x2socials
Sign inSign up

Privacy Policy

Effective: August 25, 2026

What we store

  • Account data: your email and sign-in identity (managed by Clerk), plan and billing state (managed by Stripe — we store references, never card numbers).
  • Content: the text, names, handles, avatars, images, and video you compose, upload, or ingest; snapshots of ingested public posts (text, author identity, metrics, media) as they existed at capture time; and every export's render parameters and provenance.
  • Outputs: rendered files for 30 days, plus a small thumbnail kept with your history.
  • Usage records: an append-only ledger of exports for quota and billing.
  • Abuse-prevention signals: rate-limit counters keyed by a salted hash of your IP address — we do not store raw IPs in those counters.

How long we keep it

  • Rendered files: 30 days, then deleted (the thumbnail stays with your history).
  • Uploaded and ingested media: kept while something still references it, then garbage-collected.
  • Anonymous drafts and their uploads: 24 hours.
  • Account data and history: while your account exists.
  • After account deletion: everything above is deleted, except billing-evidence records (export dates, usage counts, payment references) which are kept for 7 years in anonymized form — detached from your identity, with all content removed — for tax and chargeback obligations.

Your rights

From the Account page you can download your data (a JSON export of your account, exports, usage, and brands) and delete your account(which performs the deletion described above, cancels any subscription, and requests deletion of your analytics data). Post subjects: if an export renders your post and you want it removed, use /report — we can block a post from ever rendering again.

Analytics and error reporting

We use PostHog (product analytics) and Sentry (error reporting) with privacy guards: no autocapture of what you type in the studio, session replays mask all text and media, analytics events carry only identifiers, states, and counts, and error reports are scrubbed of post text, emails, handles, URLs, and tokens before leaving our servers.

Processors

Vercel and Railway (hosting), Neon (database), Cloudflare R2 (file storage), Clerk (authentication), Stripe (payments, as merchant of record), Resend (transactional email), Sentry (errors), PostHog (analytics). Each receives only what its function requires.

Contact

support@x2socials.com · rezy.io LLC