Legal
Privacy Policy
What Twifly collects, why we collect it, how your connected X (Twitter) session is stored, and the third parties that help us run the service.
1. Who this policy covers
Twifly is operated by Karuppanan, trading as Twifly ("Twifly", "we", "us"). This policy explains how we handle information when you use the Twifly web application, browser extension, and twifly.app website (together, the "Service"). Privacy requests can be sent to [email protected].
Twifly is an independent product and is not affiliated with, endorsed by, or sponsored by X Corp. "X" and "Twitter" refer to the platform operated by X Corp. For any privacy question, contact us at [email protected].
2. Information we collect
We collect the following categories of information, each for a specific product purpose:
- Account details you provide at sign-up: your name, email address, and password. Your password is stored only as a one-way hash — we never keep or can retrieve the original.
- Business profile you optionally provide: brand name, website, industry, business goal, short bio, timezone, and theme preference. These personalise the workspace; only industry and business goal are required.
- Your connected X account session (see section 3), which the Twifly browser extension reads from your logged-in X session so Twifly can act on your behalf.
- X data we mirror to run the features you turn on: the handles, display names, and verified status of your followers and the accounts you follow; daily follower-count snapshots; direct-message conversations and messages sent or received through Twifly; the accounts a campaign has targeted; and post/thread analytics (impressions, engagements, profile visits, link clicks) for content Twifly published or replies it made.
- Usage and technical data: activity logs of automated actions Twifly performs for you, and standard session records including IP address and browser user-agent.
- Billing data: your subscription plan, status, customer and order references, and billing event records received from FastSpring. These records may contain contact and transaction information. FastSpring collects payment-card details through its hosted checkout.
- Anti-bot signals: at sign-up we run Google reCAPTCHA, which sends device and interaction signals to Google to score whether the request is automated.
3. Your connected X (Twitter) session
To publish posts, follow and unfollow, like, repost, reply, and send direct messages on your behalf, Twifly acts as your own logged-in X session rather than through a limited public API. When you connect an account, the Twifly browser extension reads the session your browser already holds for X — session cookies and the request headers X uses to authenticate you — and sends them to Twifly over an encrypted connection.
This session is powerful: it can do what you can do on X. We treat it accordingly.
- It is encrypted at rest using a dedicated encryption key that is separate from the rest of the application, and it is never included in any Twifly API response or shown back in the interface.
- Twifly only uses it to carry out the actions your campaigns and tools are configured to take, within the daily limits and schedules you set.
- You can disconnect a connected X account at any time from Settings. Disconnecting immediately stops all automation for that account.
- You should only connect an X account you own or are authorised to operate, and automating an account may be against X's own rules (see our Terms of Service).
4. How we use your information
We use the information above to:
- Operate the features you enable — publishing, audience discovery, engagement, direct messages, RSS drafts, and campaign reporting.
- Enforce the safety limits, schedules, and run windows you configure, and stop automation when a subscription lapses or an account is disconnected.
- Process your subscription, trial, plan changes, and cancellations through our payment provider.
- Provide support, including live chat, and respond to your requests.
- Protect the Service — detecting and blocking automated sign-ups and abuse.
- Understand and improve how the product and marketing site are used, in aggregate.
- Send you service messages (for example, trial and billing notices). We do not sell your personal information.
5. Service providers and other data recipients
We share information with providers and platforms to deliver the features you use. Their roles differ: some process information on our instructions, while others also handle information under their own policies and legal obligations. The production arrangements are being reviewed for this draft.
- FastSpring — our payment provider and merchant of record. It hosts checkout and handles payments, tax, and invoices. Twifly receives and stores billing event records, including customer/order references, subscription changes, and any contact or transaction information supplied with those events. FastSpring also processes information under its own privacy policy.
- Google reCAPTCHA — bot detection at sign-up. Your use of the Service is subject to Google's Privacy Policy and Terms of Service.
- Email delivery providers — to send account and service emails, including your email address, message content, and delivery information. The application's configured failover route supports Brevo, Mailjet, and SendPulse. The providers actually used in production must be confirmed before this draft is finalised.
- AI providers — Google Gemini through billing-enabled projects and Groq are the providers confirmed for Twifly's production AI setup. They receive inputs and context for AI features you request. An alternative enabled provider may receive the same input if a request is retried. See the AI processing section for details.
- Hosting and infrastructure providers — to run the application, databases, stored files, and supporting services. The actual production providers, processing locations, and backup arrangements remain to be confirmed.
- Tawk.to — the live-chat support widget. When you are signed in, your name and email are shared so support can identify you.
- Google Analytics — used on the public marketing site to measure aggregate visits. It is not loaded inside the authenticated application.
- A push-notification provider (Firebase Cloud Messaging) — used only if you enable push notifications, to deliver them to your device.
- X Corp — the platform Twifly automates. Actions you configure are carried out on X, and data Twifly reads originates from X and remains subject to X's own terms and privacy policy.
