01Scope and identity
This policy applies to the CompoundX website, Chrome extension, OAuth sign-in, AI drafting, and subscription service. CompoundX is an independent product and is not affiliated with, endorsed by, or acting for X Corp.
It does not cover X, browser stores, or third-party websites' own processing. Their privacy policies also apply when you use those services.
02Data we process
X sign-in, account, and publishing access
- We retain your X user ID, username, and profile image URL to identify and display your CompoundX account.
- Ordinary sign-in credentials are used only for identity confirmation and are not retained. If you separately enable scheduled publishing, we store encrypted publishing and refresh credentials until you disconnect publishing or delete your account.
Saved posts, drafts, and schedules
When you actively save a post, we retain its link, author, text, language, public metrics, and CompoundX-derived assessment. We also store drafts, versions, images attached to drafts, scheduled times, and publication results so you can manage content across devices and run schedules you confirm.
Extension data stored locally
To show markers, forecasts, and daily settlement, the extension stores settings, profile snapshots, post and author identifiers, public engagement metrics, forecasts, action records, and diagnostic counters in your browser. Installing the extension does not automatically upload this local data.
Synced analytics data
When actions are synchronized, we store the X user ID, post ID, target user ID, action type and time, together with derived metrics such as follower count, views, reply position, and predicted reach. Analytics events do not contain the post body.
AI generation and personal materials
You may actively save identity details, real experiences, results, opinions, and writing preferences. They remain in your account until you disable or delete them or request account-data deletion. When you request generation with “Use personal materials” enabled, the service selects only a small number of relevant entries and sends them to the AI processing provider with your idea, text from the selected public post (which may have been published by another X user), output language, and generation parameters. CompoundX does not retain the original generation request and keeps only limited audit information needed for metering, security, and troubleshooting.
Orders and subscriptions
We retain the account linkage, product, amount, currency, and payment status needed to handle subscriptions, orders, refunds, and taxes. Card numbers and full billing addresses are handled by Creem and are not retained by CompoundX.
Necessary technical data
We process sign-in state and IP addresses only as needed for authentication, security, and abuse prevention. Extension settings and computed results are stored locally in your browser.
03Why we use data
- Complete X OAuth sign-in and identify your account.
- Provide post markers, reach estimates, action settlement, and personal calibration.
- Save content, generate drafts, manage schedules, and publish original posts at times you explicitly confirm.
- Process Pro subscriptions, confirm payments, and prevent duplicate orders.
- Enforce quotas, diagnose failures, prevent fraud, and protect the service.
- Comply with applicable law and respond to account or data requests.
CompoundX does not automatically like, follow, reply, or send direct messages. It calls X's publishing API only after you separately grant publishing access and confirm an original post schedule or “Publish now.”
04Service providers and disclosure
We do not sell personal data. We use these providers only as necessary to deliver the service:
- X for sign-in and account identity lookup. See the X Privacy Policy.
- AI processing providers to process submitted content only when you request generation.
- Cloud database and infrastructure providers for accounts, analytics, orders, application hosting, backups, and security logs.
- Creem to create checkout sessions, process payments, and manage subscriptions. See the Creem Privacy Policy.
Contact us through the support email if you want to know our current providers. We may also disclose necessary information when required by law, to protect users and the service, during a corporate transaction, or with your express consent.
Chrome Web Store Limited Use
CompoundX’s use and transfer of information received through the Chrome extension and related APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell this data, use it for personalized advertising, or allow human access except with explicit consent to access specific data, for security investigations, or when required by law.
05Retention and your controls
- Local browser data remains until removed by extension cleanup rules, cleared by you, or removed when you uninstall the extension.
- Personal materials remain until you delete individual entries or request account-data deletion. Disabling an entry prevents future generation use but does not delete it.
- Draft images are normally retained for 14 days after upload or the related scheduled publication. For later schedules, retention extends through 14 days after publication, then automated cleanup removes them.
- Account data remains while needed to provide account services. Signing out or revoking the X connection does not necessarily delete the CompoundX account; you may separately request deletion.
- Action and generation audit data remains as needed for calibration, settlement, security, and dispute handling, then is deleted or anonymized.
- Billing records remain as needed for subscriptions, accounting, tax, refunds, and fraud prevention.
You can clear local browser storage, revoke OAuth through X's connected-app settings, and request access, correction, export, or deletion of server-side data by email.
06Security and international processing
We use encrypted transmission, least-privilege authorization, access controls, and separated secrets to protect data. No system can guarantee absolute security. If a relevant incident occurs, we will notify and remediate as required by applicable law.
Providers may process data outside your country or region. Where required, we use contractual and security safeguards for international processing.
07Your rights, children, and changes
Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, obtain portability, and complain to a regulator. We verify account ownership before fulfilling a request.
CompoundX is not directed to children below the age at which they can independently consent to online services where they live. Contact us if you believe a child provided data.
We may update this policy. Material changes will be communicated through the website, extension, or another appropriate channel, and the date above will change.
Contact
For privacy, access, or deletion requests, email support@compoundx.cc or visit the contact page.