Legal
Privacy Policy
This is prototype copy. It describes the data flows this prototype is designed around, but it has not been reviewed by a privacy professional and is not legal advice. Have it reviewed before collecting real user data.
Short version: Crux reads public posts, stores your drafts, and derives a voice model that belongs to you alone. It does not read your direct messages, does not train a shared model, and does not sell anything.
1. What we collect
We collect three kinds of data, and no more than the product needs to work.
- Account data. Your email address, your connected X handle, and your subscription status.
- Public post data. Your own published posts, and public posts from the accounts and topics you ask Crux to watch. This is what the scores are computed from.
- Product data. The drafts you create, the openings you skip, your posting windows, and the voice model derived from your published posts.
2. What we never collect
Some data is deliberately out of scope, and the application is built so that it cannot reach it.
- Direct messages, in either direction.
- Private or protected accounts you do not own.
- Your X password — the connection uses OAuth, and we never see it.
- Payment card numbers, which go directly to our payment processor.
3. How we use it
Account data runs your subscription. Public post data is scored, then aged out. Product data powers Today, Drafts, Queue, Performance and your DNA, and nothing else.
Your drafts never feed the voice model — only published posts do. Your data is never pooled with another customer’s, and we do not use it to train a general-purpose model.
4. Legal bases
Where the GDPR applies, we rely on performance of a contract for everything needed to deliver the subscription you bought, and on legitimate interests for security, fraud prevention and aggregate service metrics that do not identify you. Where we ever rely on consent, you can withdraw it at any time.
5. How long we keep it
- Raw public posts pulled for scoring: 30 days, then deleted.
- Scores and aggregate metrics: for as long as your account is open.
- Drafts and voice model: for as long as your account is open, then 30 days after closure.
- Billing records: seven years, because tax rules require it.
6. Who else touches your data
We use a small number of processors, each bound by contract and none permitted to use your data for their own purposes: a cloud host, a payment processor, a transactional email provider, and a model provider that generates draft text.
Draft generation sends the opening and your voice rules to the model provider under a zero-retention arrangement. We do not sell or rent data to anyone, for any purpose.
7. Your rights
You can access, correct, export or delete your data. Export is a single JSON file available from Settings at any time, and deletion from the same screen is immediate and permanent.
You can also write to hello@cruxpost.com, and we will answer within thirty days. If you are in the EU or UK and you are not satisfied with our answer, you may complain to your local data protection authority.
8. Security
Data is encrypted in transit and at rest, access to production is limited to the people who need it and logged, and the X connection can be revoked by you at any time from either side. No system is perfectly secure; if a breach affects you we will tell you what happened and what we did about it.
9. Cookies
The application sets one session cookie so you stay signed in. The marketing site sets no analytics, advertising or third-party tracking cookies, which is why you are not reading a consent banner right now.
10. Changes and contact
Material changes are posted here with a new date and emailed to account holders before they take effect. Questions go to hello@cruxpost.com.