Privacy Policy

Last updated: July 19, 2026 (Version 2.2.2 - Data Retention Clarity Update)

At TweetReplier, we take your privacy seriously. This policy explains what data we collect, how we use it, and your rights.

What We Collect

Information You Provide

• Account Information: Email address, name (if provided via Google OAuth)
• Tester Applications: If you apply to a research program, we collect the form details you submit, including your X username, workflow, tools used, purchase intent, and feedback responses
• User Profile: Writing style preferences, topics of interest, tone settings
• Subscription Data: Selected plan tier, billing interval (monthly/yearly), payment method (handled by Polar)

Automatically Collected Information

• Usage Data: Number of AI generations used for quota enforcement and billing
• Quality Monitoring Data: When quality monitoring is enabled, the original post, generated reply, selected tone, model metadata, and limited engagement metrics may be stored under your account for batch quality analysis
• Device Information: Device fingerprint for session management (max 3 concurrent sessions per account)
• IP Address: For security, fraud prevention, and rate limiting

Twitter/X-Related Data

• Tweet Context: Text of tweets you actively choose to reply to, plus visible conversation context needed for that request. Routine generation requests are processed temporarily; a limited copy may be stored separately when quality monitoring is enabled as described above.
• Source Content: Web pages, notes, or text you paste for tweet generation (processed in-memory, NOT stored on our servers)
• Auto-Collect Library: Viral tweet examples you choose to save or that qualify for Auto-Collect are stored only in your browser's local extension storage

What We DO NOT Collect from Twitter/X:

• Your Twitter/X password, authentication cookies, or OAuth tokens
• Your Twitter/X Direct Messages
• Your Twitter/X followers or following lists
• Tweets from your timeline (except those you actively interact with using our extension)

How We Use Your Data

We use collected information to:

• Provide Service: Generate AI replies, tweets, rewrites, and analysis based on your input and preferences
• Personalization: Customize reply generation using your profile, writing style, tone preferences, and your own examples when you choose persona training
• Usage Enforcement: Track generation counts, prevent abuse, and enforce subscription tier limits
• Security: Detect fraudulent activity, prevent credential sharing, and manage concurrent sessions
• Billing: Process payments, manage subscriptions, and send payment receipts via Polar
• Communications: Send service updates, security alerts, and billing notifications (NO marketing emails without explicit consent)
• Product Research: Score tester-program applications using the answers you submit, administer time-limited research access, request private feedback, and measure whether the program leads to a paid subscription
• Legal Compliance: Respond to legal requests, enforce Terms of Service, and protect our rights

AI Data Usage & Training

Critical Clarification - Your Data is NOT Used to Train AI Models:

TweetReplier uses third-party AI models through OpenRouter. We do not use your prompts, tweet context, source material, persona examples, or generated content to train a TweetReplier model.

Generation Requests:

TweetReplier sends the text needed for your requested generation to OpenRouter and the selected AI model provider. The generation endpoint does not retain routine tweet context, source material, or generated output after the request completes. When quality monitoring is enabled, a limited copy of the original post and generated reply may be stored separately under your account for batch analysis. Third-party processing is governed by the applicable provider policies.

What We DO NOT Do:

• Use your content to fine-tune or train any AI models
• Sell or license your content to third parties
• Publicly display your generated tweets without explicit permission
• Retain source material after the generation request completes, or retain routine generation content except for the separate quality-monitoring records described in this policy

Data Storage & Security

Local Storage: Your preferences, tone settings, user profile, usage cache, and Auto-Collect library are stored in Chrome extension storage. Chrome sync may synchronize eligible settings through your signed-in Chrome profile.

Server Storage: Account data, sessions, subscription information, usage counts, persona examples you explicitly submit for persona training, and any quality-monitoring records described above are stored on our backend services. Source material and routine generation content are not retained by the generation endpoint.

Security Measures: We use encrypted HTTPS connections, authenticated API access, and access controls appropriate to the service.

Third-Party Services & Data Sharing

AI Model Providers:

• OpenRouter: Routes TweetReplier backend requests to AI model providers. They process your prompts to generate replies but do NOT receive your payment details or account billing data.
• Data Sent: The prompt needed for the feature you request, which may include tweet context, source material, profile preferences, or persona instructions
• Data NOT Sent: Your account information, email, payment details, or usage statistics are NOT shared with AI providers.

Authentication & Payment:

• Google OAuth: For account sign-in if you choose Google instead of email login. We receive only basic profile info (name, email, profile picture). Google's Privacy Policy applies.
• Polar.sh: Payment processing for subscriptions. They handle all credit card data (we never see full card numbers). Polar Privacy Policy applies.

