Privacy Policy
Last updated November 8, 2026.
What we store
- Your X profile: your X user id, @username, display name and profile photo link.
- Your X access tokens (access and refresh token), encrypted with AES-256-GCM before they are saved. They are used only to read your followers and follows and to send the follows and unfollows you click.
- Verified follower ids: one snapshot a day of the ids of your verified followers, used to find who unfollowed you. Accounts without a verified badge are never stored.
- Profile display data for the accounts in your two lists: X id, @username, display name, photo link and badge type.
- Counts: the daily number of new verified followers and verified unfollows (7-day history), and your daily action count.
- Billing: if you subscribe, your Stripe customer and subscription ids, status and the email you gave Stripe.
- Short-lived security records: sessions and rate-limit entries.
What we do not store
No posts, no direct messages, no passwords, no card details (Stripe handles payment), and nothing about accounts without a verified badge. We do not sell data, show ads or use third-party analytics or tracking scripts.
Retention
- Follower snapshots are kept for 8 days, then deleted automatically.
- Lists are rebuilt at every daily check; accounts leave them when you act on them or when they no longer apply.
- Everything else is kept while your account exists.
Deletion
Settings → Delete account and data deletes your account, tokens, snapshots, lists and history immediately, and asks X to revoke Xfair's access. You can also revoke access at any time in your X settings (Connected apps); Xfair then stops checking.
Sharing
Your tokens are never shared with anyone and never leave our servers except to call the X API on your behalf. We only share what is needed with the services that run Xfair:
- X (the X API) for sign-in and your follower data (X Privacy Policy).
- Stripe for payments (Stripe Privacy Policy).
- Cloudflare hosts the app and the database.
Cookies
One sign-in cookie (30 days), one short-lived cookie during X sign-in (10 minutes) and a language cookie. No advertising cookies.
Contact
contato@saascron.com