Privacy Policy

This policy explains how GrowX handles your personal data when you use trygrowx.app and the GrowX Chrome extension. We aim to keep it short and concrete.

GrowX is a personal project run by an individual based in Dubai, United Arab Emirates, who is the controller of your data. There is no company behind it. You can reach us at contact@trygrowx.app.

1. The short version

You sign in with X. GrowX uses your X profile and your posts to learn your voice and draft in it.
GrowX has no advertising, no analytics tools and no tracking cookies.
Your data is processed by Cloudflare (hosting and storage), X, Microsoft Azure OpenAI (AI) and Dodo Payments (billing).
GrowX posts to X only what you approve, schedule or send with a button. It never sends DMs.
You can delete your account in Settings. Deletion removes your data right away.

2. What we collect

From X when you sign in

Your X user ID, handle, display name, profile picture link, bio and follower count, refreshed each time you sign in.
Your email address, if your X account has a confirmed one. Without one, GrowX stores a placeholder address and sends no email.
Access and refresh tokens that let GrowX act on your behalf. They are encrypted before they are stored.

The permissions GrowX asks X for are: read your profile and posts, read your confirmed email, stay connected (offline access), post for you, upload media and read your liked posts. You can withdraw access any time in your X settings.

What you give GrowX

Onboarding and settings: your niche, audience, accounts you admire, writing archetypes, interests, time zone, posting schedule and morning email time.
Your posts and metrics: your recent posts read from X when you join, posts and likes from an X data archive you upload (the file is opened in your browser, and only the posts and likes are sent to GrowX), and posts you scroll past on your own profile with the extension. Each comes with its public counts, such as likes and views.
Voice material: a style card built from your posts, memories and ideas you save, and Voice Drops. A Voice Drop is a short audio recording. GrowX sends the audio for transcription and stores the transcript. It does not store the recording.
Drafts and feedback: drafts, the version you picked, your edits, the drafts you skip and the reasons you give, and a log of actions such as approve and unapprove.
Images: images you generate, with their prompts and alt text. If you use face styles, you also upload 3 to 10 photos of yourself and confirm consent. GrowX keeps the originals and a prepared copy with metadata removed.
Billing: your plan and status, a Dodo Payments customer and subscription reference, checkout sessions and your credit balance and history. Your card details go to Dodo Payments only.

From the extension on x.com

The extension reads only what is on your screen as you scroll. It makes no background reads on X. Here is what it sends to GrowX:

Your own posts and their counts, from your profile and post pages.
Posts from your home timeline, saved as private reply suggestions for you. This covers the post text, the author's handle and name, the public counts, the time and the language.
Notifications you see on x.com/notifications: who liked, reposted, replied to, quoted, mentioned or followed you, with their handle, display name and, for replies, quotes and mentions, the text they wrote. GrowX shows these to you as signals and leads.
Which accounts you like, repost and reply to, as the handle, the kind of click, the post ID and the time, without the post text. GrowX uses this to learn the taste of the people you admire.
Posts you save to your library.
Only if you turn it on in settings: public posts you scroll past, to build a shared niche library (see section 5).

The extension skips protected accounts and never reads DMs.

Read from X by GrowX itself

Using your permission, GrowX reads from the X API your recent liked posts and the recent public posts of a few accounts you engage with, and it runs one search a day for public posts in your niche to suggest leads and replies. It also reads public counts on your own posts for analytics, if you switch that on.

Automatically

A session cookie, plus the IP address and browser details recorded with your session.
A usage record for each AI or X call: the feature, the model, the size and the cost.
Server logs and error traces kept by Cloudflare, which can include your account ID.

3. Why we use it

To run GrowX: sign you in, learn your voice, write drafts and images, schedule and publish what you approve, show analytics and leads.
To bill you and apply plan allowances.
To send your morning email about drafts waiting for review.
To keep GrowX safe and working: abuse limits, error fixing and cost control.
To meet legal duties.

Our legal grounds are your agreement to the Terms of Service, your consent where you switch something on, such as the shared library or face photos, and our legitimate interest in running a secure service.

