1. Who is responsible for your data
xCinder, based in the United Arab Emirates, is the controller of the personal data collected through this website and service. This policy explains what we collect, why, how we protect it, and what rights you have. By using the service you acknowledge that you have read it. To contact us about privacy, email privacy@xcinder.com.
2. Categories of information we collect
- Account: email, name and username, preferences, plan and subscription status, and X accounts you connect.
- Connected-account credentials: X account handles, passwords, and authentication tokens you provide, and 2-step login keys if you save them. They are encrypted before storage, and a 2-step key is used only to show you the current code.
- Content you create: posts, drafts, schedules, writing ideas and rules, images you upload or design, and a log of the actions we run for you.
- AI keys and usage: your OpenAI key if you add one, encrypted and never shown in full (we show only its last four characters), and a monthly count of posts written with it and their estimated cost.
- Data Scraper results: the public X data you choose to collect, such as handles, names, post text, links, and counts, stored so you can download it, and the number of rows you collected each month.
- Support and contact: messages you send in support chat or the contact form, your email so we can reply, and your chat rating. Our team may add internal notes you do not see.
- Transactions: plan, amount, currency, status, transaction identifiers, and payer name or email returned by the payment provider. The provider handles payment-method details.
- Network and approximate location: IP address at sign-up, sign-in, and recorded activity; IP history and observation times; and approximate country or city when available.
- Device and browser: browser, operating system and device type; a random browser identifier; and derived identifiers based on screen, language, time zone, platform, graphics, processor cores, memory, and touch traits. Recorded traits may include device model and automation indicators.
- Sessions and events: session creation and expiry, IP and browser information, and events such as sign-in successes or failures, sign-up attempts, connected X account conflicts, and security actions.
- First-visit source: first page path, external referrer when present, campaign tags such as UTM values, and visit time. Other URL query parameters are not included in this source record.
- Public-site visitor analytics: public page paths and visit times, country when available, device type, browser and operating system, selected browser-reported device traits, and referrer and campaign source. A random browser identifier, kept for up to 180 days, helps count returning visitors. These analytics records do not include your IP address or account identifier.
3. Purposes and legal bases
- Providing your account and requested features, including connecting X accounts and sending the actions you choose to X: performance of our contract with you or steps requested before entering it.
- Securing accounts and the service, preventing fraud and abuse, and diagnosing failures: our legitimate interests, balanced against your rights and freedoms.
- Payments and required records: performance of the contract and compliance with legal obligations where applicable.
- Where we rely on consent, we explain the purpose and provide a way to withdraw it using the same request channel, without affecting prior processing.
When you use the Data Scraper, you decide what to collect and why. For that data you are the controller, and we process it on your behalf only to deliver your export.
4. Account-linking signals and automated decisions
We may compare accounts using IP addresses, device and browser identifiers and traits, payer email, and attempts to connect the same X account. Scores are weighted indicators, not verified probabilities or proof that one person operates multiple accounts. Families, workplaces, and mobile networks may share an IP address or device.
Depending on security settings, sign-ups from a device may be limited or a trial may be declined when a linked account already used it. You may contest the restriction and request human review at our privacy email. A match by itself is not a finding of abuse or conclusive evidence of identity.
5. Cookies and local storage
- Session cookies are necessary to keep you signed in.
- First-party protection identifiers may be stored in cookies and browser storage; identifier cookies may last up to 400 days.
- A random first-party analytics cookie may last up to 180 days to count returning visitors on public pages. It is not used for advertising or cross-site tracking.
- First-visit source, interface preferences, and the last device-report time may be stored in local storage.
We do not use advertising cookies or track your activity across other sites for advertising. Disabling storage may affect sign-in and security features.
6. Retention
- IP history, device records, and security-event records are automatically deleted after the server-configured period: 180 days by default, configurable from 30 to 730 days.
- Public-site visitor analytics are automatically deleted after the same configured period, 180 days by default.
- Sign-up IP, sign-up country, and first-visit source may remain on your account until it is deleted.
