1. Overview
This Privacy Policy explains how Xholic AI ("Xholic," "we," "us," or "our") collects, uses, shares, and protects personal data when you use xholic.ai, the Xholic web application at app.xholic.ai, the Xholic Chrome extension, our free tools, and related services (the "Services"). Xholic is the controller of the personal data described here, except where we process data on your behalf as described in Section 3.
This policy should be read together with our Terms of Service. If you have questions, contact us at hello@xholic.ai.
2. Information we collect
Information you give us or connect
- Account data: when you sign in with X, we receive your X user ID, username, display name, profile image, and the email address X shares with us, along with OAuth tokens that let Xholic act on your account. You can also verify or change your email address.
- Content and context: drafts, posts, threads, X Articles, media and alt text, instructions, AI context such as your audience, goals, voice rules, and product details, onboarding answers, Worker settings, saved posts, collections, feeds, and Ask conversations and attachments.
- Product websites: URLs you add so Xholic can describe your products, and the content of those pages.
- Contacts and messages: contact lists and notes, Signals settings, DM templates, campaign recipients, and the messages Xholic sends for you.
- Imported analytics: when you upload an analytics export from X, we keep the daily totals and a file fingerprint, not the original file.
- Feedback and support: ratings and reasons for AI suggestions, and messages you send to support with your name, email, and the page you contacted us from.
- Free report requests: when you ask for a free report by email on one of our tool pages, you give us your email address and, optionally, an X handle. We use them to send the report you asked for and, only if you opt in, X growth tips and product updates, each with an unsubscribe link. These emails are sent through Resend.
- Best Tweets digests: when you subscribe on a Best Tweets page, you give us your email address and the topic you chose. We first send a confirmation email and start the digest only after you confirm (double opt-in). Digests are sent about every two weeks through Resend, and every email has an unsubscribe link. We use this email only for the digests you subscribed to.
- Billing data: your plan, billing period, subscription status, payment history, and invoices from our payment provider. We do not receive or store full card numbers.
- Shared access: invitations, recipients, permissions, and acceptance or revocation records when you add accounts or share access.
Information from X and data providers
To provide analytics, feeds, mentions, inspiration, and personalization, we collect your X profile, posts, replies, metrics, followers, following, and mentions from X's APIs and from TwitterAPI.io, an independent provider of public X data. For posts published through Xholic, we also read metrics from X using your authorization.
Information collected automatically
- Sessions and security: IP address, browser and device information, sign-in times, and session identifiers.
- Usage: features used, actions taken, credit and allowance usage, errors, and performance data.
- Website analytics: pages viewed, referrers, and interactions on xholic.ai, collected with cookies and similar technologies as described in Section 8.
- Chrome extension: the data described in Section 4.
3. Information about other people
Many Xholic features work with public information about other X users, such as their profiles, bios, follower counts, and posts. For example, Signals finds and scores potential leads, contact lists and Home cards track accounts you choose, Inspiration and Workers learn from public posts, mentions show who engaged with you, and our free tools look up any public X handle a visitor enters.
We collect this information from X and TwitterAPI.io, store it, and may process it with AI, for example to score how well a profile fits the audience you describe or to explain why a post performed well. We also keep records of DMs sent through Xholic, including the recipient and the message, and the basis for contacting them: either your confirmation that recipients expect your message, or their reply to your post with your keyword.
We use this information only to provide the Services and do not sell it. When you build lead or contact lists or send messages, you are responsible for having a lawful reason to do so. If you are an X user and want to ask about, correct, or object to our processing of your public information, or to stop receiving Xholic-sent DMs, contact hello@xholic.ai.
4. Chrome extension
The Xholic extension runs only on x.com and adds AI reply drafts, remixes, profile analytics, contacts, and quick access to your workspace.
What it collects
- Posts and profiles you act on: when you ask for a reply or a remix, the extension reads that post's identifier and visible content, and for replies, a limited number of earlier posts in the thread for context. When you open analytics for a profile or add it to your contacts, it reads that profile's public username.
- Your active X account: your X user ID and username from the page, to select the matching Xholic account or workspace you are authorized to use.
- Replies you post: when you post a reply on x.com while signed in to the extension, it sends the reply text, the post you replied to, and your account to Xholic. If the reply started from an Xholic suggestion, we link the two to learn from your edits. We use these records to personalize suggestions and for reply analytics and streaks.
- Posts you bookmark or like: when saving is on (it is by default), the extension sends Xholic the posts you bookmark or like on x.com (the post's identifier, author, text, date, public counts, and image links) so they appear in your Library. When you open your Bookmarks or Likes page on X, it saves the posts you scroll past. It only reads what X already shows on the page and never requests anything from X itself. Undoing a bookmark or like removes the copy it made. You can turn either off in the extension's Settings.
- Telemetry: a random installation ID, the extension version, install, update, sign-in, and uninstall events, and which core features you use and when.
Permissions
- Access to x.com: to show Xholic features on X pages.
- Access to thunder.xholic.ai: the Xholic API the extension talks to.
- storage: to keep the installation ID, panel preferences, recent searches, and which notices you've already seen. Recent searches stay in your browser and are not sent to Xholic.
- Messages from app.xholic.ai: only the Xholic web app can send the extension your sign-in session and authorized accounts. No other website can message it.
Sign-in sessions are stored in the extension's own browser storage, not in pages you visit. The extension does not read your browsing on other websites. You can remove its local data by signing out or uninstalling it.
Chrome Web Store Limited Use
Xholic's use of information received through the extension complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. We use extension data only to provide and improve the extension's features and for security. We do not sell it, use it for advertising, or use it to determine creditworthiness, and people at Xholic do not read it except with your permission, for security, or as required by law.
5. How we use information
- Provide, operate, and maintain the Services and your account.
