data is stored in access-controlled databases. OAuth access and refresh tokens are encrypted at rest using AES-256-GCM with server-only key material. We also use encrypted transport, restricted production access, and other safeguards appropriate to the service.

We retain cached posts, schedules, billing records, and activity history while your account is active so the service can operate. We may retain limited records after deletion when required for security, fraud prevention, billing, or legal compliance.

4. Data Sharing

We do not sell your personal information. We may share data with:

• X/Twitter: To read your posts and publish reposts on your behalf
• Stripe: To process payments (they receive your email and payment info)
• Service Providers: Hosting and infrastructure providers who process data on our behalf
• Google and Resend: To provide Google sign-in and requested email magic links
• Plausible Analytics: To measure aggregate website traffic and improve XReposter. Plausible does not use cookies or persistent identifiers and does not track visitors across websites.

5. Your Rights

You can:

• Disconnect your X account at any time from Settings
• Delete schedules and request removal of cached content
• Request a copy of your data by contacting us
• Request deletion of your account and all associated data

6. Contact Us

For privacy-related questions, contact us at privacy@xreposter.com