Privacy Policy

Last updated: August 2026

This Privacy Policy explains how xposter.app ("we", "us") collects, uses, and protects your personal information when you use our Service.

Who is responsible for your data

xposter.app is operated from Türkiye and is the data controller for the personal data described in this policy. For any question about this policy, or to exercise the rights listed in section 5, contact [email protected]. We answer data requests within 30 days.

1. Information We Collect

We collect the following information:

• Account data: Email address and hashed password when you register
• Usage data: Content you generate, prompts you submit, and your credit transaction history
• Payment data: Payment processing is handled entirely by LemonSqueezy. We never see or store your card or payment details
• Technical data: IP address and request timestamps, used for rate limiting and abuse prevention and kept in server logs for 14 days. We do not store your IP address against your account.

2. How We Use Your Information

• To provide and operate the Service
• To process credit purchases and manage your account balance
• To prevent abuse, fraud, and unauthorised access
• To send essential service communications (account confirmation, password reset, credit receipts)
• To send occasional product emails, reminders and occasional questions about how you are finding the Service. These are never advertising, and every one of them can be stopped: use the unsubscribe link in the email, or reply asking us to stop, and we will not send you another. Essential service communications continue either way, because they are part of running your account.
• We do not sell your data to third parties

Legal basis for processing (GDPR Article 6):

• Contract performance, processing your account data and usage data is necessary to provide the Service you signed up for
• Legitimate interests. We collect IP addresses and request timestamps to prevent abuse, fraud, and unauthorised access; the same basis covers the occasional product emails described above, which you can opt out of at any time
• Legal obligation. We may process data where required by applicable law

3. AI Processing

Content you submit for generation is sent to Anthropic's Claude API to produce output. Anthropic's own privacy policy and data practices govern how they handle API inputs. We do not use your prompts to train our own models.

4. Data Storage

Your account data and generated posts are stored on our server in the European Union. Passwords are hashed using bcrypt and are never stored in plain text.

5. Your Rights

You have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data (right to be forgotten)
• Portability: Request your data in a machine-readable format
• Objection: Object to processing of your personal data
• Complaint: Lodge a complaint with your local data protection authority (e.g. the relevant EU supervisory authority in your country of residence)

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

Data breaches: In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with applicable law.

6. Cookies

We use a single authentication token stored in your browser's local storage to keep you logged in. We do not use tracking cookies or third-party analytics cookies.

7. Third-Party Services

The Service depends on the providers below. We list what each one receives, because "third-party services" without that detail tells you nothing useful.

• Anthropic (Claude API), receives your prompts, your persona/voice profile and the content being generated or polished. Subject to Anthropic's Privacy Policy. We do not use your prompts to train any model, and we have not opted into training on our API traffic.
• Voyage AI, receives the text of your posts to compute embeddings, which we use to avoid generating something you have already written. Subject to Voyage AI's Privacy Policy.
• LemonSqueezy, payment processing and subscription management; receives your email address and billing details. LemonSqueezy is the merchant of record. Subject to LemonSqueezy's Privacy Policy. We never receive or store your card number.
• Cloudflare, content delivery, TLS termination and protection against abuse. All traffic to the Service passes through Cloudflare, so it processes your IP address and request metadata on our behalf. Subject to Cloudflare's Privacy Policy.
• Resend, transactional email delivery (account confirmation, password reset, receipts); receives your email address and the message content. Subject to Resend's Privacy Policy.
• Google. Google Identity Services if you choose to sign in with Google (we receive your email address and name), and Google Fonts on the landing page (Google receives your IP address). Subject to Google's Privacy Policy.
• X (Twitter) API, only if you connect your X account. We store the access tokens X issues us, and send the post text when you ask us to schedule or publish. You can disconnect at any time from your profile page, which deletes the stored tokens. Subject to X's Privacy Policy.
• Public X mirrors (nitter instances), used by the profile scan feature to read public posts. The handle you ask us to scan is sent to whichever mirror is responding; these are independent operators we do not control. The scan reads only publicly visible posts.
• Google News RSS. When a mode uses current context, the topic you typed is sent as a search query to retrieve related headlines.
• CoinGecko and Yahoo Finance, market context for finance and crypto modes. These requests use fixed symbols and contain no data about you.

8. International Data Transfers

Our server and your stored data are located in the European Union (Germany). However, several of the providers listed above operate outside the EU, principally in the United States: Anthropic, Voyage AI, LemonSqueezy, Resend, Google and X. Using the Service therefore involves transferring personal data outside the EEA.

These transfers rely on the transfer mechanisms offered by each provider. Standard Contractual Clauses adopted by the European Commission and, where the provider is certified, the EU–US Data Privacy Framework. If you would like details of the mechanism relied on for a specific provider, contact us and we will tell you.

9. Data Retention

We retain your account data for as long as your account is active. If you request deletion, we remove your personal data within 30 days.

Server access logs are a separate case and we would rather say so than let the sentence above imply otherwise. They record IP addresses, timestamps and requested pages, they are kept for 14 days and then deleted automatically, and they are not searched or erased individually when an account is deleted. They exist to investigate abuse and faults.

10. Children's Privacy

The Service is not directed at children under 13. We do not knowingly collect personal information from children under 13. In certain EU member states the age of digital consent is 16. If you are under this age, please obtain parental consent before registering.

11. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes via email or in-app notice at least 14 days before they take effect. For material changes that affect how we process your personal data, we will seek your explicit consent where required by law. Continued use of the Service after the effective date of non-material updates constitutes acceptance of the revised policy.

12. Contact

Questions or data requests? Email us at [email protected].