Privacy Policy

Short version: Crux turns what you ship into 𝕏X posts. It keeps what the GitHub repos you choose to watch send it (commit messages, pull request and release text, never your code), the notes your coding agent sends through the Crux plugin, and the drafts it writes from them. It reads your own 𝕏X posts and their numbers, from files you upload from 𝕏X (your archive or an 𝕏X Analytics export) or a read-only 𝕏X import, to find the posts you publish from its drafts, read how they do, and learn what works for your account. Text from a private repo you watch is used like any other. Drafts are written by an AI model reached through OpenRouter. Crux does not read your direct messages, posts only what you schedule on Autopilot, does not train a model on your data, and does not sell anything.

1. Who runs Crux

Crux is built and run by Marouane Gazouzi (see About). He decides what Crux collects and why, and he is the person to contact about your data. Crux has no contact mailbox yet, so questions and requests go to him by direct message to @marouanegazouzi on 𝕏.

2. What we collect

What Crux stores depends on what you use. All of it belongs to your account and is deleted with it, except where section 8 says otherwise.

• Your 𝕏X account. Your 𝕏X user id, handle, display name and follower count, and the follower count again each time the metrics refresh reads it. Your 𝕏X profile picture, to show it in Crux: a copy of the picture 𝕏X serves from pbs.twimg.com, read when you sign in or Crux reads your account, at most once a day, and shown only to you, from Crux’s own address. If you tell Crux you asked 𝕏X for your archive, the date you did, until an archive upload arrives or you dismiss it.
• Your 𝕏X connection. The OAuth access and refresh tokens 𝕏X issues to Crux, encrypted at rest with AES-256-GCM, plus the permissions you granted, when you connected, and when you disconnected or 𝕏X asked for a reconnection. Signing in grants read-only access (tweet.read, users.read, offline.access). On Autopilot, if you allow Crux to write to your 𝕏 account (permission to post and to upload images) and turn posting on, it uses that permission only to post the text of the drafts you schedule or press Post now on, and records each post it makes. It does not attach screenshots or videos to those posts.
• Your posts. For each post: its text and date; whether it is a reply, repost or quote; whether it has media or a link; its hashtags and mentions; and its likes, reposts, replies, quotes, bookmarks and impressions. For posts under 30 days old, also profile clicks, link clicks and engagements, which 𝕏X provides only to the account owner; an 𝕏X Analytics export you upload adds them for the posts it covers. We also record whether each post came from a file you uploaded (an archive or an 𝕏X Analytics export) or an 𝕏X import, and the metrics refresh keeps a daily reading of those numbers.
• From an archive upload, only tweets.js (including its -part files), note-tweet.js and account.js are used.
• From an 𝕏X Analytics export, only each post’s id, date, text and link and the numbers listed above are used. The link only serves to check that the export is for your account; other columns, such as shares and new follows, are not stored.
• 𝕏X’s visibility reports, if you upload them. For each month you upload: the month, when 𝕏X generated the report, 𝕏X’s count of your posts that month, and each label row 𝕏X lists (the label, 𝕏X’s own description of it and of its effect, and how many of your posts or days it covered). 𝕏X has no API for this report, so Crux holds only the files you upload, and only to show you what 𝕏X reported beside the posts Crux stores. The reports are never sent to an AI model or to 𝕏X.
• Your GitHub connection, if you connect it. For each installation of the Crux GitHub App you link: its id, the GitHub account it is installed on (yours or your organisation’s) and whether that is a user or an organisation, whether it covers all of that account’s repos or the ones you selected, and whether it is suspended; and your own GitHub user id and login, from the check that the installation is yours. Crux does not keep the GitHub token that check uses. For each repo the installation lets Crux see: its GitHub id, its full name, its default branch, whether it is private, and whether you watch it. While you connect, a sign-in check (a random state, a code verifier and the installation id) that is deleted once used, and is never valid for more than ten minutes.
• Work from the repos you watch. Only for the kinds of event you leave on for automatic drafts: for each commit pushed to the default branch (up to 50 from one push), its id, message, link and time; for each pull request merged into the default branch, its number, title, description and link; for each published release, its tag, name, notes and link. Each comes with the repo’s name and when it happened, and its text is cut to 4,000 characters. GitHub’s messages to Crux also carry the names, GitHub logins and email addresses of commit authors and the names of the files each commit changed: Crux does not store them, and it never fetches a file or a diff. Crux also keeps the id of each message GitHub sends, with its event name and when it arrived, so a message sent twice is stored once; those ids are not linked to your account.
