XGrow AIStart free trial

Legal

Privacy Policy

Last updated: 27 June 2026

This Privacy Policy explains what personal data XGrow AI collects, why we collect it, and how you can control it. We built XGrow AI to handle your Twitter/X account and content responsibly — this page is written to be read, not skipped.

1. Data we collect

Account information

  • Name and email address you provide at registration
  • Password (stored as a one-way bcrypt hash — we never store or can see your plaintext password)
  • Subscription plan and billing status

Twitter / X account data

  • OAuth access and refresh tokens, encrypted at rest using AES-256-GCM
  • Your Twitter username, profile picture, and follower count, used to display your account in the dashboard
  • Engagement metrics (likes, retweets, impressions) on posts published through XGrow AI

Content you provide

  • Prompts you submit for AI content generation
  • Posts you write, schedule, or generate via the Service
  • Images, videos, documents, and links you upload to your media library

Usage data

  • Log data including IP address, browser type, and pages visited, used for security and product improvement
  • Audit logs of account actions (login, password changes, plan changes) for security purposes

2. How we use your data

  • To provide the Service: generating content, scheduling and posting to Twitter/X, running automations, and storing your media library
  • To process payments via our payment processor, Stripe
  • To send transactional emails: welcome messages, password resets, trial expiry reminders, and — if you opt in — a weekly growth digest
  • To detect and prevent fraud, abuse, and security incidents
  • To improve the Service based on aggregated, anonymised usage patterns

3. AI processing of your content

Prompts and content you submit for AI generation are sent to our AI model provider (Anthropic) solely to generate the requested content. We do not use your prompts or generated content to train third-party AI models beyond what is necessary to fulfil your request, and our AI provider's data handling is governed by their own enterprise data processing terms.

4. Where your data is stored

Account and content data is stored in PostgreSQL databases hosted on infrastructure located in the EU/UK or US, depending on your hosting region as configured by us. Uploaded media (images, videos, documents) is stored in Firebase Storage. Twitter OAuth tokens are encrypted before storage and are never exposed in API responses or logs.

5. Who we share data with

  • Twitter / X — to post content and read analytics on your behalf, via the official Twitter API, only after you explicitly connect your account
  • Stripe — to process subscription payments; we do not store your full card details
  • Anthropic — to generate AI content from your prompts
  • Resend — to deliver transactional emails
  • We do not sell your personal data to third parties, and we do not display third-party advertising in the Service

6. Your rights

Depending on your location, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing.

  • Export your data — Settings → Download my data, available at any time, provides a full export of your profile, posts, campaigns, and analytics as JSON
  • Delete your account — Settings → Delete account permanently removes your account and associated data, including media files, within 30 days
  • Opt out of marketing email — toggle the weekly digest off in Settings; transactional emails (password resets, billing receipts) cannot be disabled while your account is active

7. Data retention

We retain your data for as long as your account is active. Following account deletion, we remove personal data within 30 days, except where retention is required for legal, tax, or fraud-prevention purposes (in which case data is retained only as long as necessary for that purpose).

8. Cookies

We use essential cookies required for authentication and session management. We do not use third-party advertising or tracking cookies.

9. Children's privacy

The Service is not directed at individuals under 18. We do not knowingly collect personal data from children.

10. Changes to this policy

We may update this Privacy Policy periodically. Material changes will be communicated via email or an in-product notice before they take effect.

11. Contact us

For privacy questions, data access requests, or to exercise any of the rights above, reach us via our Contact page.