Privacy policy

1. Data we collect

Your account: email, hashed password (we never see it), language, time zone, plan and billing status.

From X, for each account you connect: X user ID, username, display name, access keys (encrypted, never shown or logged), your recent posts and their public numbers (impressions, likes, reposts, replies, quotes, bookmarks), your follower count, and the replies to your posts that are linked to an automatic DM campaign (user ID, username, reply ID).

What you create in Hookwren: drafts, scheduled posts, time slots, DM campaigns and the list of people who received a DM, your AI style guide.

Payment: handled by Stripe. We only keep a customer ID, the plan and its status; we never see your card number.

2. Why we use it

To provide the service (publish, schedule, send the DMs people asked for, compute statistics, write in your voice), to bill you, to send service emails (password reset, reminders, receipts) and to keep the service secure. We do not use your data to train AI models.

3. Service providers

Vercel (hosting), Neon (database), Stripe (payments), Resend (emails), Anthropic (AI writing: the text you send and your style examples are processed to answer, and Anthropic does not use API data to train its models by default), X Corp (the X API). Each one only gets what it needs.

4. Cookies

Only what the service needs: a session cookie to keep you logged in and a language cookie. No advertising or tracking cookies.

5. How long we keep it

As long as your account exists. Post statistics older than 60 days are not shown and may be removed. When you delete your account, everything is deleted at once; database backups are erased within 30 days. Stripe keeps invoices as required by tax law.

6. Your rights

You can see and edit your data in the app, export it on request, and delete everything in one click from Settings. Disconnecting an X account deletes its data and revokes our access at X. For any request: support@hookwren.com.

7. Security

Access keys are encrypted (AES-256-GCM), passwords are hashed (bcrypt), connections use HTTPS, and access to the database is restricted.

8. Changes

We will announce important changes by email before they apply.