Privacy policy

This policy

This page explains what Social Scribe stores, why, and how you can ask us to delete it. For questions, DM @jain_harshit on X.

What we store

Account: the name you give at sign-up and your email, held by our auth provider (Supabase). If you set a password, it is hashed; we do not see it in plain text. If you continue with Google, Google sends us your email and name for that sign-in. We do not get your Google password.

Studio content: post body and notes, draft/ready stage, schedule, tags, themes, weekly slots, cooldown settings, and whether a piece is reusable.

Images: up to four per post, 4 MB each, jpeg/png/gif/webp, plus optional alt text. Files live in a private bucket. The app uses short-lived signed URLs to show them.

Send history: when a post was sent, success or failure, and the X post id when a send succeeded.

X connection, if you link one: X user id, handle, display name, avatar URL, and access and refresh tokens. Those tokens are encrypted at rest. We use them only to post as you and to refresh the connection.

Rewrite usage: a count of successful Rewrite in your voice and Proofread runs so we can stop abuse. We do not store the model’s variants or proofread marks.

Cookies and local storage

Session cookies from Supabase Auth keep you signed in. They are required for the app.

ss-theme remembers light or dark. We also keep that choice in localStorage. We do not follow your system preference.

While you connect X, we set short-lived httpOnly cookies (x_oauth_state and x_oauth_verifier, SameSite=Lax, about ten minutes) so the OAuth handshake can finish.

While you continue with Google, we set short-lived httpOnly cookies (ss_oauth_next and ss_oauth_via, SameSite=Lax, about ten minutes) so that handshake can finish.

Recent emoji picks stay in localStorage on this device.

If we turn the bot check on, Cloudflare Turnstile may set a cookie on sign-in, sign-up, and password-reset pages.

We do not set advertising cookies. Vercel Web Analytics records anonymized page views on public pages (the landing page, sign-in, sign-up, plans, checkout return, password reset, terms, and privacy). It does not use cookies or advertising identifiers. Visitor hashes reset daily and cannot identify you.

Why we use this

To run the product: sign you in, take payment for a plan, store drafts, show the calendar, post to X when you ask, remember the theme, and stop bots on auth forms. Aggregated page views on public pages tell us whether people are finding the site. We do not sell your data.

Rewrite in your voice is optional. We do not send a draft to a model, or change a post, unless you click Tighten, Expand, or Rephrase. Proofread is optional. We do not scan a draft unless you click Proofread.

Who else sees it

Supabase hosts auth, the database, and image storage.

Google handles Continue with Google. They receive the sign-in and send us your email and name.

Vercel hosts the app and collects those anonymized public-page views.

Dodo Payments processes checkout, subscriptions, and invoices when you buy a plan. They receive your email and payment details. We store plan, billing interval, subscription status, billing period dates, and Dodo customer and subscription ids so Studio and the billing portal can work.

X receives the posts and images you choose to send, under X’s terms.

OpenAI receives the current draft and Ready-post examples when you use Rewrite in your voice, so the rewrite can match how you write. OpenAI also receives the current draft only when you use Proofread. We do not send Ready-post examples for a proofread. OpenAI does not use API data to train or improve their models unless we opt in to share it (we do not). They may keep prompts and responses in abuse-monitoring logs for up to 30 days.

When the bot check is on, Cloudflare Turnstile runs on sign-in, sign-up, and password-reset request forms. Cloudflare receives the challenge result, not your password.

Those processors only get what they need for that job.

How long

Account data stays until you ask us to delete it, or we close the product.

Session cookies last for the auth session. The theme cookie lasts about a year. X OAuth handshake cookies expire in about ten minutes. Google OAuth handshake cookies expire in about ten minutes. Encrypted X tokens stay until you disconnect X or we delete the account.

Delete an account

Message @jain_harshit on X. Tell us the email on the account. We will delete the account, posts, images, and encrypted X tokens.

Disconnecting X in Connections only drops the X connection. You can also delete individual posts and images in the app, and sign out. There is no self-serve account delete button yet.

Children

Social Scribe is not meant for children. Do not create an account if you are under 18.

Changes

We will update this page when the product’s data practices change. The date at the top is the current version.