Infrastructure & Hosting:

• Railway: Backend API hosting for account, session, subscription, and usage services
• Neon: PostgreSQL database hosting for user accounts, sessions, and usage tracking.
• Cloudflare: Website hosting and CDN for tweetreplier.com

Data Minimization Principle:

We share only the minimum data necessary for each service to function. For example, AI providers only receive the prompt needed to generate a reply, not your email or payment information.

Data Retention

• Account Data: Retained while your account is active
• Generation Content: Tweet context, source material, and generated drafts are processed for the request and are not retained by the generation endpoint afterward
• Quality Monitoring Records: When enabled, limited original-post and generated-reply records are retained for quality and service improvement until removed under our operational retention process or the associated account is deleted
• Persona Training Data: Retained until you reset persona training or delete your account
• Usage Stats: Retained for billing and service improvement
• Deleted Accounts: All personal data deleted within 30 days of account deletion

Your Rights (GDPR, CCPA & Global Privacy Laws)

If you are in the European Union (GDPR):

• Right to Access: Request a copy of all personal data we hold about you
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format (JSON export)
• Right to Object: Object to our processing of your data for certain purposes
• Right to Withdraw Consent: Withdraw consent for data processing at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

If you are in California (CCPA/CPRA):

• Right to Know: Know what personal information we collect, use, disclose, and sell
• Right to Delete: Request deletion of your personal information (subject to certain exceptions)
• Right to Opt-Out: We do NOT sell personal information, so no opt-out is necessary
• Right to Non-Discrimination: We will not discriminate against you for exercising your rights
• Right to Correct: Request correction of inaccurate personal information

For All Users Globally:

• Access Your Data: Email privacy@tweetreplier.com with subject "Data Access Request"
• Export Your Data: Request an export of account data and usage information we hold
• Delete Your Account: Account settings → Delete Account, or email privacy@tweetreplier.com
• Update Preferences: Manage data collection preferences in extension settings

Data Deletion Timeline:

• Account data deleted within 30 days of deletion request
• Persona training data deleted when you reset it or delete your account
• Anonymized usage statistics may be retained for business intelligence (cannot be tied back to you)
• Billing records retained for 7 years per financial regulations

How to Exercise Your Rights:

Email privacy@tweetreplier.com with:

• Your account email address
• Specific right you're exercising (access, deletion, correction, etc.)
• Government-issued ID verification (required for deletion/access requests to prevent fraud)

We will respond to all requests within 30 days (or 45 days if complex, with notification).

Children's Privacy

TweetReplier is not intended for users under 13 years old. We do not knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. We'll notify users of significant changes via email or extension notification.

Twitter/X Data Handling & Compliance

Important Clarification:

TweetReplier is a third-party tool and is NOT affiliated with, endorsed by, or operated by Twitter, Inc. or X Corp. We comply with Twitter/X Developer Agreement and API terms.

How We Handle Twitter/X Data:

• Tweet Text: When you use our extension to reply to a tweet, we temporarily process the tweet text to generate context-aware replies. This text is NOT stored permanently on our servers.
• Local Examples: Auto-Collect examples remain in Chrome extension storage unless you clear them or uninstall the extension.
• DM Access: We do NOT access your Twitter/X Direct Messages.
• No Timeline Scraping: We do NOT scrape your timeline or collect tweets you didn't actively interact with using our extension.

International Data Transfers

Your data may be processed in the United States where our servers (Railway, Neon) are located. If you are located in the EU, EEA, or UK, your data is protected by:

• Standard Contractual Clauses (SCCs) with our hosting providers
• Data encryption in transit and at rest
• Your rights under GDPR remain enforceable regardless of where data is processed

Data Breach Notification

In the unlikely event of a data breach affecting your personal information, we will:

• Notify affected users within 72 hours of discovery
• Provide details on what data was affected and steps we're taking
• Offer guidance on protecting your account (password reset, session revocation)
• Notify relevant data protection authorities as required by law

Contact Us

Privacy & Data Protection Inquiries:

• General Privacy Questions: privacy@tweetreplier.com
• Data Access/Deletion Requests: privacy@tweetreplier.com (include "Data Request" in subject)
• GDPR/CCPA Compliance: privacy@tweetreplier.com (include your region)
• Data Breach Reports: security@tweetreplier.com

Formal Notices:
Email legal@tweetreplier.com to request the current mailing address for legal or privacy notices.

← Back to Home