Last updated: July 2026
We collect your email address (for authentication), X OAuth access/refresh tokens (stored encrypted), posts you create, your subscription status, and standard server logs.
Your data is used solely to operate Genpost: authenticating you, generating and scheduling posts on your behalf, and billing you. We do not sell your data.
Your X OAuth tokens are encrypted at rest using AES-256-GCM with a key stored in our server environment. They are decrypted only at the moment of posting and never logged.
We use: Supabase (database/auth), Paystack (billing/payments), Trigger.dev (background jobs), and Google Gemini API (AI generation). Each has its own privacy policy.
We retain your posts and account data while your account is active. You may request deletion at any time via Settings → Delete Account.
We use session cookies for authentication (managed by Supabase) and a short-lived cookie during the X OAuth flow. No advertising cookies.
You may access, export, or delete your data at any time by contacting us or using the in-app controls.
We implement industry-standard security: HTTPS everywhere, encrypted token storage, Row-Level Security on all database tables, and no plaintext secrets in code.
Privacy questions: privacy@genpost.io.