• Notes from your coding agent. For each note the Crux plugin sends: its title, what changed, why, who it is for, up to 5 highlights, the kind of change, the repo and commit it names, if any, which of your plugin tokens sent it, whether it is waiting for its commit, part of a batch, or drafted on its own, and, while it waits, until when.
• Screenshots and videos from your coding agent. On Pro, the Crux plugin can attach a screenshot of a change, or a video made on your own machine, to the work it shows. For each file: the file itself, after Crux removes its metadata (such as EXIF, which can hold where a photo was taken), its name, type, size and dimensions, a SHA-256 hash of it, the batch or commit it belongs to, which of your plugin tokens sent it, and when. Only you can open it until its entry is published on your public changelog: by your click, or, for a public repo whose changelog you switched on, by default once the work is drafted (hide the entry to take the file down).
• Plugin tokens. For each token you create in Settings: the name you give it, its first 8 characters, a SHA-256 hash of it (never the token itself, which Crux shows you once), when you created it, when it was last used, and when you revoked it.
• Batches. Crux gathers the work from one repo, and notes, into a batch before it writes about them. For each batch: its repo, whether it is still gathering work, being written, drafted, failed or skipped (with a short code for why), when it was due and when writing began, the kind of work Crux judged it to be, the three variants it wrote, the draft saved from them, the Friday recap a batch was folded into and, for a Friday recap, the date it was gathered for.
• Your automatic drafts settings. Whether automatic drafts are on, and which of pushes, merged pull requests and published releases start one.
• Your setup progress. When your first-run setup started, when each of its steps was first done, when you finished or skipped it, and when Crux last read your repo on GitHub to write your first draft.
• Analysis. The Account DNA analysis computed from your posts, including your Learnings (which kinds of post, and whether posts from Crux drafts, do better or worse than usual for you), and your voice rules: the phrases you ban or allow in drafts.
• Drafts. The text of each draft and its thread split, the angle and notes you gave, the batch, opening or topic it started from, its status, and, for drafts an AI model wrote, what you asked for and the variants it returned. For a draft written from your work, also the kind of work it is about and when you chose Post on 𝕏X, and once Crux finds it on 𝕏X, the id of the post you published.
• Your posted drafts’ numbers. For each post Crux finds from one of its drafts, its likes, reposts, replies, quotes, bookmarks, impressions, profile clicks and link clicks at 1 hour, 24 hours and 7 days after you posted it, as 𝕏X returns them, when each is due and when each was read, and whether it was read on time, late or not at all because 𝕏X did not return the post.
• Your reply feed, if you use it. The topics (up to 3) and 𝕏X accounts (up to 20) you watch, the language you picked, and how many times you pressed Refresh today. For each recent post a Refresh found worth replying to: its id, its text cut to 600 characters, its author’s 𝕏X id, handle and name, when it was posted, its like, repost, reply and quote counts, its rank, when Crux read it, and when you replied to it from Crux. These are other people’s posts, so, like Radar’s samples, they are not part of your data download. Crux never sends a reply: you post it yourself on 𝕏X.
• From Radar, Today and the Queue. Crux retired these three in October 2026: their pages are gone and the jobs that filled Radar and Today no longer run. What they stored before then stays for the periods in section 8. From the Queue: a copy of each queued post, its slot and time zone, whether you copied it to 𝕏X, marked it posted or missed it, the id of the 𝕏X post it was matched to, and your Queue preferences (time zone, weekly target, quiet days). From Radar: the topics you tracked and their keywords; hourly counts, read from 𝕏X, of the public posts that matched them; momentum readings; and small samples of other people’s public posts that matched a topic: the post id, its text cut to 500 characters, the author’s numeric 𝕏X id, when it was posted, and its like, repost, reply and quote counts. From Today: the openings it scored from those counts and your DNA, and what you did with them (skip, save or write). The samples were used only to measure how crowded a topic was: they are never shown, never sent to an AI model, and never part of your data download.
• Billing, once it is open. When your free trial started and ends; the ids Stripe gives your customer record, your subscription and its events; and the subscription’s status, renewal date and whether it is set to cancel. Your card, the email and the address you give at checkout go to Stripe, not to Crux.
• Operation. A record of each 𝕏X API request made for your account (which endpoint, how many items, and its estimated cost), used to stay within spending limits; a record of each AI model request (the provider’s host, the model, what it was for, whether it worked, token counts and timing, never the text); the history of background job runs; for each signed-in session, when it started and was last used and your browser’s user-agent string; and a short history of sign-outs, 𝕏X disconnections, withdrawn access and account deletion (the event, your numeric 𝕏X user id and when, never an IP address or session id).

