Privacy Policy

1. Overview

This Privacy Policy explains how Xholic ("Xholic," "we," "us," or "our") collects, uses, stores, and shares information when you use xholic.ai, the Xholic web application, the Xholic browser extension for Google Chrome, and any related services (collectively, the "Services").

By using our website, browser extension, or any of our Services, you agree to the data practices described in this policy.

2. Information We Collect

We may collect the following categories of information:

Account and contact data: such as your email, name, and profile metadata when you sign up.
Connected-account and invitation data: the inviter and invitee account identifiers, 𝕏 username or stable account identifier, an invitation email address when supplied by the inviter, invitation status and timestamps, retry and abuse-prevention metadata, connection status, sponsoring account, shared-pool attribution, and the active workspace selected in the Services.
Social platform data: limited data from your 𝕏 account when you connect via OAuth, based on permissions you authorize.
Usage data: device, browser, page views, interactions, and service performance data.
Billing data: subscription plan, billing status, transaction metadata, and limited payment-related information provided by our payment processors. We do not store full payment card numbers ourselves.
Support communications: messages and related metadata when you contact us.
Human ghostwriting and priority support data: account context, product context, preferences, drafts, generated outputs, instructions, and related messages you provide or create when you use a plan that includes personalized writing or priority support.
Browser extension data: when you use the Xholic browser extension on x.com, we collect data described in Section 3 ("Browser Extension") below.
Smart Scheduler data: scheduled post text, uploaded images or videos, filenames, file types, image descriptions, temporary storage identifiers, schedule slots, timezone, post status, posted tweet and media identifiers and URLs, media-cleanup status, automation rule settings, automation outcomes, failure messages, retry metadata, and related scheduler activity.

3. Browser Extension

The Xholic browser extension operates on x.com (formerly Twitter) to provide AI-powered reply generation and refinement, content discovery, and collection management. This section describes the extension's data practices in detail.

3.1 Data Collected by the Extension

Tweet content and metadata: when you interact with a tweet (e.g., open the reply panel or save a tweet), the extension reads its identifier from the page. Our servers then resolve relevant public tweet text, author information, metrics, and available contextual metadata from our authorized 𝕏 data sources and cache.
Your active 𝕏 account: the extension reads your logged-in 𝕏 username or account identifier from the page to verify the account and select an Xholic account or connected workspace that you are currently authorized to use.
Reply text: when you compose or insert a reply using our suggestions, the text of that reply is transmitted to our servers for tracking and analytics.
Reply refinement data: when you ask Xholic to refine reply suggestions, the extension sends your instruction and the text and angle of the four current suggestions to our servers. We combine them with relevant tweet and personalization context and send the resulting prompt to our AI model provider to generate a revised set. We may record operational metadata such as the generation mode, instruction length, generation identifiers, suggestion count, usage, and timestamps. Xholic does not intentionally persist the raw refinement instruction in its application database. Third-party provider retention is described in Section 7 below.
Authentication and workspace information: one or more session tokens, related Xholic account identifiers, and the selected authorized workspace may be securely passed from the Xholic web application to the extension and stored locally in Chrome's storage API to authenticate and route API requests.
Extension lifecycle telemetry: the extension creates an installation identifier and sends installation, update, account-linking, and uninstall signals to help us understand extension adoption and reliability. This may include extension version, install/link/uninstall timestamps, and a server-issued uninstall URL token.
Extension feature-action telemetry: when you use core extension actions such as opening reply suggestions, remixing a tweet, using a tweet as a template, saving a tweet, or submitting a reply, we may record the action type, relevant tweet identifier, collection identifier, reply tweet identifier, installation identifier, and timestamp to understand feature usage and reliability.
Reply suggestion feedback: when you rate an AI-generated reply suggestion, we may collect the thumbs vote, selected reason codes, optional custom reason text, suggestion text and angle, tweet identifier, generation identifier, suggestion identifier, suggestion index, installation identifier, and timestamps.
Reply-outcome personalization: when you select a generated suggestion and submit a reply, we may record the selected suggestion's text, angle, generation and index identifiers; your final posted reply text; an edit-distance ratio; the public reply identifier; public like, reply, repost, quote, bookmark, and view counts; a derived engagement score; your installation identifier; and related timestamps. We use these records to understand which suggestions work for you and personalize future suggestions.

