Last updated: July 8, 2026
We collect the minimum needed to run DeckPost: your email, the X accounts you connect, your posts and drafts, and the public engagement data needed for analytics. We don't run third-party ad trackers, we don't sell data, and we don't train shared AI models on your content without opt-in.
Account: your email address (for magic-link sign-in) and plan/billing status. Card details are held by Stripe, never by us.
Content: posts you import to build your voice fingerprint, drafts and queue items you create, and metadata about published posts (timing, engagement) used for analytics and coaching.
Product analytics: privacy-respecting usage events (PostHog), used only to improve the product. No third-party advertising trackers, ever — which is why you don't see a cookie wall.
The extension is opt-in and consented at install. It reads public engagement data only on pages you actually visit on x.com, to show engagement chips and to power your analytics without expensive API polling. It never reads DMs, never acts on your behalf, and never collects browsing data outside x.com and app.deckpost.io.
Observations buffer locally in your browser's extension storage and sync only to your own DeckPost account when you're signed in. Uninstalling the extension deletes the local buffer.
Your posts are processed to build a private voice fingerprint (style features and exemplar references) that scores and steers drafts for your account only. Drafts may be generated and scored by third-party AI providers under contracts that prohibit training on your data.
We do not use your content to train shared models without your explicit opt-in, and there is no dark-pattern default: the setting starts off.
Data lives on servers in the EU. We keep it while your account is active. Deleting your account removes your content, fingerprint and observations within 30 days (backups age out on the same schedule).
You can export your data (posts, drafts, analytics) from the app at any time in a machine-readable format, and you can request deletion by email if you can't access the app.
We share data only with processors needed to run the service: Stripe (billing), our hosting provider, our AI providers (draft generation/scoring), and PostHog (product analytics). Each is bound by a data-processing agreement. We never sell personal data.
Depending on where you live (GDPR, UK GDPR, CCPA and similar), you have rights of access, correction, deletion, portability and objection. Write to privacy@deckpost.io and we'll respond within 30 days.
Material changes are announced on the changelog and by email 14 days in advance. The 'last updated' date at the top always reflects the current version.
Questions about this policy: legal@deckpost.io.