The free tools

Most of the free tools run entirely in your browser and send nothing to Crux. Three ask Crux’s server, with no account or sign-in: the repo ideas tool and the shipping streak card send the GitHub repo or username you enter, which the server looks up through GitHub’s public API; the 𝕏X card validator sends the page address you enter, which the server fetches, only over https, only from a public address and only its first 1 MB, and answers with the tags it found, not the page.

The server keeps each answer in memory for 6 hours (repo ideas), an hour (shipping streak) or 10 minutes (card validator), so a repeat lookup is not asked again. To limit lookups, it counts those from your network for an hour by a keyed one-way hash of its address, also only in memory; your IP address itself is not kept. GitHub, and the site whose page you check, receive the request from Crux’s server, not from you. Nothing from these tools is written to a database or linked to a Crux account.

3. Access requests from before sign-up opened

Sign-up is open: anyone can sign in with 𝕏X. Before it opened, access was by request, through a form that is no longer on this site. For each request sent with it, we store:

• Your email address, trimmed and lower-cased.
• Your 𝕏X handle, only if you enter one.
• Which page’s form you used, and when.
• A keyed one-way hash of your IP address, used only to limit repeated requests from one network. Your IP address itself is never stored. The hash is cleared from requests more than a day old.
• A coarse browser and system label, such as “Safari · iOS”, used to spot automated sign-ups. The full user-agent string is not kept.
• Whether it is approved, since when, and which admin approved it.
• The numeric 𝕏X user id of the account that first signs in through an approved request. 𝕏X never reassigns this id, so from then on only that account can use the approval, even if the handle later belongs to someone else.

We use the list to decide who can use Crux and to contact you about access. An approved request lets the 𝕏X account whose handle it names sign in to Crux. The list is not shared or sold, and the form sets no cookie and loads no third-party script. Asking twice changes nothing, and the form shows the same message either way, so it does not reveal whether an address is already listed.

A request stays on the list until you ask for it to be removed. An approved request is kept for as long as it is approved, because it is what lets you sign in. Any other request is deleted 12 months after you sent it, and one whose approval is withdrawn later than that is deleted at the next daily clean-up. Deleting your Crux account also deletes the request you signed in through, with its email and its approval; to use Crux again, you would ask for access again. Crux has no contact mailbox yet, so to be removed, send a direct message to @marouanegazouzi on 𝕏 from the handle you entered or with the email address you used. An in-app control for this is planned but does not exist yet.

