Privacy Policy

Last updated: October 23, 2026

This policy explains what X Audience Companion (“we”, “us”) collects, why, who we share it with, and the controls you have. We only collect what we need to run the service.

Information we collect

• Account data. Your email address, a salted password hash if you set a password, and, if you use Google sign-in, a stable Google account identifier. We do not receive or store your Google password. We never ask for your X password and never act on your X account.
• Tracked account and audience data. The X username you choose to track, and the public profile data of that account's followers and following (user ID, username, display name, profile picture and counts). This is retrieved from public X data and makes up your results, lists and change history.
• Scan history. The outcome of each scan and the follow changes it detected (for example, accounts that stopped following you). Detailed history is kept for 90 days and then removed; your latest results remain until you delete them.
• Billing data. Your plan, subscription status, trial status and Stripe customer and subscription identifiers. Card details are collected and stored by Stripe; we never see or store full card numbers.
• Session data. A secure, HTTP-only sign-in cookie that keeps you signed in for up to 14 days, a short-lived HTTP-only cookie used to protect Google sign-in, and, if you use the Chrome extension, a signed token that lets the extension read your latest results.
• Optional acquisition and ad-measurement data. Only if you accept measurement on our consent banner, we store coarse first-party data about how you arrived (UTM tags, referring site and landing page). If you arrive from a Google ad, we also keep the Google click identifier (gclid, gbraid or wbraid) in a first-party cookie for up to 90 days and link it to your account when you register or subscribe, so that we can tell Google Ads that an ad led to a sign-up, a free trial or a paid subscription. If you decline, none of this is collected.
• Technical data. Our servers keep standard operational logs (such as request metadata and error details) for security, abuse prevention and debugging.

How we use your information

• To run scans, show non-followers and detected unfollowers, and keep your results up to date.
• To sign you in, secure your account and send transactional emails such as password recovery.
• To process your 7-day trial and subscription, enforce plan limits and prevent abuse.
• To measure which campaigns lead to sign-ups, trials and paid subscriptions, if you consented.
• To maintain, debug and improve the service.

What we do not do

• We do not sell your personal data.
• We never send your follower or following lists, your X username, or your email address to analytics or advertising platforms.
• We do not post, follow, unfollow or message on your behalf.

Service providers

We share data only with providers that help us operate the service:

• twitterapi.io, which receives the public username you track and returns public X profile and audience data to our servers. Scans and comparisons are processed server-side; the extension only reads saved results from your account and does not access X pages.
• Stripe, to process payments, trials and subscriptions.
• Google Ads, only if you accepted measurement: the Google tag reports that a registration happened, and our servers report that a trial started or a first payment was made (with the amount excluding tax) together with the ad click identifier. We do not send your name, email address, X username or audience data, and we do not enable personalised advertising signals.
• Resend, to deliver transactional email such as password recovery.
• Google, if you choose Google sign-in, to authenticate you and provide your verified email and Google account identifier.
• Our hosting and database providers, which store and serve the data described above.

We may also disclose information if required by law or to protect the rights and safety of users and the service.

Retention

We keep account and results data while your account is open. Scan history is pruned after 90 days and temporary scan staging data after about a day. Backups and logs may persist for a short period after deletion. Billing records may be kept by us and Stripe as long as required for tax and accounting purposes.

To prevent the one-time free scan from being repeated, when you use it we keep two one-way, keyed cryptographic hashes that survive account deletion: one of your normalized email address and one of the numeric ID of the X account that was scanned (and nothing else: no email, name, handle or scan data). They cannot be reversed into your email or X account, are kept for as long as the free scan is offered, and are used only to recognize a returning address or X account. You can ask us to review them; see your controls below.

Your controls

From Settings you can export your data as JSON, remove a tracked account, and permanently delete your account. Deleting your account removes your tracked accounts and scan data and cancels any active subscription, apart from the anti-abuse hash described above. You can change your analytics choice by clearing this site's stored data in your browser. Depending on where you live, you may also have the right to access, correct or erase your data or object to certain processing; contact us to exercise these rights.

Cookies and local storage

We use a strictly necessary sign-in cookie, and a language cookie that remembers the language you chose or arrived in. If you accept measurement we also set a first-party acquisition cookie (including any Google click identifier), the Google tag may set Google Ads cookies, and we store your consent choice in your browser's local storage. A short-lived cookie marks a newly created account so the registration is reported once, and is deleted immediately. Google Consent Mode is used: all Google signals are denied by default and the Google tag does not load until you agree.

Security

Passwords are hashed, sessions use HTTP-only secure cookies, and traffic is encrypted in transit. No system is perfectly secure, so we cannot guarantee absolute security.

Children

The service is not directed to children under 16, and we do not knowingly collect their data.

Changes

We may update this policy and will change the date above when we do. Material changes will be communicated where reasonably possible.