- Generate drafts, replies, rewrites, articles, images, answers, scores, and insights, and personalize them to your voice, audience, and feedback.
- Publish, schedule, repost, delete, and send messages on X as you instruct or configure.
- Show analytics, earnings estimates, feeds, mentions, leads, and recommendations.
- Manage trials, subscriptions, credits, allowances, invoices, and shared access.
- Send service emails, such as receipts, failed payment and failed post alerts, and, unless you opt out, product and marketing emails.
- Provide support and respond to requests.
- Secure the Services, prevent fraud, trial abuse, spam, and misuse, and enforce our Terms.
- Understand how the Services are used and improve them, including our website and onboarding.
- Comply with legal obligations.
6. AI processing
To provide AI features, we send the relevant content to our AI providers, OpenAI and Anthropic. Depending on the feature, this can include your instructions, drafts, AI context, examples of your posts and replies, relevant public posts and profiles, product page content, Ask messages and attachments, and images you ask us to edit. We also create embeddings, numerical representations of text, to power search and personalization.
- We do not use your content to train third-party AI models, and we do not opt your content into provider training.
- Providers process this data to return results to us and may keep it for a limited period, typically up to 30 days, for abuse monitoring under their API terms.
- Your ratings, edits, selected suggestions, and reply performance are used to personalize your own suggestions.
- Reply refinement instructions are used only for the current request. We do not save the raw instruction to your account.
- For posts with images or video, reply suggestions use text such as alt text and link previews, not the media itself.
7. Actions on your X account
With your authorization, Xholic acts on your X account only as you instruct or configure: publishing posts, threads, and X Articles you schedule or post now; running automation rules such as auto-repost, follow-up replies, and auto-delete; sending bulk DM campaigns you launch; and sending Auto DMs to people who reply to your post with your keyword. Workers and Ask prepare drafts and actions for your review; they do not publish without your approval. Xholic does not like posts or follow accounts for you.
We record the result of each action, such as published, skipped, or failed, with identifiers and error details, so you can see your history.
10. International transfers
We and our providers process data in the United States and other countries that may not have the same data protection laws as yours. Where required, we rely on safeguards such as the European Commission's Standard Contractual Clauses and the UK and Swiss equivalents.
11. Data retention
We keep personal data while your account is active and as long as needed to provide the Services. After that, we delete or anonymize it unless we need to keep it for legal, tax, accounting, security, fraud prevention, or dispute purposes. Specific practices include:
- Scheduled media: uploaded media is stored privately until it is published, then deleted after 72 hours. We keep the published post's X links and basic metadata for your history.
- Ask: attachments expire after 7 days. Deleting a conversation removes it from your account view. Its contents are deleted when your account is deleted.
- Lead scoring: evaluations of profiles that were not added as leads are removed after about 30 days.
- Billing records: kept as long as tax and accounting laws require, including after your account closes.
- Security and audit records: sign-in, sharing, invitation, and revocation records are kept as long as reasonably needed to protect accounts and resolve disputes.
Ending a subscription does not delete your account or its data. To delete your account and its data, email us from the address on your account as described in Section 13. Copies may remain in backups for a limited period until they are overwritten.
12. Security
We protect data with encryption in transit (TLS), encryption of X OAuth tokens at rest, private media storage with short-lived access links, access controls, rate limiting, and monitoring. No system is completely secure, so we cannot guarantee absolute security. If a breach affects your personal data, we will notify you as required by law.
13. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, or receive a portable copy of your personal data, to object to or restrict certain processing, and to withdraw consent at any time without affecting earlier processing. To make a request, email hello@xholic.ai from the address on your account. We will verify your identity and respond within the time the law requires. You may also complain to your local data protection authority.
You can also:
- sign out other sessions and manage shared access in your account settings;
- revoke Xholic's access in your X settings under connected apps, which stops features that need it;
- unsubscribe from marketing emails with the link in any marketing email (service emails, such as receipts and alerts, will still be sent);
- change website analytics consent in ;
- uninstall the Chrome extension at any time.
14. Legal bases (EEA, UK, Switzerland)
If you are in the European Economic Area, the United Kingdom, or Switzerland, we process personal data on these legal bases:
- Contract: to provide the Services you sign up for, including your account, X connection, AI features, publishing, extension features, shared access, billing, and support.
- Legitimate interests: to secure the Services, prevent fraud and abuse, improve our products, and process public X information to provide discovery, analytics, and lead-finding features, where these interests are not overridden by your rights.
- Consent: for website analytics cookies and marketing emails where the law requires consent.
- Legal obligation: to meet tax, accounting, and other legal requirements.
15. US state privacy rights
If you live in California or another US state with a consumer privacy law, you may have the right to know what personal information we collect and how we use and disclose it, to access, correct, or delete it, and to opt out of its sale, of "sharing" for cross-context behavioral advertising, and of certain profiling. We do not sell personal information. If our website analytics are considered "sharing" under your state's law, you can opt out with . We honor Global Privacy Control signals where required.
The categories of personal information we collect are described in Section 2: identifiers, commercial information, internet activity, approximate location derived from IP address, content you provide, and inferences such as audience fit scores. We use them for the purposes in Section 5 and disclose them to the recipients in Section 9. We do not use sensitive personal information to infer characteristics about you. You may use an authorized agent to make a request, and we will not discriminate against you for exercising your rights.
16. Children
The Services are for people 18 and older. We do not knowingly collect personal data from anyone under 18. If you believe a minor has given us personal data, contact us and we will delete it.
17. Changes to this policy
We may update this policy. We will post the new version here with a new "Last updated" date and, for material changes, notify you by email or in the Services before they take effect.
18. Contact
For privacy questions or requests, contact hello@xholic.ai.