Privacy policy

1. What we collect

• Your e-mail address. You sign in with a one-time code sent to it. We also use it for service mail: sign-in codes, plan reminders and payment notices.
• Your X connection. The cookies and the proxy you add for each X account, and the account's public username. Cookies and proxies are stored encrypted.
• Your work in the service. The settings, prompts and templates you save, the run history and its logs, the tweets your runs collect, the files you upload for analysis and the reports you get.
• Plan and payment details. Your plan and its end date, and a payment order (amount, status, the provider's invoice number). We never receive card numbers: payments are made in crypto through NOWPayments.
• Technical data. Your IP address and browser type when you sign in. We use them to keep accounts safe and to stop abuse.

2. Your X cookies

A cookie proves to X that a sign-in already happened, so you never give us your password. This is what we do with it:

• One purpose. We use the cookies only to work from your account when you start a run. We use them for nothing else.
• Encrypted. They are stored encrypted. They are decrypted only inside the service, at the moment it runs your account.
• Not visible to anyone. No screen of the console, including the administrator's, shows them. They are kept out of logs and out of e-mail.
• Not read by people. No one at 0xweb opens, copies or uses your cookies for anything other than running your account.
• Not shared. We do not give them to anyone. They reach X, because that is how the session works, through the proxy you provide: the provider of that proxy can see the traffic of the session.
• You can end it at once. Log the session out in your X settings and the cookies stop working immediately. Delete the X account in the console and its cookies, proxy and saved session are wiped right away.

3. Who else receives data

We do not sell your data and we do not use it for advertising. We do not run analytics or advertising trackers. Some providers have to receive data to do their part of the job:

• An AI model provider (OpenAI, Anthropic or OpenRouter, depending on how the service is set up). It receives the text of the tweets being answered or analyzed and your prompt, and images only if that option is on. It is used only to write the replies and reports you ask for.
• Cloudflare. All traffic to the site and the console passes through it, and it runs the bot check on sign-in.
• Resend sends our e-mail, such as sign-in codes.
• NOWPayments processes payments.
• Backblaze stores our database backups. They are encrypted before they leave our server, and Backblaze cannot read them.
• The proxy provider you choose and X itself, as described above.

We disclose data to an authority only if the law requires it.

4. Cookies on our website

The console sets a few cookies that it needs to work: one keeps you signed in and one protects forms from forged requests. Cloudflare may set a cookie of its own for security. This landing site sets no cookies, and there are no advertising or analytics cookies on either site.

5. How long we keep data

• Your account: as long as it exists.
• X cookies and proxies: until you delete the X account in the console or ask us to delete your account.
• Run logs: deleted automatically after one day.
• Collected tweets, reports and run history: until you delete the X account or ask us to delete them.
• A demo that is not followed by a plan: seven days after it ends we delete the X accounts, runs, logs and files. We keep your e-mail address and the X accounts you used, so the same person does not start a second free demo.
• Payment orders: about two weeks after payment. NOWPayments keeps its own records.
• Backups: database backups are kept for 14 days on our server and up to 60 days encrypted off site. Deleted data disappears from them as they expire.
• The sign-in security record (IP address, browser): as long as it is needed to protect accounts.

6. How we protect data

Our servers are not reachable directly from the internet: traffic comes in through Cloudflare, over HTTPS. You sign in with a code sent to your e-mail, and attempts are limited. Secrets are encrypted, backups are encrypted, and access to the systems is limited to the people who run 0xweb. No system is perfectly secure. If a breach that affects you happens, we will tell you by e-mail without delay.

7. Your choices

You can ask us for a copy of your data, to correct it or to delete it, including your whole account. Write to [email protected] or to @oxwebxyz on Telegram from the e-mail address of your account. We answer within 30 days, usually much sooner.

8. Age

0xweb is for people aged 18 and over. We do not knowingly collect data from children.

9. Changes

When this policy changes, we change the date above. If the change is material, we also tell you by e-mail. The rules of use are in the Terms of service.

10. Contact

Questions about your data: [email protected] or @oxwebxyz on Telegram.