This policy explains what GrowYourX (“GrowYourX”, “we”, “us”) collects when you use the GrowYourX web app, browser extension and API (the “Service”), why we collect it, and the choices you have. We are the controller of the personal data described here. If you have questions, contact us at support@growyourx.so.
1. What we collect
Account data
- Your email address, display name, a hashed password (never the password itself), plan, timezone, streaks, and sign-in and activity timestamps.
- Records of password-reset requests you make.
Your connected X accounts
- The X account identifier, handle and display name of each account you connect, and the connection status.
- The OAuth access token and secret issued when you authorize GrowYourX. These are encrypted at rest and are decrypted only to call the X API on your behalf. We never receive or store your X password.
Your work in the Service
- Drafts, scheduled posts and threads, uploaded media, publishing history, saved posts, and posts used to calibrate your writing voice.
- Competitor and watch lists, engage lists, keywords, saved mentions and replies, alert rules, and your chat history with the built-in assistant (including any actions it proposes or performs at your request).
Metrics and usage data
- Public post metrics and engagement baselines we read back from the X API for accounts you track or watch.
- Usage events and counters (for example, draft and API usage) and link-click or revenue-attribution events for links you choose to track.
Credentials for integrations
- API keys you generate for the Bearer API and tokens for the browser extension, stored so we can authenticate your requests.
Operational data
- Basic request, error, job-run and diagnostic logs used to keep the Service running, secure and debuggable.
Cookies
- A session cookie set when you sign in so the server knows who you are.
- Short-lived, HttpOnly cookies used only during the X authorization handshake; they are cleared when the handshake finishes and expire within about ten minutes.
- We do not use advertising cookies or third-party ad trackers.
2. How we use it
- to create and secure your account and sign you in;
- to provide the features you ask for — drafting, scheduling, publishing, engagement, analytics and the assistant;
- to publish to X only when you approve or schedule it, and to read back the metrics you ask to see;
- to prevent abuse, enforce limits, and keep the Service and your account secure;
- to process payments if you subscribe to a paid plan, and to provide support; and
- to understand usage and improve the Service.
3. Legal bases
Where the General Data Protection Regulation (or UK GDPR) applies, we process personal data on these bases: performance of our contract with you (to provide the Service); our legitimate interests (to secure, operate and improve the Service); your consent (where we ask for it, for example to connect an X account); and compliance with legal obligations (such as tax and accounting).
4. AI processing
When you use an AI feature, the text and context you send for that request are transmitted to a configured AI provider to generate the result. We currently use DeepSeek as the primary provider, with OpenAI as a fallback, and we may change providers over time. We do not use your content to train our own models. Each provider processes the request under its own terms and privacy policy. Please avoid putting sensitive personal data into prompts.
5. When we share data
We do not sell your data and we do not share it with advertisers. We share data only with the processors needed to run the Service:
- X (formerly Twitter) — to read and publish through its API on your behalf;
- Database and authentication hosting (self-hosted Supabase/PostgreSQL);
- Infrastructure hosting (servers in the European Union) and DNS/CDN providers;
- AI providers (DeepSeek, OpenAI) for the AI features you use;
- Email providers for transactional email such as password resets and security notices;
- Payment providers if you subscribe to a paid plan.
We may also disclose data if the law requires it, to protect rights and safety, or as part of a business transfer.
6. International transfers
Our primary hosting is in the European Union. Where data is processed outside your country, including by the providers above, we rely on appropriate safeguards such as standard contractual clauses.
7. How long we keep it
We keep your data while your account is active, and for a limited period afterwards where we need it for legal, security or backup purposes. X authorization-handshake cookies last only minutes. Operational logs are kept for a limited period and then removed.
8. Security
We encrypt your X access tokens at rest, serve the Service over HTTPS/TLS, restrict access to production systems, and hash stored API and integration credentials. No service can be perfectly secure, so please protect your password and keys and tell us right away if you suspect a problem.
9. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to receive it in a portable format, and to withdraw consent. You can:
- update your name, timezone and password, and disconnect X, from the Settings page;
- revoke GrowYourX’s access at any time from your X account settings, which stops all future API calls immediately; and
- request a copy of your data or ask us to delete your account and stored data by emailing support@growyourx.so.
When we delete your account, we remove your account record, drafts, scheduled posts, stored tokens and metrics. You also have the right to lodge a complaint with your local data-protection authority.
10. Children
The Service is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will remove it.
11. Changes to this policy
We may update this policy from time to time. If we make a material change, we will notify you in the app or by email before it takes effect, and we will update the date at the top of this page.
12. Contact
Privacy questions or data requests: email support@growyourx.so.