3.2 Permissions and Why We Need Them

Host permission (x.com): required to inject the content script that reads tweet data and provides in-page reply features. The extension only runs on x.com and does not access any other websites.
activeTab: used to interact with the currently active x.com tab when you trigger an action.
sidePanel: used to display the Xholic side panel within Chrome for reply suggestions and collection management.
storage: used to store your authentication session information, Xholic account and authorized workspace identifiers, workspace selection, and random installation identifier locally on your device using Chrome's storage API. No unrelated browsing history is stored.

3.3 Cross-Origin Communication

The extension communicates with the Xholic web application (app.xholic.ai) to receive session and authorized-account information after you sign in or add another standalone account. This communication uses Chrome's externally connectable messaging API and is restricted to verified Xholic domains. No third-party websites can send messages to the extension.

3.4 AI and Machine-Learning Processing

Tweet content, current or generated suggestions, refinement instructions, and relevant personalization context may be sent to our servers and processed by AI and machine-learning models (including third-party large language model providers) to generate or refine personalized reply suggestions, content recommendations, and engagement insights. We do not use your data to train third-party AI models. AI-generated suggestions are provided for your review and are never posted automatically.

A refinement instruction is used to revise the current suggestion set for the selected tweet. It is not saved as a standing custom reply rule or used by itself to update your long-term taste memory. If you later rate, select, edit, or post a refined suggestion, that later activity may be processed under the feedback and reply-outcome practices described in this policy.

Reply suggestion feedback is used to personalize future suggestions, improve your reply taste memory, avoid repeated suggestion patterns you reject, and maintain service quality. Retracted feedback is removed from active feedback records and is no longer used for same-tweet regeneration or long-term taste memory, subject to ordinary backup, security, and legal retention practices.

When you select a generated suggestion and submit a reply, we may compare the suggestion with the reply you posted and use its later public engagement metrics as a personalization signal. Reply tracking may also support Goals & Streaks reply counting.

For posts with media, the current reply-generation flow uses only textual context made available through our 𝕏 data sources, such as media alt text, title, or description and linked-article preview text. It does not download image or video files or send media pixels to an AI model for vision analysis. If that practice changes, we will update this policy and provide any required notice or choice before the new processing begins.

3.5 Local Storage and Data Minimization

The extension stores session information for the Xholic accounts you add, related Xholic account and authorized workspace identifiers, your current workspace selection, and a random installation identifier locally using Chrome's storage API. Tweet data and reply suggestions are fetched on demand and are not persisted in the browser. Reply refinement instructions are held in temporary browser memory for the active flow and are not saved to Chrome's storage API. You can remove all locally stored data by signing out of the relevant account, uninstalling the extension, or clearing extension storage.

3.6 Chrome Web Store Limited Use

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use extension data only to provide or improve the extension's disclosed features and related security, reliability, and operational functions.

4. Connected and Standalone Accounts

Xholic lets eligible users invite another account to become a connected workspace. We may receive an invitation email address directly from the inviter when the intended recipient is not yet registered or cannot be identified from an existing Xholic account. We use that address to deliver and manage the invitation, prevent invitation abuse, and communicate the invitation's status. The invitation identifies the Xholic user who initiated it.

A connection request does not give the inviter access to the intended recipient's workspace. Access begins only after the recipient accepts the request through the Services. The recipient may decline the request or later revoke access, and a connected user may disconnect. We revalidate connected-workspace authorization for protected requests so that a completed revocation or disconnection ends future access, including from other active tabs, devices, and the browser extension.

After acceptance, the connected user can access and work with the information and features made available in that workspace. Depending on the features used, this may include drafts, saved content, personalization and Xholic Brain data, product context, scheduler content and settings, and other workspace information. The connected user may initiate available actions, including generating, saving, scheduling, or publishing content through the account owner's existing authorized 𝕏 integration. Xholic does not disclose the account owner's password, raw OAuth tokens, full payment details, or other credentials to the connected user.

We use connection and workspace-selection information to verify access, switch between authorized workspaces, attribute usage to the correct plan or shared pool, provide invitations and account controls, prevent abuse, maintain audit and security records, and synchronize access changes across active sessions.

