Your history stays yours.

TweetGuard is an online service for private, AI-assisted review of public X history. This policy describes the information we process and the choices available to you.

1. Scope

This Privacy Policy applies to the TweetGuard website, applications, audit reports, archive processing, account connections, and related services. It does not apply to X, Supabase, Creem, our AI provider, TwitterAPI.io, Vercel, or other third-party services, which have their own policies.

2. Information We Process

Account and contact information

When you sign in or request a teaser, we may process your email address, name, avatar, Supabase user identifier, authentication provider, consent record, and account timestamps.

Audit information

We process the X handle you submit, audit source and plan, scan progress, normalized public post identifiers, post text, author identifiers, timestamps, links, risk scores, categories, explanations, and deletion outcomes.

Organization brand-monitoring information

For Brand Shield, we process the organization name, monitored targets (handles, @mentions, brand keywords, competitor handles, and publicly posted executive handles), retrieved public mention text and identifiers, risk scores, incident records, alert deliveries, and Brand X-ray snapshots. We monitor only the organization's own public footprint and do not profile employees or private individuals.

X OAuth information

If you choose to connect X for deletion, we process your X user ID, handle, granted scopes, access token, refresh token, expiry, and revocation status. Tokens are encrypted before storage. TweetGuard does not ask for or store your X password, TOTP seed, or direct messages.

Archive information

For Full Cleanse, we process the official X archive `.zip` you upload and extract supported tweet data. The raw archive is processed temporarily and is not intentionally retained as part of the audit record. We retain normalized audit results and upload metadata needed to operate the service.

Payment information

Creem, our Merchant of Record, processes checkout, customer, product, order, payment status, amount, currency, tax, refund, and dispute information. TweetGuard does not receive or store complete card numbers or payment authentication credentials.

Technical information

We may process IP address, browser and device information, request timestamps, error diagnostics, and security events for authentication, rate limiting, abuse prevention, service reliability, and legal compliance.

3. Why We Process Information

• To authenticate users, maintain accounts, and secure sessions.
• To retrieve public X data and produce the requested audit.
• To provide AI-assisted context and reputation-risk analysis.
• To process payments, confirm entitlements, prevent fraud, and handle refunds or disputes through Creem.
• To connect an X account only after explicit authorization and perform only confirmed deletion actions on posts owned by that account.
• To prevent abuse, enforce limits, diagnose failures, and maintain the service.
• To communicate about requested audits, account security, service changes, and, where legally permitted, the V2 transition.

Depending on the circumstances and applicable law, these purposes rely on consent, performance of a contract, legitimate interests, legal obligations, or steps taken at your request before a contract.

4. AI-Assisted Analysis

TweetGuard uses a server-side AI provider to classify submitted public posts into structured risk scores, levels, categories, explanations, and recommended review actions. TweetGuard does not make employment, legal, insurance, housing, credit, or other high-impact decisions about you. An AI result is not a fact finding, legal conclusion, or guarantee of harm.

We do not intentionally use submitted content to train a TweetGuard model. Third-party provider processing, retention, and model-improvement controls are governed by the applicable provider agreement and the configuration used for the deployment.

5. X Data and Deletion

Public post retrieval is performed through configured X data services. Official X OAuth is used for account identity, ownership verification, and user-confirmed deletion only. We do not use OAuth to read direct messages or private account content. Deletion is irreversible and is never triggered solely by an AI score.

6. Service Providers and Sharing

We share information only as needed to operate the service, including with Supabase for authentication and database hosting, Vercel for application hosting, TwitterAPI.io for public X retrieval, our AI provider for inference, Creem for payment and tax processing, an email delivery provider such as Resend for transactional and alert emails, and X for OAuth and deletion.

We may disclose information when required by law, to protect users or the service, to investigate abuse, or as part of a merger, acquisition, financing, or transfer of assets. We do not sell audit content or use it for advertising.

7. Retention

We retain account and audit information for as long as needed to provide the service, comply with legal obligations, resolve disputes, enforce agreements, and maintain security. Temporary archive data is subject to expiry. OAuth tokens are retained only while the connection is active or needed for a confirmed deletion workflow, and are removed or revoked when you disconnect the account or request deletion.

For Brand Shield, monitored targets, incidents, alerts, and X-ray snapshots are retained while an organization pilot or subscription is active. When a pilot ends, monitoring pauses and the organization owner may remove targets or request deletion of the organization's monitoring data at any time; if an organization remains inactive without a pilot or subscription, its monitoring data is retained only as needed for security, billing records, and legal obligations.

We also record aggregate operational and conversion events such as provider request counts, token counts, durations, scan size, deletion counts, checkout status, and funnel milestones. These records are not intended to include post text, raw archive contents, OAuth tokens, API keys, or raw payment webhook payloads.

8. Security

We use server-only credentials, encrypted OAuth token storage, access controls, Row Level Security, HTTPS, rate limiting, and signed webhook verification. No internet service can guarantee absolute security. You are responsible for protecting your account and promptly reporting suspected unauthorized access.

9. Your Rights

Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection to processing. You may withdraw consent where processing relies on consent and may revoke X access through X. Rights requests may be submitted through the rights-request process made available by the service. You may also complain to your local data-protection authority.

10. Children

TweetGuard is intended for adults and is not directed to children under 18. We do not knowingly create accounts for children under 18.

11. International Processing

Our service providers may process information in countries outside your country of residence. Where required, we use appropriate contractual, technical, or legal safeguards for international transfers.

12. Changes and Contact

We may update this policy when the service, law, or processing changes. We will update the effective date and provide additional notice where required.