Privacy Policy

1The short version

This summary is a convenience. The full policy below is what applies.

2Who we are and what this covers

Twit Dragon is operated by 12TH LAB LLC (“Twit Dragon”, “we”, “us”). This policy explains how we handle personal information when you use twitdragon.com, the Twit Dragon web app, and related communications (together, the “Service”). Because the Service reads public posts on X, it also explains how we handle public information about people on X who are not our users.

12TH LAB LLC is the “controller” of the personal information described here (the organization that decides why and how it is used). You can reach us at support@twitdragon.com.

Twit Dragon is an independent product. It is not affiliated with, endorsed by, or sponsored by X Corp. X, Google, GitHub, Stripe and our AI providers each have their own privacy policies, which this policy does not cover.

3Information we collect

Information you give us

• Account details. Your name and email address. If you sign up with an email and password, your password is stored only as a salted hash, and when you set it we check it against a list of known breached passwords (only a short partial hash leaves our servers, never the password). If you sign in with Google or GitHub, we receive your name, email address, profile image, your account ID at that provider, and the tokens it issues so you can sign in.
• Content and settings. Themes (name, topics, keywords, style guidelines and example posts), subjects and instructions for generation, drafts and your edits, reply variants you select, review notes, schedules, watchlist entries (public X handles you choose), and voice-profile settings.
• Your own X API credentials, only if you choose to store them under Settings. They are encrypted before storage.
• Messages and promo codes. Anything you send our support team, and promotion codes you redeem.

Information from X when you connect your account

When you connect X, you authorize us through X’s OAuth 2.0 flow. We receive your X user ID and @handle, and the access and refresh tokens X issues for the permissions you grant (reading posts and profile information, publishing posts, and staying connected until you revoke access). The tokens are encrypted at rest. We never receive your X password, and we do not request access to your direct messages.

Using that connection, we retrieve through the X API:

• when you use the voice profile, recent posts from your own timeline (up to 100, excluding reposts), from which you choose the ones we learn from;
• public posts you ask us to reply to (by URL), including the text, author, and public engagement counts;
• recent public posts from accounts on your watchlist, so we can suggest reply opportunities; and
• the identifiers and content of the posts and replies we publish for you.

X’s “read posts” permission covers posts you are able to see, which can include posts from protected accounts you follow. We use X data only to provide the features you ask for, and we do not show it to other users of the Service.

Billing information

Payments are processed by Stripe. Stripe collects your payment method, billing details and, where applicable, tax information. We store your Stripe customer ID, subscription ID, plan and status, billing period dates, credit balances and credit ledger, and records of credit-pack purchases (amount, currency and Stripe references). We do not receive or store your full card number.

Information collected automatically

• Technical data: IP address, browser and device type (user agent), session identifiers and timestamps. Signed-in sessions record the IP address and user agent they were created from.
• Logs: request logs (URL path without query string, status, a request ID and your user ID) and error logs, used to run and secure the Service.
• Usage: generations and publishing actions, their status, the AI model used, and credits consumed. We also keep counters used for rate limiting.

Information we create

If you use the voice profile, we generate a structured description of your writing style (for example tone, formality, rhythm and punctuation habits) from the posts you select. For watchlist suggestions we calculate a relevance score for each public post (based on recency, engagement and topic match against your themes). We do not use X data to infer sensitive characteristics about anyone, such as health, political views, religion, ethnicity or sexual orientation.

Sensitive information

We do not ask for sensitive personal information and do not need it to provide the Service. Please do not put it in prompts, themes or notes. The only information we handle that some laws classify as sensitive is your account log-in credentials (your email and password, or the tokens from the provider you sign in with), which we use only to sign you in and keep your account secure.

4How we use information and our legal bases

We use personal information for the purposes below. For people in the European Economic Area, the United Kingdom and Switzerland, the right-hand column gives the legal basis under the GDPR.

We do not use your content, the drafts we generate for you, or data from X to train AI models, ours or anyone else’s. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. The repeat-trial check is an automated fraud-prevention step; if you think it blocked you in error, contact us and a person will review it.

5How AI providers handle your content

Drafts are written by third-party AI models. To produce a draft we send the provider the instructions and context for that request: your theme settings, the subject or instructions you entered, your voice-profile data and a few of your recently published items as style examples, and for replies the public post being answered (its text and author handle). We do not intentionally include your email address or payment information.

We use third-party AI model providers, and if one is unavailable we may switch to another. When generating posts, the model may also run a small number of web searches to ground a draft in current public information; search terms are derived from your subject and instructions.

We use the providers’ commercial API services. Under those terms the providers do not use API inputs or outputs to train their models by default, and they keep that data only for a limited period set by their terms (longer where needed for safety enforcement or legal reasons). AI output can be inaccurate or inappropriate, which is why you review and approve every draft before it is published.

6Who we share information with

We share personal information only with the service providers and recipients below, and only as needed for the purposes in this policy.

We can provide a current list of our service providers on request at support@twitdragon.com.

