Privacy Policy

Last updated: September 2026

This Privacy Policy explains how ExTweets collects, uses, and protects information when you use the service to connect X/Twitter accounts, authorize MCP clients, and use Grok or other provider-backed tools.

Information we collect

We collect account information needed to operate the service, such as your ExTweets user identifier, name and email address from your sign-in provider (X/Twitter or Google), sign-in provider identifiers and OAuth tokens (stored encrypted), connected X/Twitter account IDs, usernames, display names, profile image URLs, granted scopes, billing records, usage records, and MCP client authorization records. Sign-in sessions record the IP address and browser user agent used to sign in; we use them only for session security and do not use them for tracking or profiling.

When you connect X/Twitter, we receive OAuth tokens from X/Twitter. These tokens let ExTweets perform the actions you approved, such as reading posts, posting, uploading media, managing follows, managing bookmarks, and sending direct messages where those permissions are granted.

When an authorized MCP client calls a tool, ExTweets processes the tool inputs and the provider's response to complete that call. Tool results, including post, profile, bookmark, and direct message content, are returned to the MCP client you authorized (for example ChatGPT) and are then handled under that client's own terms and privacy policy. ExTweets does not keep post text, direct message text, image content, or Grok prompts and answers after the call completes. For each call we keep an audit record, described below. To stop a retried request from publishing twice, we keep a one-way fingerprint (a hash, not the text) of each post, reply, and direct message for 10 minutes. We do not write OAuth tokens to logs.

How we use information

We use information to authenticate you, maintain sessions, connect X/Twitter accounts, issue and manage MCP client access, execute tool calls requested by authorized clients, refresh OAuth tokens, show dashboard activity, enforce limits, calculate usage and billing, prevent abuse, troubleshoot issues, and improve reliability.

We send the operator internal email notifications about new sign-ups, credit purchases, and failed auto-recharge payments. These contain your name or email address and, for payments, the amount. They are sent through Cloudflare's email service to the operator's mailbox.

If Grok or xAI-backed tools are used, prompts and related tool parameters are sent to xAI for processing. If X/Twitter tools are used, relevant requests are sent to X/Twitter APIs. If Google sign-in is used, authentication information is processed through Google. If billing is enabled, payment information is processed by Stripe.

Direct messages

Direct message tools work only if you grant the direct message permission for a connected account and also allow direct messages for the specific MCP client. When an authorized client reads direct messages, ExTweets fetches them from X/Twitter and returns them to that client without storing their content. When a client sends a direct message, ExTweets passes the recipient and message text to X/Twitter; the audit record keeps the recipient username but not the text. ExTweets should not be used to send unlawful, unsolicited, abusive, or deceptive messages.

Bookmarks

Bookmark tools work only if you grant the bookmark permission for a connected account. Bookmarks are read from and changed on X/Twitter when a client asks; ExTweets does not keep a copy of your bookmarks.

Token storage and security

X/Twitter OAuth tokens for connected accounts are stored encrypted (AES-GCM, with a key held as a Cloudflare Worker secret) in Cloudflare D1. Sign-in provider tokens are also stored encrypted. Access tokens issued to MCP clients expire after one hour and are refreshed by the client; they are stored only in hashed form. OAuth state used during sign-in or authorization expires within 10 minutes. Raw OAuth tokens are never returned to MCP clients, dashboard pages, or tool responses.

No system can be guaranteed perfectly secure. We use reasonable technical and organizational measures to protect connected-account credentials, including encrypted token storage, scoped OAuth permissions, short-lived authorization state, and revocation paths.

Sharing

We do not sell connected-account data. We share information with service providers only as needed to operate ExTweets: Cloudflare hosts the service and stores its data and request logs; X/Twitter receives the requests your authorized clients make with your connected accounts, and your sign-in if you sign in with X/Twitter; xAI receives Grok research prompts and returns answers; Google handles Google sign-in; and Stripe processes payments, saved cards, and receipts. ExTweets never receives or stores full card numbers. Tool results go to the MCP client you authorized.

We may disclose information if required by law, to protect the service or users, to investigate abuse or security incidents, or as part of a business transfer such as a merger, acquisition, or asset sale.

Retention

Connected-account tokens are kept while the account stays connected. Disconnecting an X/Twitter account revokes its tokens with X/Twitter where possible and deletes the stored tokens immediately. Revoking an MCP client deletes its tokens immediately. Sign-in and authorization state expires within 10 minutes, and duplicate-send fingerprints after 10 minutes. Your profile, sessions, usage audit records, credit ledger, and MCP client records are kept while your ExTweets account exists and are deleted when you delete it, except for the records described under Your choices. Hosting request logs are kept according to Cloudflare's log retention.

Your choices

You can revoke X/Twitter access from your X/Twitter account settings. From the ExTweets dashboard you can disconnect individual accounts, revoke individual MCP clients, change each account's permission tiers, or delete your entire ExTweets account in one action. Account deletion removes your profile and sign-in identities, sessions, connected-account tokens (which are also revoked on X/Twitter's side where possible), MCP client authorizations, usage history, and billing profile, and forfeits any remaining credit balance. We retain payment and transaction records held with Stripe for accounting, tax, and legal purposes, we retain a minimal record that a given X/Twitter account has already claimed its one-time welcome credit, to prevent repeated claims, and the operator notification emails described above are not deleted. The Stripe customer record is retained as part of our financial records.

Each tool call creates an audit record visible in your dashboard: the tool name, the MCP client, the connected account used, target identifiers (such as a post ID or the username a direct message was sent to), the number of items returned, the result status, a short error message if the call failed, the time, and the amount charged. Audit records do not store post text, message bodies, or Grok prompts.

Children

ExTweets is not intended for children under 13, and we do not knowingly collect personal information from children under 13.

Changes

We may update this Privacy Policy as the service changes. The updated version will be posted on this page with the updated date.

Contact

For privacy or security questions, or to exercise your choices above, email ExTweets@anouar.ca.