- Session data is retained with the session record during its validity period and is deleted with the account.
- Data Scraper results are deleted after 7 days, and uploaded images not used in any post after 2 days.
- Some security-action audit records may remain after account deletion to document admin decisions.
7. Your rights in the United Arab Emirates
We process personal data in accordance with the United Arab Emirates Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data and its executive regulations. In line with that law, you have the right to obtain information about your data, access it, and receive a copy; to request that your data be transferred; to have inaccurate data corrected or completed; to request erasure of your data; to request that processing be restricted or stopped; to object to automated processing; and to withdraw consent at any time without affecting processing already carried out.
To exercise these rights, email privacy@xcinder.com from the address linked to your account. We may ask for information to verify your identity and will respond within the period set by law. You may also lodge a complaint with the UAE Data Office.
We transfer personal data outside the UAE only to the extent necessary to operate the service and subject to the safeguards and conditions required by applicable law.
8. EEA and UK privacy rights
If European or UK data-protection law applies, you may request access, correction, deletion, or restriction; object to processing based on legitimate interests; and request a portable copy where applicable. You may withdraw consent at any time without affecting earlier processing, and complain to your local data-protection authority. Email our privacy contact; we may ask for information to verify your identity. We generally respond within one month, subject to lawful extensions.
9. U.S. state privacy rights
Depending on your state and whether its law applies, you may have the right to know the specific information and categories we collect, its sources and purposes, and the categories of recipients; access, correct, delete, or obtain a portable copy; opt out of targeted advertising, sale, or sharing where applicable; limit the use or disclosure of sensitive personal information where that right applies; opt out of certain profiling; and appeal a denied request. You may use an authorized agent where the law allows. We will not discriminate against you for exercising your rights.
Relevant statutory categories include identifiers, customer-record information, commercial transaction information, internet or network activity, approximate geolocation, and inferences derived from those data. We obtain them from you, your browser or device, and payment providers, and disclose necessary categories to the service providers described below. Credentials for connected X accounts may be sensitive personal information; we use them only to provide requested connected-account features and protect those accounts, and do not sell them.
We do not sell personal information or share it for cross-context behavioral advertising. Connected-account credentials are used to provide and protect features you request, not for advertising or to infer personal characteristics. To submit or appeal a request, email privacy@xcinder.com and identify your state and request. We will verify your identity and respond within the time required by law; you may appeal by replying to our decision.
10. Recipients and international transfers
- X: X receives connected-account information and the content of requests and actions you choose to perform, to the extent needed to provide the requested features. X handles that data under its own terms and policies.
- Payment providers (such as Polar and PayPal), to process purchases and return necessary transaction and payer details. We do not store your full card details. Polar acts as the seller of record for transactions completed through Polar.
- OpenAI, only if you add your key: we send the post idea, your writing rules, and earlier texts to avoid repeating, using your key and under OpenAI’s terms.
- Grok: draft ideas are sent to X’s Grok service through your connected account.
- Resend, to send account and support email; it receives your email address and the message content.
- Hosting and network-delivery providers, to operate the service and transmit and protect requests.
- Authorized admins, when reviewing accounts or investigating abuse.
Providers may process data in different countries. Contact us for the processing locations and the transfer mechanism and safeguards that apply to your data. We do not sell personal information.
11. Safeguards, breaches, and account deletion
Access to protection data is limited to authorized admins, and stored credentials for connected X accounts, 2-step keys, and AI keys are encrypted. Device identifiers are pseudonymous, not anonymous, and are not conclusive evidence of identity. You may request access, correction, or deletion through account settings when available or by contacting us. Account deletion removes account data, sessions, connected accounts, and associated protection records under the deletion workflow; security audit records may remain.
If a personal-data breach affects you, we will notify you and the competent authority within the periods and in the manner required by applicable law.
The service is intended for adults and is not directed to children. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Contact and updates
Privacy questions and requests: privacy@xcinder.com. Material updates will be posted here with a new revision date.