Privacy Policy

Last updated: June 2026

This Privacy Policy explains how xposter.app ("we", "us") collects, uses, and protects your personal information when you use our Service.

1. Information We Collect

We collect the following information:

• Account data: Email address and hashed password when you register
• Usage data: Content you generate, prompts you submit, and your credit transaction history
• Payment data: Payment processing is handled entirely by LemonSqueezy. We never see or store your card or payment details
• Technical data: IP address (for rate limiting and abuse prevention), request timestamps

2. How We Use Your Information

• To provide and operate the Service
• To process credit purchases and manage your account balance
• To prevent abuse, fraud, and unauthorised access
• To send essential service communications (account confirmation, credit receipts)
• We do not sell your data to third parties

Legal basis for processing (GDPR Article 6):

• Contract performance — processing your account data and usage data is necessary to provide the Service you signed up for
• Legitimate interests — we collect IP addresses and request timestamps to prevent abuse, fraud, and unauthorised access
• Legal obligation — we may process data where required by applicable law

3. AI Processing

Content you submit for generation is sent to Anthropic's Claude API to produce output. Anthropic's own privacy policy and data practices govern how they handle API inputs. We do not use your prompts to train our own models.

4. Data Storage

Your account data and generated posts are stored on our server in the European Union. Passwords are hashed using bcrypt and are never stored in plain text.

5. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data (right to be forgotten)
• Portability: Request your data in a machine-readable format
• Objection: Object to processing of your personal data
• Complaint: Lodge a complaint with your local data protection authority (e.g. the relevant EU supervisory authority in your country of residence)

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

Data breaches: In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with applicable law.

6. Cookies

We use a single authentication token stored in your browser's local storage to keep you logged in. We do not use tracking cookies or third-party analytics cookies.

7. Third-Party Services

• LemonSqueezy — payment processing. Subject to LemonSqueezy's Privacy Policy
• Anthropic Claude API — AI generation. Subject to Anthropic's Privacy Policy
• Google Fonts — typography loaded from Google's CDN on the landing page

8. Data Retention

We retain your account data for as long as your account is active. If you request deletion, we will remove your personal data within 30 days.

9. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. In certain EU member states the age of digital consent is 16 — if you are under this age, please obtain parental consent before registering.

10. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or in-app notice at least 14 days before they take effect. For material changes that affect how we process your personal data, we will seek your explicit consent where required by law. Continued use of the Service after the effective date of non-material updates constitutes acceptance of the revised policy.

11. Contact

Questions or data requests? Email us at [email protected].