Standalone accounts are separate signed-in Xholic accounts kept on the same device for convenient account switching. They are not connected to one another merely because they appear in the same account switcher. Each standalone account retains its own workspace, subscription, billing, usage, and sessions. You can sign out of an individual standalone account without signing out of every account on that device, or use available security settings to revoke its other active sessions.

5. Smart Scheduler and Posting Automation

Smart Scheduler lets you save drafts, queue posts, choose recurring or custom posting times, publish approved posts, and configure automation rules such as auto-retweet or auto-delete conditions. To provide these features, we process the post text you submit, your selected schedule slots and timezone, any supported images or videos you attach, image descriptions, post status, posted tweet and media identifiers and URLs, automation rule configuration, metrics needed to evaluate those rules, retry state, media-cleanup state, failure logs, and related operational metadata.

When Smart Scheduler publishes a post or runs a configured automation, Xholic sends the necessary request to 𝕏 through the authorized platform integration. We may record whether the action succeeded, failed, was skipped, or requires your attention so the scheduler can show accurate history and reliability alerts.

6. How We Use Information

We use information to:

Provide, maintain, and improve Xholic features.
Personalize discovery, recommendations, and content suggestions.
Generate and refine AI-powered reply suggestions and content insights based on tweet context, your instructions, and relevant personalization context.
Personalize reply suggestions using your submitted thumbs feedback, reason selections, optional custom feedback text, and real reply activity.
Evaluate selected suggestions against your edits and public reply performance to personalize later suggestions.
Save drafts, schedule approved posts, publish scheduled posts, and run automation rules you configure.
Operate signup, trial, and onboarding flows.
Deliver and manage connected-account invitations, verify current workspace authorization, switch between authorized accounts, and attribute shared-plan usage.
Measure website usage, diagnose performance, and improve our marketing site and product experience.
Process subscriptions, payments, invoices, and account support.
Provide plan-specific priority support and human ghostwriting where included in your subscription.
Monitor security, detect abuse, and prevent fraud.
Comply with legal obligations and enforce our terms.

5.1 Website Analytics and Cookies

On xholic.ai, we use analytics cookies and similar technologies to understand traffic sources, site usage, conversion activity, and performance. This helps us improve the website, marketing pages, and onboarding flow.

For visitors located in the European Economic Area (EEA), the United Kingdom, and Switzerland, we ask for consent before enabling non-essential analytics technologies on the website. For visitors in other regions, analytics may be enabled without a consent banner where permitted by applicable law. You can change your website cookie preference at any time through Cookie Settings.

7. Data Sharing

We do not sell your personal data. We may share data with trusted providers that help us operate the service (such as hosting, analytics, payment processing, AI model providers, and customer support tooling), and when required by law.

Our website analytics stack currently includes Google Tag Manager and Google Analytics 4 for traffic and conversion measurement, Microsoft Clarity for usability and session insights, and PostHog for landing and product analytics. When enabled, these providers may receive device, browser, page, referral, and interaction data and may set or read cookies or similar identifiers on your device.

When you purchase a subscription, payment processing is handled by our third-party payment provider, currently Dodo Payments. Their use of your information is governed by their own terms and privacy policies. We do not store full payment card numbers ourselves.

When you use human ghostwriting or priority support, Xholic personnel and authorized service providers may review the minimum account, product, draft, scheduling, preference, and support context needed to provide that service. We limit access to people and providers who need it to operate, support, secure, or improve the Services.

When you accept a connected-account invitation, you direct us to make the information and controls available in your workspace accessible to the connected user as described in Section 4. We share workspace information with that user only while a valid connection authorizes the access. We do not disclose your Xholic password, raw 𝕏 OAuth tokens, full payment details, or other account credentials to them.

When you use Smart Scheduler, relevant post text, attached media, scheduling instructions, and automation requests may be sent to 𝕏 or its APIs as needed to publish approved posts, check metrics, or run configured actions. Those interactions remain subject to 𝕏's own terms and privacy practices.

AI prompt content, including tweet content, current or generated reply suggestions, refinement instructions, and relevant personalization context, may be sent to third-party large language model providers to generate and operate the requested AI features and to support service security and abuse prevention. Under OpenAI API defaults, API data is not used to train OpenAI models unless the customer explicitly opts in; default abuse-monitoring logs may contain prompts and responses and may be retained for up to 30 days, and API features that store application state may retain that state under their configured retention period. We do not opt your Xholic content into third-party general-purpose model training.