4. What we never collect

Some data is deliberately out of scope, and the application is built so that it cannot reach it.

• Direct messages, in either direction.
• Private or protected accounts you do not own.
• Your 𝕏X password — the connection uses OAuth, and we never see it.
• Permission to like or follow, or to read or send direct messages — Crux never requests those 𝕏X scopes.
• Your code. The Crux GitHub App never fetches a file or a diff from your repos, and asks GitHub for no permission to change anything in them.
• Your GitHub password, or a lasting GitHub token for your account: the one-time check that an installation is yours uses a token that Crux discards without storing it.

5. How we use it

Your data is used to:

• sign you in and keep you signed in;
• analyse your own posts: which hooks, formats, topics and posting times do better or worse than usual for you;
• write drafts in your voice from the work the GitHub repos you watch send Crux and the notes your coding agent sends;
• make template videos when you ask, from the titles and numbers in that work, in code, with no AI model;
• find the posts you publish from Crux drafts on your 𝕏X timeline, read their numbers at 1 h, 24 h and 7 d after you post them, and learn which kinds of post work for you;
• show the visibility labels 𝕏X reported for your posts and your account, month by month, if you upload 𝕏X’s reports;
• write drafts when you ask, and check every draft against your voice rules;
• keep what Radar, Today and the Queue stored until it is due for deletion, including matching queued posts to what you later publish;
• keep 𝕏X API and AI spending within limits, and keep Crux secure.

Your data is not pooled with other accounts’ data, and Crux does not train any model on it.

6. AI models

Crux uses an AI model for two things: writing drafts about the work you ship and writing drafts when you ask. Everything else, including the analysis of your posts and every score, is computed in code.

These requests go to OpenRouter (openrouter.ai), which passes each one to the company that hosts the model. The Drafts page names the model in use. What a request contains:

• A draft from your work: the voice profile from your DNA, the findings it may rely on, up to 5 of your own public posts as style examples, a short list of what 𝕏X’s ranking code rewards and penalises, and the batch’s work: each commit message, pull request and release title and text, with its repo’s name, and your agent’s notes. That includes text from private repos you watch.
• A draft you ask for: the same voice profile, findings and example posts, and the topic, angle and notes you gave.

Other people’s posts are never sent to a model. Crux asks OpenRouter to send its requests only to providers that do not collect the data they receive.

7. Legal bases

Where the GDPR applies, we rely on performance of a contract for what you signed in to use: drafts from your work and on request, the GitHub connection and the plugin, finding your posted drafts and reading their numbers, and the analysis, including sending a request to an AI model when a feature you use needs one. We rely on legitimate interests for security, abuse prevention, keeping 𝕏X API and AI spending within limits, and for keeping what the retired Radar, Today and Queue stored until it is due for deletion, including the short samples of public posts Radar kept to measure how crowded a topic was. We keep an access request because you sent it to ask for access, and you can withdraw it at any time by asking for removal. Where we ever rely on consent, you can withdraw it at any time.

