Privacy Policy

1. Who is responsible

TweetAPI is the controller (Art. 4(7) GDPR) of the personal data described here. Contact: support@tweetapi.com. We haven't appointed a data protection officer.

2. Website

• Hosting and security. The site runs on our servers behind Cloudflare. When you open a page, your browser sends technical data (IP address, browser, page, time) that Cloudflare and our servers use to deliver the page and protect it from attacks. Legal basis: Art. 6(1)(f), our interest in a working, secure site.
• Analytics (DataFast). We use DataFast to count visits and see which pages and campaigns lead to sign-ups and purchases. It receives the page address, referring site, screen size, language, time zone, operating system and any ad click IDs in the link. It sets cookies on tweetapi.com: datafast_visitor_id, datafast_visitor_first_seen_at and datafast_visitor_session_count (1 year), and datafast_session_id and datafast_session_start (30 minutes). It also links visits to sign-ups and purchases, so we can see which channels bring customers. Legal basis: Art. 6(1)(f).
• Campaign source. If you arrive through a link with campaign tags (utm_*) or a Google ad click ID (gclid, wbraid), we keep them in the tweetapi_utm cookie for 30 days and save them with your account when you sign up, together with the first page you visited. This tells us which campaigns bring customers. Legal basis: Art. 6(1)(f).
• Support chat (Crisp). The chat bubble is provided by Crisp and loads on most pages. Crisp may set its own cookies to keep your conversation going. What you write in the chat, and any email address you give, is used to answer you. Legal basis: Art. 6(1)(f), and Art. 6(1)(b) for questions about your account.
• Free tools and the homepage demo. The timestamp converter and the manual advanced-search builder run in your browser; we don't receive what you enter. The user ID finder and the account lookup on the homepage look up the username or ID you enter through our API without saving the lookup. If you use the AI option in the search builder, the text you submit is sent to OpenAI to turn it into a search query; we don't keep it. To prevent abuse, these tools use Cloudflare Turnstile (a bot check), a cookie holding a random ID (tweetapi_advanced_search_visitor, tweetapi_id_finder_visitor, 1 year), and short-lived counters based on your IP address; we don't store the IP itself. Legal basis: Art. 6(1)(f).
• Email. If you email us, we use your message and address to answer you.

3. Dashboard, API and MCP

• Account. Name and email from sign-up (Clerk runs sign-up, login and two-factor authentication), account ID, API keys and settings. Purpose: running your account. Legal basis: Art. 6(1)(b).
• Billing. Plan, subscription status, invoices and payments. Card payments go through Stripe and crypto payments through NOWPayments; we receive the result, transaction references and the card brand and last four digits, never full card numbers. Stripe keeps the billing name, address and VAT ID you enter at checkout. We keep your email on payment records to match refunds and disputes. Legal basis: Art. 6(1)(b) and (c).
• Request logs. For every API request we record the time, endpoint, method, status code, response time, the API key used and the caller's IP address. We don't record query parameters, request bodies or responses. You can see these logs in your dashboard. Purpose: billing, usage statistics, your logs, troubleshooting and abuse prevention. Legal basis: Art. 6(1)(b) and (f). Kept 90 days.
• X sessions you send. When you call an endpoint with an X auth token, we keep that session's X cookies for up to 7 days after last use, and delete them sooner if X rejects the session. For /tw-v2/auth/login, your username, password and 2FA secret are used only for that login and are never stored or logged. If you set up XChat, we keep your account's XChat keys for up to 6 months; we never store your PIN or message content.
• MCP connections. When you connect an app such as Claude or ChatGPT to our MCP server, we store the app's name and redirect addresses, which API key it uses and your approval. You can disconnect apps in the dashboard. Legal basis: Art. 6(1)(b).
• Product analytics (PostHog, EU cloud). To see how customers use the dashboard, we record dashboard page views and key account steps such as sign-up, checkout and plan changes. These are linked to your account ID, never your email, and contain nothing you type. Nothing is stored in your browser for this, and Do Not Track is respected. Kept up to 1 year. Legal basis: Art. 6(1)(f).
• Service emails (sent through Resend). Usage alerts at 80% and 100% of your allowance, crypto payment and PAYG purchase confirmations, PAYG expiry reminders, and crypto renewal reminders (7 days and 1 day before expiry, and when it lapses). We don't send marketing emails. Legal basis: Art. 6(1)(b).
• Internal notifications. Sign-ups, payments and cancellations (including any reason you give) are sent with your email to our internal notification channel on Telegram. Legal basis: Art. 6(1)(f).

API content. We don't store the X content your requests return. For personal data in it, you are the controller (Terms, section 7).

We don't collect special categories of data (Art. 9 GDPR) about our customers and don't make automated decisions about you that have legal or similarly significant effects (Art. 22 GDPR).

4. Who receives data

Only what each needs: Clerk (sign-up and login), Stripe (card payments, billing details), NOWPayments (crypto payments; it receives the price and an order reference containing your account ID, not your email), Cloudflare (network, security, bot check), DataFast (website analytics), PostHog (product analytics, EU), Crisp (support chat), OpenAI (only when you use the AI search option), Resend (email delivery), Telegram (internal notifications), and the hosting, database and backup providers that run our infrastructure. Also our accountant or legal advisers and authorities where the law requires it, and a buyer or successor if the business is sold or reorganised. If you buy through RapidAPI, RapidAPI shares your RapidAPI username and billing data with us.

We don't sell personal data or share it for anyone else's advertising. Some providers are in the US; transfers there rely on an adequacy decision (such as the EU-US Data Privacy Framework) or the EU standard contractual clauses.

5. How long we keep data

When you ask us to delete your account, we delete or anonymise your data within 30 days, except records the law requires us to keep. Deleted data leaves our backups within 6 months.

6. Cookies and browser storage

• Needed for the Service: Clerk's login cookies, tweetapi_advanced_search_visitor and tweetapi_id_finder_visitor (1 year, abuse prevention), and local storage for dashboard state (the plan chosen during checkout, the playground's selected key ID, never the key itself, and the docs sidebar).
• Analytics: the DataFast cookies and tweetapi_utm (30 days), described in section 2.
• Chat: Crisp's cookies.
• We use no advertising cookies or ad pixels. You can delete or block cookies in your browser; blocking login cookies stops the dashboard from working.

7. Your rights

Under Arts. 15–21 GDPR you can ask to access, correct, delete, restrict or export your data, and object to processing based on our legitimate interests. You can withdraw any consent at any time (Art. 7(3)). Email support@tweetapi.com to use these rights, including deleting your account; we reply within one month. You can also complain to a data protection authority, in particular in the EU country where you live, work or where the issue happened (Art. 77).

8. Security

We use reasonable technical and organisational measures to protect personal data. No method of transmission or storage is completely secure.

9. Children

The Service is for adults (18+) and isn't directed at children.

10. Changes

We'll post updates here and change the date above. We'll email you before material changes take effect.