Privacy Policy

The short version

TweetX helps you write, schedule, and publish posts to X. We collect only what we need to run the service, we never sell your data, and we don't run advertising or analytics trackers on your account. You can export your workspace as JSON or ask us to delete it at any time.

Who we are

TweetX (tweetx.space) is operated by Alwyn Ventures ("TweetX", "we", "us"). For anything in this policy, including requests about your data, write to support@alwynventures.com. We act as the data controller for the personal data described below.

What we collect

We collect the following, and nothing beyond it:

• Account details: your name and email address, provided when you sign in with Google or an email magic link. If you use Google, we receive your basic profile (name, email, avatar). We never see your Google password.
• Workspace content: the posts, drafts, schedules, and settings you create in TweetX.
• X connection data: when you connect an X account, we store its handle, account ID, and public metrics such as follower counts, plus the OAuth tokens X issues so we can publish on your behalf. We never receive or store your X password.
• AI settings: your choice of AI provider and, if you bring your own key, that API key.
• Billing status: your plan, trial dates, and subscription state. When paid billing is live, card details are handled entirely by our payment processor. Card numbers never touch our servers.
• Log data: standard server logs from our hosting provider, including IP address, browser type, and request timestamps, used for security and debugging.
• Support messages: anything you send us by email.

How we use it

We use your data to run TweetX for you: storing your drafts, publishing posts to X when you tell us to, generating AI drafts you request, computing scheduling and engagement insights, and managing your plan. The legal basis for this is performing our contract with you.

We also use log and account data to keep the service secure, prevent abuse, and debug problems. The legal basis for that is our legitimate interest in running a safe, working service. Where the law requires us to keep or disclose something, we do so to comply with that legal obligation.

We do not use your data for advertising, and we do not make automated decisions about you that have legal or similarly significant effects.

AI features

When you use an AI feature, the text needed to fulfil your request (for example a draft or a prompt) is sent to an AI model provider. By default that provider is DeepSeek, using our server key. You can instead connect your own key for Anthropic (Claude), OpenAI (ChatGPT), xAI (Grok), or OpenRouter in Settings, in which case your requests go to the provider you chose under your own agreement with them.

We do not train models on your content, and we only send providers the content needed to answer your request. Bring-your-own keys are encrypted at rest and are only ever used to call the provider you connected them for.

Who we share it with

We share data only with the services that make TweetX work, and only for the purposes described here:

• X Corp: to publish the posts you schedule, and to read the public metrics we show you.
• Supabase: our database and authentication provider, which stores your account and workspace data.
• Vercel: our hosting provider, which serves the app and processes server logs.
• AI providers: DeepSeek by default, or the provider you connect a key for, as described above.
• A payment processor, once paid billing is live, to handle subscriptions and card payments.

What we never do

We never sell your personal data. We never share it with advertisers or data brokers. We never post to your X account without an instruction from you. And no TweetX code path can read your X tokens or AI keys in plain text outside the encrypted publishing flow.

Cookies

TweetX sets only the cookies needed to keep you signed in (session cookies from our authentication provider). We use no advertising cookies and no third-party analytics trackers, which is why you won't see a cookie banner here.

Where your data lives

Our infrastructure providers operate in the United States and other countries, so your data may be processed outside the country you live in. Where data moves out of the EEA or UK, we rely on recognised safeguards such as the EU standard contractual clauses or an adequacy decision, and our providers commit to them in their data processing terms.

Security

All traffic to TweetX is encrypted in transit. X OAuth tokens and bring-your-own AI keys are encrypted at rest with AES-256-GCM and stored in tables that only our server can read. Database access is scoped per workspace, so members of one workspace can never read another's data. No system is perfectly secure, but if we ever discover a breach affecting your data we will notify you without undue delay.

How long we keep it

We keep your data for as long as your account is active. When you disconnect an X account, its tokens are deleted. When you delete your workspace or ask us to delete your account, we remove your data within 30 days, and it ages out of encrypted backups within a further 30 days. Server logs are kept for a short rolling window for security purposes. We may retain minimal billing records where tax law requires it.

Your rights and choices

You can export your entire workspace as JSON from Settings at any time, disconnect X accounts whenever you like, and remove any AI key you added.

Depending on where you live, you also have legal rights over your data: to access it, correct it, delete it, receive a portable copy, object to or restrict certain processing, and withdraw consent where processing is based on consent. To exercise any of these, email support@alwynventures.com and we will respond within one month. If you are in the EEA or UK you can also complain to your data protection authority; if you are in India you can raise a grievance with us first and then with the Data Protection Board of India.

Children

TweetX is not directed to children and you must be at least 16 to use it. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top and tell you in the app or by email before the change takes effect. Continuing to use TweetX after that means you accept the updated policy.

Contact

Questions, requests, or complaints about privacy: support@alwynventures.com. A human reads and answers every message.