8. How long we keep it

• Your 𝕏 account details, posts, Account DNA and Learnings, voice rules, automatic drafts settings, your setup progress, the topics and accounts your reply feed watches, the Radar topics you tracked, your Queue preferences and your follower count history: Until you delete your account in Settings, or ask us to delete them.
• Your 𝕏 profile picture, to show it in Crux: Until you delete your account. Crux replaces its copy when 𝕏 shows a new picture, checking at most once a day.
• 𝕏 visibility reports you upload: Until you delete your account in Settings, or ask us to delete them. Uploading a month again replaces that month’s report.
• Your drafts: Until you discard and then delete them, or delete your account.
• Queued posts, including the ones you posted or that were missed: Until you delete your account.
• Posts you removed from the queue: 90 days after you removed them.
• AI draft requests: what you asked for and the variants the model returned: 30 days. Older requests are deleted the next time you ask for drafts, and all of them with your account.
• Today’s openings: 90 days, and a saved opening at least 7 days after you saved it.
• What you do with an opening (skip, save or write): 365 days.
• Radar’s samples of other people’s public posts: 7 days.
• Recent posts from other people that your reply feed found: 7 days after a Refresh read them. A post you replied to from Crux keeps only its ID and when you replied, so it stays hidden from your feed, until 30 days after you replied.
• Radar’s hourly counts and momentum readings: 35 days, except each topic’s latest reading, which stays while the topic does.
• Radar topics you dismiss: 35 days after you dismiss them, with everything Radar stored for them.
• The daily readings of your posts’ numbers from the metrics refresh: 180 days, then only the latest reading of each post, until you delete your account.
• Your GitHub connection: the Crux GitHub App installations you linked, your GitHub login, and the repos Crux can see there with the ones you watch, private repo names included: Until you disconnect GitHub in Settings or delete your account. Uninstalling the app on GitHub removes them too.
• The GitHub account name an installation of the Crux GitHub App is on (yours, or your organisation’s): Until the app is uninstalled on GitHub, or no Crux account links that installation any more.
• Plugin tokens for your coding agent: a hash of each token (never the token itself), its name, its first characters and when it was last used: Until you delete your account. A token you revoke stops working at once; its record stays until then.
• Commits, merged pull requests and releases Crux reads from the GitHub repos you watch, and the notes your coding agent sends: 180 days after Crux receives them, or until you delete your account. The copy kept with a draft written from them, so its checks can read them, goes 180 days after that draft was written; the draft itself stays.
• Batches of that work, with the three variants Crux wrote for each: 180 days after the batch last changed, once the work it was written from is gone, or until you delete your account. The draft saved from a batch stays until you delete it.
• Your public changelog pages: which repos you switched on, and each entry’s title and date. Its posted text and 𝕏 link are read from your posts, so they go with them: Until you delete the entry or your account. Switching a changelog off takes its page down and keeps its entries for when you switch it back on.
• Screenshots and videos your coding agent attaches to your work, with their file name, size, type and which batch they belong to: 180 days after they were uploaded, or until you delete your account. A file uploaded but never attached is deleted after a day. A file you publish on your public changelog stays while it is published.
• Template videos you make from a batch: the titles and numbers they show, your brand colour, and the video files and poster: 180 days after you made them, or until you delete your account, which removes the files too.
• Your posted drafts’ numbers at 1 hour, 24 hours and 7 days after posting: 180 days after each reading was due, or until you delete your account.
• Posts you scheduled on Autopilot, with what 𝕏 answered when it posted or refused them: 180 days after each one posted, failed or was canceled, or until you delete your account. One still waiting stays until it posts or you cancel it.
• The ids of GitHub webhook deliveries, so one sent twice is not stored twice: 14 days.
• The record of each 𝕏 API request (which endpoint, how many items, the estimated cost): Kept as the record of what 𝕏 billed. When you delete your account, the link to your account is removed and the rest is kept.
• The record of each AI model request (never its text): 90 days.
• The history of background job runs: 180 days, always keeping the last 50 runs of each job.
• OAuth tokens: Until you choose Disconnect 𝕏 in Settings, until 𝕏 refuses to renew them (for example after you revoke Crux on 𝕏), when they are wiped, or until you ask us to delete them.
• Sign-in sessions: Until you sign out, after 14 days without use, or at the latest 30 days after you sign in.
• Sign-in history: Deleted with your account, except one record that the account was deleted (the event, its numeric 𝕏 user id and when), kept so the deletion itself stays on record.
• Your trial dates and the Stripe ids and status of your subscription: Until you delete your account, which also cancels a live subscription at Stripe. Stripe keeps its own payment records under its own terms.
• Requests for access: Until you ask for removal. An approved request is kept for as long as it is approved; any other request is deleted 12 months after it was sent, or at the next daily clean-up once its approval is withdrawn, whichever comes later. The IP hash is cleared after a day.
• Page-view statistics (Umami): On our Umami server until we delete them. They hold no IP address, cookie, name, handle or account id.

