Privacy Policy

What we collect

• X account data — your X user ID, handle, display name, avatar, public profile fields, and public posts, read through X's official API under the OAuth authorization you grant. We never read private accounts, direct messages, or any account you did not authorize.
• Authorization tokens — the short-lived OAuth token X issues is stored encrypted and used only to perform the reads for your purchase.
• Payment facts — order, amount, and refund status from Dodo Payments, our merchant of record. Your card details go to Dodo directly and never reach us.
• Operational records — technical logs, error codes, and anti-abuse signals needed to run the service. Roast prompts and your post contents are not written into logs.

How we use it

Your data is used for exactly one product purpose: generating the roast you paid for, rendering its share card, and operating the service around it (payment, delivery, refunds, fraud and abuse prevention, and legally required accounting). We do not sell your data, run advertising, or use your content to train models.

Who processes it

• Cloudflare — hosting, storage, and delivery infrastructure.
• An AI model provider — processes the public posts to write your roast.
• Dodo Payments — checkout, taxes, refunds, and disputes as merchant of record.
• X Corp — the source of your account data, under your OAuth authorization.

How long we keep it

• Fetched posts and intermediate analysis — deleted automatically as soon as your run reaches a final result (delivered, failed, or refunded).
• Your roast, its share card, and the short evidence excerpts it cites — kept until you delete them (see "Your controls").
• Order, refund, anti-abuse, and cost records — kept permanently, as required for accounting and fraud prevention. Deleting your content does not delete these transaction records.

Visibility

Your result is reachable only through an unguessable link, and the public page is marked so search engines do not index it. The public version never shows evidence excerpts, links to your original posts, or internal analysis. A refund immediately takes the public page and share card offline.

Your controls

• Disable the link — permanently kills the public page and share card. Old links stay dead forever.
• Delete content data — removes the stored roast, avatar, share card, and evidence excerpts from our systems.
• Copies already saved by other people, or cached by third-party platforms such as X or messaging apps, are outside what we can delete.

Contact

Privacy questions and requests: support@roastmyx.org.