Privacy Policy

1. Who is responsible for your data

For personal data we collect about you as our user, John Brown is the data controller (the "business" under U.S. state privacy laws). For Collected Content and other data that you choose to collect, upload, or process through the Service, you are the controller (or business) and we act solely as a processor (or service provider) at your direction. You can reach us at JohnBrownFlex@proton.me.

2. Data we collect

Data you give us

• Account data: your email address, workspace name, and login credentials. Passwords are stored in hashed form, not in plain text.
• Login State Files: files you upload that contain session data (including cookies) for your Connected Platform accounts, plus the account names, links, and labels you enter for them. The Login Helper runs on your device and saves the file locally, and nothing is sent to us until you upload it. When you sign in to a Connected Platform using the Login Helper, your authentication happens directly between your device and that platform; we never collect, log, or transmit your platform password.
• API keys and model settings: model names, base URLs, and API keys you enter in the settings.
• Your content: prompts, followed-account lists, Drafts, and other material you create or upload in the Service.
• Messages: what you send us when you contact us for support.

Data from Connected Platforms, at your direction

• Collected Content: public posts, and related data such as publication time and engagement counts, from the accounts you choose to follow. This can include names, handles, and other personal data of the people who published them.
• Performance data: views, interactions, and follower changes for your own connected accounts.

Data we collect automatically

• Usage and device data: IP address, browser type, operating system, pages and features used, timestamps, and error logs, from the website and the Login Helper.
• Cookies and similar technologies: the ones needed to keep you signed in and to secure the Service (see Section 9).

Payment data

Paddle.com, our Merchant of Record, processes payments. Paddle collects your payment details, billing address, and tax information under its own privacy notice. We receive limited information from Paddle, such as your plan, subscription status, and the country and email used for the order. We do not receive your full card number.

3. How we use your data

We use personal data to:

• provide and operate the Service: create your Account, use your Login State Files to collect content, sync performance data, or publish at your request, and generate Drafts with the model you choose;
• process payments and manage your subscription and Credits through Paddle;
• keep the Service secure, prevent abuse, and troubleshoot problems;
• communicate with you about your Account, security, changes to our terms, and support requests;
• comply with legal obligations and enforce our Terms.

We do not use your prompts, Drafts, or Login State Files to train artificial intelligence models, and we do not use your Login State Files or API keys for any purpose other than carrying out your requests. However, when your prompts or content are sent to an AI model provider, especially when you use your own API key or a custom base URL, that provider's own data retention and model-training policies apply.

4. Legal bases (EEA, UK, and similar regions)

Where data protection law requires a legal basis, we rely on: contract, to provide the Service you ask for; legitimate interests, to secure and improve the Service and prevent abuse, balanced against your rights; legal obligation, where the law requires us to keep or disclose data; and consent, where we ask for it, which you can withdraw at any time.

5. Who we share data with

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. We share data only with:

• Paddle, our Merchant of Record, to process payments, taxes, invoices, and refunds.
• Infrastructure and service providers that host the Service, store data, send email, and monitor errors. They process data only on our instructions.
• AI model providers, only the content you submit for generation, and only through the model you choose or that we use for the Service. Their own terms and privacy policies apply to what they receive.
• Connected Platforms such as X and Xiaohongshu, because the Service acts on them at your direction, for example when it publishes a Draft or reads your account data.
• Authorities, advisers, or a successor: where the law requires, to protect rights and safety, or in connection with a sale or reorganization of the business, with notice to you if your data becomes subject to a different privacy policy.

6. Collected Content about other people

When you collect public posts, the Service stores them for you. We do not use that content to build profiles of individuals. If you are the author of a post that appears in someone's workspace and want it removed from our systems, contact us at JohnBrownFlex@proton.me with the link to the post and we will review and process your request in accordance with applicable law. Many posts remain visible on the original platform until their author removes them there.

7. Retention and deletion

We keep personal data while your Account is active and as long as needed to provide the Service. You can delete a Login State File, API key, or any content in the Service at any time, and you can delete your Account by contacting us at JohnBrownFlex@proton.me. If you have an active paid plan, please cancel your subscription through the billing portal or Paddle before or when you request Account deletion, to prevent future billing. After you delete your Account we delete or anonymize your data, including stored Login State Files and API keys, generally within 30 days. We may keep limited records for longer where the law requires, for example billing records, or to resolve disputes and prevent abuse. Backups are overwritten on a regular cycle.

8. Security

We use commercially reasonable technical and organizational measures to protect personal data, and we limit access to Login State Files and API keys. No method of storage or transmission is completely secure, so we cannot guarantee absolute security. Keep your Account credentials safe, and tell us right away if you think any file or key has been exposed.

9. Cookies

We use cookies and similar technologies that are needed to keep you signed in, remember your preferences, and protect the Service. You can block cookies in your browser, but the Service may not work without them. We will update this Policy and, where required, ask for your consent before we add analytics or advertising cookies. We do not currently respond to browser Do Not Track signals, because we do not track users across third-party websites or use behavioral advertising cookies.

10. Your rights and choices

Depending on where you live, you may have the right to access your personal data, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent. If you are in the EEA or UK, you can also complain to your local data protection authority.

If you are a California or other U.S. state resident, you may have the right to know what personal information we collect and how we use it, to request access, correction, and deletion, and to opt out of the sale or sharing of personal information. We do not sell or share personal information for advertising, and we will not treat you differently for exercising these rights.

To use any of these rights, email JohnBrownFlex@proton.me from the email address associated with your Account. If you do not have an Account, give us enough information to verify your identity and locate the relevant data, such as the link or handle of the public post. We may need to verify your identity, and we respond within the time required by law. If we deny a request, you may appeal by replying to our response, and you may contact your state attorney general.

11. International data transfers

We are based in the United States, and your data is processed in the United States and in other countries where our providers operate. If you are in the EEA or UK, we rely on appropriate safeguards for these transfers, such as standard contractual clauses, where required.

12. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Third-party services

The Service links to and works with services we do not control, such as Connected Platforms, Paddle, and AI model providers. This Policy does not cover their practices. Please read their privacy notices.

14. Changes to this Policy

We may update this Policy from time to time. For material changes we will give notice in the Service or by email before they take effect, and we will change the date at the top. If you keep using the Service after the effective date, you accept the updated Policy.

15. Contact

Questions or requests about this Policy: JohnBrownFlex@proton.me

John Brown, United States