Reply suggestion feedback, reply-outcome records, and related taste-memory data are used by Xholic to provide and improve personalized reply suggestions. We do not sell this data or use it for personalized advertising.

8. International Data Transfers

Your data may be transferred to and processed in countries other than the one in which you reside, including the United States and other jurisdictions where our service providers operate. When we transfer data internationally, we rely on appropriate legal mechanisms such as Standard Contractual Clauses (SCCs) or equivalent safeguards to protect your data.

9. Data Retention

We keep data for as long as needed to provide the service, meet legal obligations, resolve disputes, and enforce agreements. Retention periods vary based on data type and operational needs.

Xholic does not intentionally retain raw reply refinement instructions in its application database. We may retain related operational metadata, such as instruction length, generation identifiers, usage, and timestamps, under our ordinary service, security, and legal retention practices. AI providers may retain prompt and response data as described in Section 7.

Media uploaded through Smart Scheduler is stored temporarily while a post is waiting to publish or being delivered to 𝕏. After successful publication, the temporary copy is scheduled for deletion after a three-day retention period. We may retain the 𝕏-hosted media URL and limited upload, publication, and cleanup metadata so post history and operational records remain accurate.

We may retain invitation, connection, access, revocation, session, and related audit records for as long as reasonably needed to operate the feature, investigate security or abuse, resolve disputes, enforce our Terms, and meet legal obligations. Disconnecting an account ends future connected access but does not delete the account owner's workspace content. Declined, expired, or removed invitations may remain in limited security and audit records under these same retention criteria.

We may retain certain billing, transaction, security, and compliance records after account closure where reasonably necessary for legal, tax, audit, fraud prevention, or enforcement purposes.

10. Security

We use reasonable technical and organizational safeguards to protect data, including encrypted connections (TLS) for all data in transit, restricted access controls, and secure token storage. However, no system is 100% secure, and we cannot guarantee absolute security.

11. Your Rights and Choices

Depending on your location, you may have the following rights under applicable data protection laws (including the GDPR, CCPA/CPRA, and similar regulations):

Access: request a copy of the personal data we hold about you.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your personal data, subject to legal retention obligations.
Portability: request a machine-readable export of your data.
Restriction or objection: request that we limit or stop processing your data in certain circumstances.
Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.
Non-discrimination: we will not discriminate against you for exercising your privacy rights.

To exercise any of these rights, contact us at [email protected]. We will respond within the timeframe required by applicable law.

You can also manage website analytics consent directly through on the website.

You may also decline a connected-account invitation, revoke or disconnect connected-account access, sign out individual standalone accounts, revoke active sessions, disconnect linked 𝕏 accounts, unsubscribe from marketing communications, and uninstall the browser extension. Deleting your account or cancelling a subscription does not eliminate records we are required or permitted to retain for billing, compliance, dispute resolution, or security purposes.

12. Lawful Basis for Processing (EEA/UK/Switzerland)

If you are located in the European Economic Area or the United Kingdom or Switzerland, we process your personal data on the following legal bases:

Performance of a contract: to provide the Services you have requested, including AI-powered features, browser extension functionality, connected and standalone account features, scheduled publishing, configured automation rules, subscription billing, priority support, and human ghostwriting where included in your plan.
Legitimate interests: to improve our Services, ensure security, and prevent fraud, where those interests are not overridden by your rights.
Consent: where you have given explicit consent, such as allowing analytics cookies on xholic.ai, connecting your 𝕏 account, or installing the browser extension.
Legal obligations: to comply with applicable laws, regulations, and lawful requests.

13. Children's Privacy

Xholic is not intended for children under 13 (or the minimum age required by your jurisdiction). We do not knowingly collect data from children. If we learn that we have collected personal data from a child under 13, we will delete it promptly.

14. Policy Changes

We may update this policy over time. We will post updates on this page and revise the "Last updated" date. If we make material changes, we will provide prominent notice through the Services or by email.

15. Contact

For privacy-related questions or to exercise your data rights, contact us at [email protected] .

Also see our Terms of Service.