Privacy Policy

plotpost (“we”, “us”) is a tool for writing, scheduling and analysing posts on X, with an optional browser extension. It is run by an individual, who decides how your data is used. For anything about your data, write to [email protected].

This policy covers plotpost.ai, the dashboard, the browser extension and the connectors for AI apps. Using the service also means accepting our Terms of Service.

We only collect what the product needs to work:

• Account. Your email address, if you sign in with email or add one, and your time zone. We do not ask for your name and we have no passwords: you sign in with a one-time code by email or with X.
• Sessions. When you sign in we store the IP address and browser (user agent) that signed in, so a session can be recognised and abuse stopped. The sign-in email shows the device and country it was asked from.
• Connected X accounts. When you connect an account with X’s official login, X gives us access tokens. We store them encrypted and use them to publish what you schedule and read your profile. We also keep your public profile (handle, name, picture, bio, banner, location, website, verification, follower and post counts). We never see your X password.
• Your content. Campaigns, posts, threads, drafts, schedules, the briefs you give our AI (persona, goal, voice), AI reports, automation settings and the reply texts you write.
• Images you upload for posts, or that an AI app you connected sends us for a campaign.
• Analytics. Follower, following and post counts over time, and the text and numbers (views, likes, replies, reposts, quotes, bookmarks) of your own posts.
• Writing styles. When you learn a style, we read recent public posts of that account and keep a sample of them with our AI’s description of the style.
• Billing. Your plan, credits and every credit change, invoices and payments. For USDC payments, the wallet address you paid from and the transaction id. For partners, the payout wallet you enter and who you referred.
• Extension activity, described in the next section.

The extension is optional. It only runs in the browser where you install it and pair it with your account, and only on x.com. To work, it:

• Reads which X account is signed in on x.com (from X’s user id cookie), so its work goes to the right account.
• Reads the data x.com itself loads in your tab: your following list, timelines, search results, profiles and posts you open. It sends to us what the feature you use needs: your following list (with each account’s public profile and whether it follows you back), candidate accounts and posts for the growth tools you switch on, your profile and post numbers, and post samples for writing styles.
• Performs the actions you set up (follows, unfollows, likes and replies) in your own x.com tab, and reports what it did.
• Sends us an activity log of what it did and any errors, so you can watch it from the dashboard and we can fix problems.
• Keeps a device token and its own settings in the browser’s extension storage.

It does not read your direct messages, your X password or other websites, and it does not publish posts: posts go out through X’s official API. You can revoke a paired browser from the Extension page at any time, or remove the extension.

Some features handle public information about other X accounts: the accounts you follow, accounts and posts the growth tools find, and the public posts of accounts whose writing style you learn. We use it only to provide those features to you. Style descriptions are made from writing patterns, and we do not use them to impersonate anyone. If you are an X user and want your information removed, write to [email protected].

• To run the service: sign you in, publish on schedule, run the AI and the extension, show analytics, count credits and take payments.
• To keep it safe: rate limits, fraud and abuse checks (including partner program rules) and debugging.
• To improve it: we look at how features are used in aggregate. Writing style descriptions may be used, without the account’s posts, to improve our AI and the library of ready-made styles.
• To email you sign-in codes. We do not send newsletters or marketing email, and our emails have no open or click tracking.

We do not sell your data, do not show ads, and do not use your posts or content to train AI models. Where the GDPR or similar laws apply, our legal bases are performing our contract with you, our legitimate interest in keeping the service secure and working, and legal obligations (such as keeping payment records).

Only with services that help us run plotpost, and only what each needs:

• X: what you publish and the requests made with your account’s tokens go to X under X’s own privacy policy.
• Anthropic (Claude): the text our AI works on, such as campaign briefs, posts and their numbers, and style samples. Anthropic does not train its models on this data.
• Postmark: your email address, to deliver sign-in codes.
• twitterapi.io: the public handle of your connected account, to fetch public post numbers when the extension has not refreshed them.
• Cloudflare: sits in front of our site and sees requests, including IP addresses.
• Card payment providers (Dodo Payments or Paddle) when you pay by card. They act as the seller of record, collect your card and billing details themselves and handle tax. We only receive the payment status, never your card number.
• The Solana blockchain: USDC payments and partner payouts are public transactions that anyone can see. We cannot change or delete them.
• AI apps you connect (ChatGPT, Claude, Cursor or others): they can read your accounts’ setup, plan, credits and campaigns and create campaign drafts, as allowed on the consent screen.
• Ahrefs Web Analytics on public pages, described under Cookies.

We store data on servers we manage. We may disclose data if the law requires it, to protect the service or its users, or to a successor if plotpost is transferred, under this policy. Some of these providers process data in other countries, including the United States.

• Session cookie: keeps you signed in for up to 30 days. A short-lived cookie protects signing in with X.
• Referral cookie: if you arrive through a partner link, we remember the partner code for 30 days, so the partner is credited if you sign up.
• Browser storage in the dashboard for things like the selected account, dismissed tips and unsaved AI drafts.
• Ahrefs Web Analytics counts visits on public pages only (never in the dashboard or sign-in), without cookies or personal profiles.

We do not use advertising or cross-site tracking cookies. Card checkout pages are served by the payment provider, which may set its own cookies.

• Sign-in codes expire after 10 minutes. Sessions last up to 30 days and are deleted, with their IP address and browser, within a day of running out.
• Extension activity logs are kept for 30 days.
• Accounts you no longer follow drop out of your synced following list.
• Your account, content, images and analytics are kept while your account exists, so your history stays available after a plan ends.
• Disconnecting an X account deletes its tokens; its posts and history stay in your workspace until you delete them or your account.
• A writing style you delete disappears from your workspace; we may keep it for the uses above unless you ask us to erase it.
• Payment and payout records are kept as long as tax and accounting rules require, even after an account is deleted.

You can delete posts and campaigns, disconnect X accounts, revoke extension browsers and connected AI apps, and sign out, all from the dashboard. Disconnecting an X account also revokes plotpost’s access at X, and you can revoke it yourself in your X settings.

You can delete your account and everything in it yourself, under Account in the dashboard. It happens at once: your content, images and analytics are deleted, and plotpost’s access to your X accounts is revoked. Payment and payout records stay, as described above.

To get a copy of your data or correct it, or if you cannot sign in to delete your account, email [email protected] from the address on your account, or tell us your X handle and we will check it is you. We answer within 30 days. Depending on where you live (for example the EU, UK or California), you may also have the right to object to or restrict some uses and to complain to your data protection authority.

Connections are encrypted (HTTPS). X tokens are encrypted at rest, and session, extension and AI-app tokens are stored only as hashes. Access to production data is limited to the operator. No system is perfectly secure; if a breach affects your data, we will tell you as the law requires.

plotpost is not for children under 13, and we do not knowingly collect their data. If you believe a child under 13 uses it, write to [email protected] and we will delete the account.

We will update this page when what we collect or how we use it changes, and change the date at the top. For bigger changes we will tell you in the dashboard or by email. Questions: [email protected].