Privacy Policy

We collect only what we need to run the Service:

• Account data — your email address and basic profile from your sign-in provider (Google).
• Connected X account data — the public profile of each X account you connect (user id, handle, display name, avatar), and OAuth access & refresh tokens issued by X.
• Content you create — the posts, threads, schedules, AI prompts, generated images and automation settings you store in the Service.
• Billing data — your subscription status and a customer reference from our payment provider. We never receive or store your full card details.
• Technical data — standard logs (e.g. IP address, timestamps, errors) generated when you use the Service.

We use your data to:

• provide the Service — authenticate you, store your content, and publish to your connected X accounts on your instruction;
• run AI features by sending the text and prompts you submit to our AI provider;
• process subscriptions and prevent abuse;
• maintain security, debug issues, and improve the Service;
• comply with legal obligations.

We process your data on the basis of: contract (to provide the Service you sign up for), consent (where you connect an X account or opt into a feature), legitimate interests (security, abuse prevention, product improvement), and legal obligation (e.g. accounting).

When you connect an X account, X issues OAuth tokens that let us act on your behalf (for example, to publish a scheduled post). These tokens are encrypted at rest using AES-256-GCM and are used only to perform the actions you configure. We never see or store your X password. Disconnecting an X account revokes the token at X and deletes it from our database.

AI text and image generation is performed by Google (Gemini). When you use an AI feature, only the input you submit (such as a topic or image prompt) is sent to the provider to generate a response. We do not use your content to train AI models, and we rely on the provider not to do so for API requests in line with its terms.

We share data only with service providers that help us operate the Service:

• Supabase — authentication, database and file storage.
• Google (Gemini) — AI text and image generation.
• Lemon Squeezy — payment processing (merchant of record).
• Vercel — application hosting and scheduled jobs.
• X Corp — to publish and manage content on the accounts you connect.

We do not sell your personal data. Some providers may process data outside the EEA; where they do, appropriate safeguards (such as Standard Contractual Clauses) apply.

We keep your data for as long as your account is active. When you delete your account, we delete your personal data and connected-account tokens, except where we must retain limited records to meet legal or accounting obligations. Backups are purged on a rolling basis.

Under the GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time. You can delete your account from within the Service, or contact us to exercise any right. You also have the right to lodge a complaint with a supervisory authority — in our case the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

We use only essential cookies required to keep you signed in and to operate the Service. We do not use advertising or third-party tracking cookies.

The Service is not directed to anyone under 18, and we do not knowingly collect data from children. If you believe a minor has provided us data, contact us and we will delete it.

We may update this Policy from time to time; the "Last updated" date above reflects the latest version. For any privacy question or to exercise your rights, contact Chemify OÜ at contacto@quimify.com.