GrowX makes no decisions about you that have legal effects. AI is used to write drafts for you to review.

4. Who processes your data

Processor	What it does	Data involved
Cloudflare	Hosting and the full back end: Workers, the D1 database, R2 file storage, KV, queues, scheduling and email delivery	Everything GrowX stores, including the morning email
X Corp.	Sign-in, reading your posts and likes, publishing what you approve	Your X profile, tokens, post text and media you publish
Microsoft Azure OpenAI	Drafts, replies, style cards, embeddings, alt text, images and Voice Drop transcription	The text, posts and prompts needed for each task, Voice Drop audio and, for face styles, your reference photos
Dodo Payments	Checkout, subscriptions, credit packs and the customer portal	Your email, plan and payment details, which go to Dodo directly

GrowX does not sell your data and does not share it for advertising. We share it with these providers only to run GrowX, and with authorities where the law requires it.

5. Shared library, leads and other people's data

Shared niche library. This is off by default. If you turn on "contribute", the extension sends public posts you scroll past, with the author's handle, public counts and the time, to a library shared with other GrowX users in your niche. A contributed post carries no trace of who contributed it. Because of that, it can stay in the library after you delete your account.
Public posts from X. Posts that GrowX reads from the X API are public. GrowX keeps a shared list that connects handles to X IDs, and shared pools of public posts used for suggestions.
Your private views. Reply suggestions, signals and leads from your own screen belong to your account only and go away when you delete it.

6. How long we keep it

We keep your data while your account is open. You can delete parts of it yourself: your imported posts and voice profile, memories, ideas, drafts, images and face photos.

When you delete your account:

your subscription is cancelled first;
your profile, posts, voice profile, drafts, memories, signals, leads, plan state and settings are deleted from the database;
your generated images and face photos are deleted from storage, and your schedule is cleared.

Some things remain after deletion: public posts you saved to or contributed to the shared library (they carry no link to you), billing records that GrowX keeps for accounting with your account link removed, records held by Dodo Payments and X under their own policies, and backups and logs held by Cloudflare until they expire under its schedules.

Sessions expire automatically. Posts published on X stay on X.

7. Your rights

You can ask us to:

give you a copy of the personal data we hold about you, in a common format;
correct data that is wrong (you can also edit your profile and settings in the app);
delete your data (the quickest way is Settings, then Danger zone, then Delete account);
limit or object to a use of your data;
stop a use that rests on your consent. You can switch off library contribution in settings, and you can delete your face photos in the Images section.

Email contact@trygrowx.app from your account email or write from your X handle. We reply within 30 days. Where data protection law applies to you, including the UAE Federal Decree-Law No. 45 of 2021 on personal data protection and, for people in the EEA and UK, the GDPR, you also have the right to complain to your local data protection authority.

8. Cookies and local storage

GrowX uses one first-party cookie, a session cookie that keeps you signed in. It is HTTP-only, set for GrowX only and used for no other purpose. Your browser also keeps small settings in local storage, such as your light or dark theme and which tips you have dismissed. The extension stores its connection token, settings and counters in the browser's extension storage on your device.

GrowX sets no advertising, analytics or cross-site tracking cookies, so there is no cookie banner.

9. Security

Tokens from X are encrypted at rest. Extension tokens are stored as one-way hashes. All traffic uses HTTPS, and each person's data is separated by account. We keep access to production data limited to the person who runs GrowX. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

10. International transfers

GrowX runs on Cloudflare's global network. Microsoft, X and Dodo Payments also process data in several countries, including outside the United Arab Emirates. By using GrowX, you accept that your data may be processed in those places. We rely on the contracts and safeguards of those providers for the transfer.

11. Children

GrowX is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you think a child has an account, write to contact@trygrowx.app and we will delete it.

12. Changes to this policy

We may update this policy. The date at the top shows the latest version. For a material change, we will tell you in the app or by email.

13. Contact

GrowX, Dubai, United Arab Emirates.

Email: contact@trygrowx.app