Privacy policy

1. About this policy

Firecrest (the "Service") helps you write posts and replies for X that fit your niche, and can publish them to the X accounts you connect. It is operated by Squared Sums Pte Ltd ("we", "us", "our"), which is responsible for your personal data as its controller.

This policy explains what personal data we collect, how we use it, who receives it, how long we keep it, and the rights you have over it. Section 11 explains how to reach us.

2. Information we collect

2.1 Information you give us

• Account details: your email address, and your name and profile picture if you add them.
• Content you create: your onboarding answers, posting profiles, drafts, posts, replies and images, and the web pages you ask us to read.
• Payment details: your plan and billing details. Our payment processor handles your card, and card numbers never reach us.
• Messages you send us: support requests, bug reports and feedback.
• Preferences: your language, time zone, posting times and marketing choices.

2.2 Information collected automatically

• Usage information: the features you use, the actions you take, time spent in the Service, and how you found us.
• Technical data: your IP address, browser and device type, sign-in sessions, and error data.

2.3 Information from other sources

• Your connected X accounts: your public profile and how it changes over time, your posts and the replies to them, and the access you grant us.
• Other X accounts: public posts and profile details of the X accounts we show you, such as people replying to you or posts you might reply to.
• Our payment processor: your payment and subscription status.

You need an email address to create an account, and a connected X account to use the features that work with X. Everything else you give us is optional.

3. How we use it

We use your information, and rely on these legal bases, to:

• Provide the Service: run your account, draft and publish your content, bill you, and send you account emails. This is necessary to perform our contract with you.
• Understand and improve the Service: learn how it is used, report on your X accounts' growth, and manage what it costs to run. This is in our legitimate interests.
• Keep the Service secure: prevent abuse, fraud and unauthorised access. This is in our legitimate interests.
• Meet legal obligations, such as keeping accounting and tax records.
• Send you product news and offers, only if you opt in. This relies on your consent, which you can withdraw at any time.

To draft your posts and replies, we send your content, your X profile and relevant public posts from X to AI providers. They process it only to return a response to us.

We do not sell your personal data, use it for advertising, or track you across other apps and websites. We make no decisions about you based solely on automated processing.

4. Who we share it with

We share personal data only as far as running the Service requires:

• Service providers that process it on our behalf: AI providers, X data providers, payment processing, email delivery, hosting and storage, and analytics. They may use it only to provide their services to us, under terms that protect it at least as well as this policy does.
• X, which provides your X account data and receives what you publish. Published content is public and governed by X's own terms and privacy policy.
• Apps you connect, such as an AI app you connect over MCP. They receive the data they work with on your instruction, such as your posts and posting profiles, and their own terms and privacy policies apply.
• Authorities, advisers and buyers, where the law requires it, to protect our rights, or as part of a merger or sale of our business.

We and our service providers process data in Singapore, the United States and other countries. Where the law requires it, we protect these transfers with safeguards such as standard contractual clauses. Contact us for a copy.

5. Cookies and similar technologies

We use cookies and browser storage only to keep you signed in, keep the Service secure, and remember your preferences. Our analytics set no cookies and store nothing on your device, so we show no cookie banner. You can control cookies in your browser settings.

6. How long we keep it

We keep personal data only as long as we need it, and no longer than:

• Account details, content and preferences: while your account exists, and up to 30 days after you delete it.
• Web pages you ask us to read: 1 day.
• Information from your connected X accounts: until you disconnect the X account.
• Information from other X accounts: 60 days.
• Payment details: 7 years after each payment, for accounting and tax purposes.
• Usage information: 2 years, including after you delete your account.
• Messages you send us: 2 years after your last message.
• Technical data: 60 days after you last use the Service.
• A summary of a deleted account (its plan, how long it was a customer and why it left): 7 years.

When a period ends, we delete the data.

7. Deleting your account

You can delete your account from your settings, or by emailing us. Deletion takes effect after 30 days, and you can cancel it until then. We then delete your account details, content, preferences and connected X accounts. We keep your payment details, usage information, messages and an account summary for the periods in section 6.

8. How we protect it

We protect your personal data with measures that include:

• Encryption in transit and at rest: all traffic to and from the Service is encrypted, and so is the data we store.
• Encrypted X credentials: the access we hold for your X accounts is additionally encrypted with a dedicated key that we rotate.
• Passwordless sign-in: you sign in with a one-time code sent to your email, so there is no password to steal. Sign-in attempts are rate-limited, and sessions expire after 60 days without use.
• Private file storage: your images are stored privately and shown only through short-lived, signed links.
• Certified payment processing: your card is handled by a payment processor certified to PCI DSS, and its details never reach our servers.
• Limited access: only the people and systems that need personal data to run the Service can access it.
• Regular audits: we regularly audit the Service for security issues and fix what we find.

If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.

9. Your rights

Depending on where you live, you have the right to:

• access your personal data and get a copy of it;
• correct it if it is inaccurate or incomplete;
• have it deleted;
• restrict how we use it;
• object to how we use it based on our legitimate interests;
• receive it in a portable format;
• withdraw your consent at any time, without affecting what we did before;
• complain to a data protection authority, such as the one where you live or work, or Singapore's Personal Data Protection Commission.

To exercise these rights, email us (section 11). We may ask you to confirm your identity first. We respond within one month, or tell you within that month if we need longer and why.

10. Children

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children under 16. If we learn that we have, we will delete it.

11. Contact us

For questions about this policy or your personal data, or to exercise your rights, email [email protected]. This address also reaches our data protection officer. You can also write to Squared Sums Pte Ltd, 160 Robinson Road, #14-04 SBF Centre, Singapore 068914.

12. Changes to this policy

We may update this policy. We will tell you about material changes in the Service or by email, and update the "Last updated" date above.