Privacy Policy

1. Data we collect

Account data — email address, display name, and a hashed password. Passwords are stored only as bcrypt hashes; password reset and email verification use single-purpose, expiring tokens.

Workspace content — your voice profile, ideas, drafts, uploaded images, engagement targets, captured posts, and reply drafts. This content exists so the product can work; it is never used to train AI models.

X connection — when you connect your X account we store your X account id, username, profile image URL, and OAuth tokens. Tokens are stored only in AES-256-GCM encrypted form and are used solely to perform the actions you trigger (publishing approved content, reading your own recent posts, looking up accounts you add).

Billing data — subscription status, plan, and Stripe identifiers. Card details are collected and stored by Stripe, not by us.

Usage data — per-month counters (AI generations, posts and replies published, X lookups) used to enforce plan quotas, plus operational logs. Logs redact credentials and tokens.

2. How we use data

To provide the service, process subscriptions, enforce plan limits, secure accounts, respond to support requests, and meet legal obligations. We do not sell personal data and we do not use your content for advertising.

3. Processors we share data with

Stripe (payments), Cloudflare R2 (image storage), X Corp (publishing and reading via the X API, at your direction), our AI providers xAI and OpenAI (the text needed to generate your drafts and replies), and Resend (transactional email). Each receives only what its function requires.

4. Retention and deletion

Workspace data is retained while your account is active. Disconnecting your X account revokes and deletes its tokens. Detaching or deleting draft images removes them from storage. If you delete your account or ask us to, we delete your workspace data within 30 days, except records we must keep for accounting or legal compliance (such as invoices).

5. Security

All traffic is encrypted in transit. Social tokens are encrypted at rest with keys held outside the database. Access to production systems is restricted to the operator. No system is perfectly secure; if a breach affects your data we will notify you without undue delay.

6. Your rights

You can access and edit your data in the product, export your content, and request a copy or deletion of your personal data by contacting support@postpulse.app. Depending on your location you may have additional rights (such as under GDPR or CCPA), which we honor on request.

7. Changes

We will announce material changes to this policy by email or in the product before they take effect.

8. Contact

Privacy questions and requests: support@postpulse.app.