We may also disclose information:

• to comply with law, legal process or a valid request from authorities, or to protect the rights, safety and security of our users, us or others;
• to X, where X or a post’s owner asks us to act on content (for example removal) or to investigate a violation of X’s rules;
• in connection with a merger, acquisition, financing or sale of assets, in which case we will require the recipient to honor this policy; and
• with your direction or consent, or in aggregated or de-identified form.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

7X and your X content

We handle data we receive from X in line with X’s Developer Agreement and Policy. In particular, we use X data only to provide the features you request; we do not sell it; we do not use it to train AI or machine-learning models; and we do not derive or store sensitive characteristics about people from it.

We keep copies of X content, such as the text of a post you are replying to, only to generate and review your drafts. A copy stays with that draft until you delete the draft or your account. If content is deleted or restricted on X, or X or the account owner asks us to remove it, we remove our copy as soon as reasonably possible and within the time X’s policies require. To make a request, write to support@twitdragon.com.

People who are not our users

If your public X account is on someone’s watchlist, or someone drafts a reply to one of your public posts, we process your @handle, your public post and its public engagement counts. We use them only to help that user prepare a reply, we do not build profiles of you, and we do not contact you. A reply is published only if the user approves it. To ask us to delete data we hold about you, contact support@twitdragon.com.

Revoking access

You can disconnect X in the app under Settings → X Account, or at any time at x.com/settings/connected_apps. Disconnecting stops us from reading or posting on your behalf.

8International transfers

We operate from the United States and our providers process data primarily in the United States, with our network provider serving requests from locations worldwide. If you use the Service from outside the United States, your information will be transferred to, stored and processed in the United States and other countries whose data-protection laws may differ from yours.

Where the GDPR or UK GDPR applies, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses (with the UK Addendum where needed) in our providers’ data-processing terms, and the EU–US Data Privacy Framework where a provider is certified. Contact support@twitdragon.com to request more information.

9How long we keep information

We may keep information longer where the law requires, or where we need it to resolve a dispute or enforce our agreements.

10Your rights and choices

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a portable copy, restrict or object to certain processing, withdraw consent, and not be discriminated against for exercising your rights. You can do much of this yourself:

• edit your profile and content in the app;
• delete your account under Settings → Account;
• disconnect X under Settings → X Account;
• cancel your subscription under Settings → Billing (cancel before deleting your account if you have an active subscription); and
• disconnect Google or GitHub sign-in in that provider’s own security settings.

For anything else, email support@twitdragon.com from the address on your account. We may ask you to confirm your identity before acting. We respond within the time the law requires (generally 30 to 45 days) and do not charge a fee unless a request is clearly excessive. You can also use an authorized agent; we may ask for proof of their authority.

If we decline a request, you can appeal by replying to our message within 30 days. If you are still unsatisfied, you can contact your state attorney general or, in the EEA, the UK or Switzerland, your local data-protection authority.

11Additional information for US state residents

This section supplements the rest of the policy for residents of California and other US states with privacy laws. In the past 12 months we collected the following categories of personal information.

We collect this information from you, from X, from the sign-in provider you use, from Stripe, and automatically from your use of the Service, for the purposes described above. We have not sold or shared (for cross-context behavioral advertising) personal information in the past 12 months, and we do not knowingly do so for anyone under 16. We use sensitive personal information only to provide the Service and keep it secure, so there is no right to limit its use to exercise. Because we do not sell or share personal information, an opt-out preference signal such as Global Privacy Control does not change how we handle your data. Retention periods are in the retention section above.

California’s “Shine the Light” law lets California residents ask which personal information we disclosed to third parties for their direct-marketing purposes. We make no such disclosures. Nevada residents may opt out of the sale of covered information; we do not sell it.

12Additional information for the EEA, UK and Switzerland

12TH LAB LLC is the controller of your personal information. The legal bases for our processing are listed in the “How we use information” section. Where we rely on legitimate interests, you can object to that processing by contacting support@twitdragon.com. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

You also have the right to lodge a complaint with your local supervisory authority. We have not appointed a Data Protection Officer or an EU or UK representative at this time.

13Security

We use safeguards designed to protect personal information, including:

• encryption in transit (HTTPS/TLS) for all traffic to the Service;
• encryption of X access and refresh tokens, and any API credentials you store, using AES-256-GCM;
• hashing of passwords, and screening of new passwords against known breaches;
• database-level isolation so each account’s data is accessible only within that account’s own context; and
• access controls on our infrastructure and internal tools.

No system is perfectly secure. Please use a strong, unique password and keep your account credentials private. If a breach affects your information we will notify you and regulators as the law requires.

14Cookies and similar technologies

We use only strictly necessary cookies: session cookies that keep you signed in (including a short-lived cache of your session to reduce lookups) and security cookies that may be set by our network provider to protect the Service from abuse. We do not use advertising, analytics or social-media tracking cookies or third-party analytics scripts, so we do not show a cookie banner.

When you go to Stripe Checkout, or to X, Google or GitHub to authorize or sign in, those sites set their own cookies under their own policies. We do not respond to “Do Not Track” signals because we do not track you across other sites.

15Children

The Service is for people who are at least 18 years old and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, contact support@twitdragon.comand we will delete it.

16Changes to this policy

We may update this policy as the Service or the law changes. We will post the new version here with a new “last updated” date and, for material changes, notify you by email or in the app before they take effect where the law requires.

17Contact us

Questions, requests or complaints about privacy: email support@twitdragon.com.