9. Who else receives your data

• 𝕏X, which Crux reads your posts, profile and metrics from, including the ids of the posts it looks up to read their numbers and, when you press Refresh in your reply feed, the topics and accounts it searches for, under 𝕏X’s own terms.
• GitHub, if you connect it, which sends Crux the work from the repos you watch, and which Crux asks for an installation’s details and the list of repos it covers; once, while you connect, for your GitHub login, your installations and the repos you can read in them; before Crux reads a repo to write your first draft, its current name and whether it is private; and, for each message from a private repo and before Crux reads one to write your first draft, whether each GitHub login linked to it can still read that repo, under GitHub’s own terms. Crux sends GitHub nothing from your 𝕏X account.
• OpenRouter, and the company hosting the AI model it passes a request to, for the requests in section 6.
• Stripe, once billing is open, which takes payments, holds your card and keeps its own records of your payments and invoices, under Stripe’s own privacy policy.
• Telegram, if we turn on notifications, which delivers short messages to our own chat: that a new account signed up, that an account connected GitHub or got its first draft, and that a payment, a cancellation, a refund or a dispute happened, with the plan and amount. Each names the account by its 𝕏X handle; none holds an email, a post, a draft, your work or a payment detail. Alerts about the service itself go there too, and name no one. Under Telegram’s own terms.
• The server provider that hosts the application, its database and our Umami statistics (section 12).
• Cloudflare, for the cruxpost.com domain’s DNS.

We do not sell or rent data to anyone, for any purpose.

10. Your rights

Once signed in, you can download a copy of your data as a JSON file and delete your account from Settings. You can also access, correct or delete your data by sending a direct message to @marouanegazouzi on 𝕏 (Crux has no contact mailbox yet), and we will answer within thirty days. If you are in the EU or UK and you are not satisfied with our answer, you may complain to your local data protection authority.

You can disconnect GitHub in Settings, and uninstall the Crux GitHub App on GitHub (Settings, Applications, Installed GitHub Apps) to stop it receiving anything from your repos. Revoking a plugin token in Settings stops it working at once.

You can revoke Crux’s access at any time from 𝕏X: Settings, Security and account access, Apps and sessions, Connected apps.

11. Security

Data is encrypted in transit, OAuth tokens are encrypted at rest, plugin tokens are stored only as hashes, GitHub’s messages to Crux are checked against a shared secret before they are read, and access to production is limited to the people who need it. No system is perfectly secure; if a breach affects you we will tell you what happened and what we did about it.

12. Cookies and statistics

The application sets a session cookie so you stay signed in, short-lived cookies (ten minutes) that protect the 𝕏X sign-in flow and the GitHub connection, and, if you choose Light or Dark instead of following your system’s theme, a cookie that remembers that choice for a year. None of them track you. The marketing site sets no analytics, advertising or third-party tracking cookies, which is why you are not reading a consent banner right now.

The public site, the sign-in page and the public changelogs count visits with Umami, an open-source analytics tool we host ourselves, not a third-party analytics service. Its script is served from cruxpost.com, it sets no cookie and does not follow you across other sites, and it never runs inside the application. For each visit it records the page’s address without its query string, the site you came from (its address only), your browser, operating system, device type, screen size and language, and the country, region and city your IP address points to. Umami does not store your IP address or your browser’s full identifier: it uses them only to make an anonymous visitor id, a one-way hash keyed with a secret only our Umami server holds and the current month. It also counts three moments: clicks on Start your trial, Continue with 𝕏X, and that a new account was created, never with your handle, your email or an account id. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded.

13. Changes and contact

Material changes are posted here with a new date before they take effect. Questions go to @marouanegazouzi on 𝕏.