AI inputs, providers, and saved content
When you request AI writing, Twifly sends the writing instructions, source text, and relevant context supplied to that feature to an enabled AI provider. Depending on the request, this can include your business profile, topic, tone, draft or revision, and selected X content. You must have the rights and lawful basis needed to submit this material, including other people's information. Do not submit passwords, X session credentials, confidential material, sensitive personal information, or material you are not authorised to share.
The confirmed production AI providers are Google Gemini through projects associated with active Cloud Billing accounts and Groq. Actual availability depends on server configuration and provider health. If one attempt fails or reaches capacity, Twifly can retry the same input with another enabled provider; one request may therefore be processed by both providers. A model's publisher is not necessarily the company receiving the API request. OpenRouter is not part of the confirmed production setup.
Google classifies Gemini API access through a project associated with an active billing account as Paid Services. Under those terms, Google does not use prompts or responses to improve its products and processes that content under its applicable Data Processing Addendum. Google may retain prompts and responses for a limited period for safety, abuse prevention, and required legal or regulatory disclosures, with transient storage or caching in countries where Google or its agents maintain facilities. This is not a zero-retention promise. The production project and applicable contractual and transfer arrangements still require verification before this draft is finalised.
Twifly uses Groq with Zero Data Retention enabled for inference requests. Groq documents that this setting prevents retention of customer inputs and outputs for system reliability and abuse monitoring. Groq still retains usage metadata that does not contain those inputs or outputs. This setting does not delete Twifly's own saved drafts, generation records, or revisions and does not apply to Gemini. Groq's documentation identifies the United States as the location for customer data it retains; applicable processing and transfer agreements still require confirmation. Twifly does not promise zero retention across its AI providers.
Twifly stores generation results and operational records such as provider/model, request hashes, token usage, timings, and errors. Saved AI drafts can contain your brief, edited content, outputs, and revision history. The generation table stores an input hash rather than a complete raw-prompt archive; saved briefs and drafts can still contain the original input. Ordinary application logs and provider logs have separate retention controls.
Completed generation records and their attempt records are scheduled for daily cleanup after a configurable period, defaulting to 30 days. This is not a 30-day deletion promise for saved drafts, revisions, published content, unfinished records, backups, or provider copies. Deleting a saved draft removes its draft record and associated revisions; separate generation records follow their own lifecycle. Contact support for broader deletion requests. Backup schedules, exceptional retention, and production settings remain to be confirmed.
International processing and regional rights
Twifly and its service providers may process information outside your country, including in the United States. Hosting locations, enabled AI hosts, and support access can affect where processing occurs. We do not currently promise EU-only or UK-only storage. Before final publication, we must identify the controller, processor arrangements, transfer destinations, and applicable safeguards such as adequacy decisions or standard contractual clauses and the UK addendum where required.
For EEA and UK users, the final policy must identify a lawful basis for each processing purpose, including service delivery, security, billing, and optional Analytics consent. Depending on applicable law, you can request access, correction, deletion, restriction, portability, or object to processing; you can withdraw optional consent without affecting earlier lawful processing and complain to your local supervisory authority, including the UK ICO. Contact [email protected] to make a request. Identity checks and lawful exceptions may apply.
7. How we protect your data
We take practical measures to protect your information:
- Your connected X session and device push tokens are encrypted at rest, using a dedicated key that supports rotation.
- Passwords are stored only as one-way hashes and are never recoverable.
- Traffic between your browser and Twifly is encrypted in transit over HTTPS.
- Access to production data is limited to what is needed to operate the Service.
8. Data retention and deletion
We keep information needed to provide the Service while you use it. Saved drafts, revisions, account and campaign records, connected-account information, and billing records have different purposes and are not all covered by the AI generation cleanup period. Disconnecting an X account marks it revoked and stops automation; it does not by itself erase the stored account, session credentials, or historical records.
The application has scheduled cleanup for some technical records. Its defaults target completed AI generation records after 30 days, notification delivery records after 30 days, and notification inbox entries after 180 days. These are application defaults, not confirmed production retention promises. Cleanup requires the scheduled jobs to run and can be delayed by processing backlogs. Saved drafts and revisions follow their own deletion lifecycle.
You can request account deletion or exercise other privacy rights by emailing [email protected]. We assess requests and any applicable retention exceptions, including legal obligations and dispute records. Deleting data from Twifly does not automatically remove posts already published on X or copies independently retained by a payment or AI provider. Backup expiry and provider deletion processes must also be confirmed before this draft is finalised.
9. Your rights
Depending on where you live, you may have rights to access, correct, delete, export, or restrict the processing of your personal information, and to object to certain uses. To exercise any of these, email [email protected] from the address on your account and we will respond within the timeframe required by applicable law.
10. Changes to this policy
We may update this policy as the product changes or as required by law. When we make a material change we will update its date and, where appropriate, notify you in the app or by email. A policy update does not itself grant optional Analytics consent; where fresh consent is required, we will request it separately.
11. Contact us
Questions about this policy or your data can be sent to [email protected]. See also our Terms of Service, which govern your use of Twifly.