Skip to content
X Brain

Privacy Policy

Last updated: October 2026

1. Who We Are

X Brain (xbrain.live) is the controller of the personal data described here. For any privacy question or request, email xbrainapp@outlook.com.

2. What We Collect

  • Account information - your email address and name from your Google account, payment status and Stripe customer and payment IDs (never card details), and usage counters.
  • Uploaded data - the likes and bookmarks files from your X archive. Your browser normally removes everything else (media, direct messages, your own posts) before upload. Either way the server reads only the likes and bookmarks files, and the ZIP itself is not stored.
  • Processed data - embeddings, categories, tags and AI-generated takeaways created from those tweets.
  • API keys - AI provider keys you choose to add, encrypted at rest.
  • MCP tokens - if you connect X Brain to Claude, we store only a hash of each token. Anyone holding a token can search your library until you revoke it in Settings.
  • Email list - your address, once you confirm it, if you sign up for our guide or mailing list. Until you confirm, we only send the confirmation email and keep nothing.
  • Usage data - page views, feature usage and error reports, described under Third-Party Services and Cookies.
  • IP address - every request carries one. We use it to work out your country for the cookie-consent cookie (xb_geo), and for rate limiting, where it is hashed before it is stored. Our hosting provider (Vercel) and error-tracking provider (Sentry) also receive it as part of handling the request.

3. How We Use Your Data, and Why

  • To provide the service you signed up for: process, classify and search your tweets, and send transactional email about processing and your account (performance of our contract with you).
  • To keep the service secure and working: error tracking, abuse prevention and rate limiting (our legitimate interest).
  • To measure and improve the site with analytics cookies, and to send marketing email you signed up for (your consent, which you can withdraw at any time).

4. Third-Party Services

These processors handle data on our behalf:

  • Supabase - database and authentication.
  • Vercel - hosting, plus cookieless Vercel Analytics and Speed Insights.
  • Stripe - payment processing. We never see or store your card details. If analytics cookies are allowed, your DataFast visitor and session IDs are attached to the checkout so a purchase can be matched to the visit.
  • AI providers (Anthropic, OpenAI, Google) - called to process your tweets, with your own API keys if you added any and otherwise with X Brain's own. Tweet text, and the text of your searches (including the demo search on the homepage), is sent to whichever provider is used.
  • Sentry - error tracking. On signed-in pages it records a session replay, with all text masked and media blocked, only when an error occurs, so we can see what went wrong.
  • Resend - sends our email and stores your address if you join the mailing list.
  • Google Analytics and DataFast - page-view and usage measurement. When you are signed in, DataFast also receives your internal account ID (not your email or name), so visits before and after sign-in count as one visitor. This only happens if analytics cookies are allowed.
  • Advertising platforms (X Ads, and Meta or Google Ads when enabled) - measure which adverts lead to visits, sign-ups and purchases, and build retargeting audiences.

Several of these providers are based in the United States, so your data may be processed outside your country. Where that applies, they rely on standard contractual clauses or an equivalent transfer mechanism.

5. Sharing and Public Pages

  • We do not sell your data. Advertising platforms are told when a visit from one of their adverts leads to a sign-up or purchase, but never your email address, your archive or your tweets.
  • If you share your brain card, the page at its link is public and shows your display name and category statistics, never your tweets or email address.

6. Storage, Security and Retention

  • Data is stored in Supabase with row-level security, and all connections use HTTPS/TLS.
  • API keys are encrypted at rest with AES-256-GCM.
  • Your tweets and processed data are kept until you delete them or ask us to delete your account.
  • Payment records are kept as long as tax and accounting law requires.
  • Error reports are kept for the retention period of our Sentry plan, then deleted automatically.

7. Your Rights

  • Export - download your tweets and processed data at any time from the dashboard.
  • Delete your data - Settings, Delete All Data removes your tweets, uploads, API keys, MCP tokens, daily search counts and share link. Your account record (email, name, payment status) and AI usage counters remain, so a later upload still recognises your purchase.
  • Delete your account - email us and we will delete your account record too.
  • Access, correction, objection - email us to get a copy of the data we hold, correct it, or object to its use.
  • Unsubscribe - reply "unsubscribe" to any marketing email.
  • Complain - if you are in the EEA or UK, you can also complain to your local data protection authority.

X Brain is not intended for anyone under 16.

8. Cookies and Local Storage

  • Essential - Supabase sign-in cookies (sb-*), a short-lived signed payment-status cookie (x-brain-paid, 5 minutes), a country cookie used to decide whether to ask for cookie consent (xb_geo, 24 hours), a cookie that remembers which page to return to after you sign in (xb_next, 10 minutes), and your cookie choice and theme preference in local storage.
  • Analytics - Google Analytics (_ga*) and DataFast cookies that measure how the site is used.
  • Advertising - cookies set by the advertising platforms listed above to measure adverts and build retargeting audiences.

Visitors in the EEA, the UK and Switzerland are asked first, and analytics and advertising cookies load only if they accept. Everywhere else they load by default, unless your browser sends a Global Privacy Control signal, which we honour as a refusal. Anyone can change their choice at any time: .

California residents - advertising cookies used for retargeting may count as "sharing" personal information under the CCPA. You can opt out through Cookie settings by rejecting cookies, and Global Privacy Control is honoured as an opt-out.

9. Changes

We may update this policy from time to time. Significant changes will be communicated by email.

10. Contact

Questions about this policy? Email us at xbrainapp@outlook.com