Privacy Policy

1. Who we are

Torbit is operated by Aayush Giri ("we", "us"). This policy explains what data we collect when you use Torbit, how we use it, and your rights. Questions? Email us at hello@torbit.xyz.

2. Data we collect

• Account data — name, email address, and profile photo from your sign-in (Google, X, or email/password).
• X / Twitter credentials — API key, API secret, access token, and access token secret you paste in when connecting an account. These are encrypted at rest (AES-256-GCM) and never logged or shared.
• Content you create — draft tweets, approved posts, voice profiles, watchlist handles, and pipeline settings.
• Billing data — handled entirely by Stripe. We store only your Stripe customer ID and subscription status; we never see or store your card number.
• Usage data — request logs (timestamp, path, HTTP status, request ID) retained in Cloudflare Workers Logs for up to 7 days.

3. How we use your data

• Operate the pipeline — harvest signals, generate drafts, post on your behalf.
• Bill you via Stripe and send receipts.
• Debug errors and improve reliability.
• Contact you about your account (no marketing without explicit consent).

4. Data sharing

We do not sell your data. We share it only with:

• Cloudflare — compute and database hosting (D1 SQLite, Workers KV, Durable Objects).
• Stripe — payment processing.
• Anthropic (Claude API) — AI inference for draft generation. Prompts include your voice profile and niche context; they do not include your X credentials.
• X / Twitter API — posting on your behalf using the credentials you provided.

5. Data retention

Your data is retained as long as your account is active. If you cancel, your drafts, voice profile, and X credentials are retained for 30 days, then purged. Request earlier deletion by emailing us.

6. Security

X API credentials are encrypted before storage using AES-256-GCM with a key stored separately from the database. All traffic is served over HTTPS. We perform no logging of credential values.

7. Your rights

You may request access to, correction of, or deletion of your personal data at any time by emailing hello@torbit.xyz. We will respond within 30 days.

8. Cookies

We use only first-party session cookies set by our own authentication system. We do not use third-party advertising or tracking cookies.

9. Changes

We may update this policy. Material changes will be communicated by email or an in-dashboard notice. Continued use after the effective date constitutes acceptance.