Privacy policy

1. Who we are

This policy covers the Socialnib browser extension, the Socialnib API at api.socialnib.com, and this website. “We”, “us” and “Socialnib” mean the maintainers of Socialnib, who are the data controller for the processing described here. Reach us at privacy@socialnib.com.

2. What we send to our servers when you draft a reply

Drafting happens on our servers, not in your browser. When you trigger a draft — by clicking into an empty reply box, pressing the keyboard shortcut, or clicking the Socialnib icon — the extension sends the following to our API:

• The post you are replying to, including its visible text and the author's handle.
• Surrounding conversation. The chain of posts leading to it and some of the replies already on it, so the draft fits the conversation. You can reduce or disable this under Advanced.
• The post's image, if it has one and you have left that setting on. The extension sends the image URL and our server fetches it.
• Your X handle, as shown on the page, so the reply is written from your point of view.
• Your voice settings. Your default tone, the description of your stack, what you're optimising for, and your house rules.

We use this only to generate the reply and return it to you. We do not store the post content or the generated replies after the request completes, and we do not use them to train any model. Our server logs record operational facts about the request — a request id, timing, how many replies came back, how many tokens were used, and the model's classification of the post type — not the text itself.

3. What stays in your browser

The following is written to your browser's own extension storage on your device. We never receive it, and it is not synced to us:

• Generation history and favourites, so you can search and reuse replies that worked. Capped at the most recent 100 generations.
• Your preferences — default tone and shape, whether pre-drafting is on, how much thread context to include, theme.
• Your voice settings, which are also sent with each draft request as described above. They are held locally because they can exceed the browser's 8 KB per-item sync limit.
• Your session tokens. Held by the extension's background worker, which is deliberately the only part of the extension that can read them — nothing running on an X page can reach them.
• A per-post draft cache, so reopening the reply table for a post doesn't re-run a generation you already spent.

You can clear history, favourites and settings from the extension's settings page at any time. Uninstalling the extension removes all of it.

4. What we store about your account

You sign in with Google. We use Google only to establish who you are — we do not request access to your Gmail, Drive, contacts or calendar, and we cannot act on your Google account. From that sign-in we store:

• Your Google account identifier (the stable sub value), which is what your account is keyed on;
• Your email address, name and profile picture URL, so the extension can show you which account you're signed in as;
• Your plan and account status, which determine your allowance;
• Sign-in timestamps — when the account was created and when it was last seen.

We also store, for each signed-in account:

• Session records. Refresh tokens are stored only as a hash, never in a form that could be replayed as a login, together with an expiry and a coarse browser description.
• Usage counters. A running total of the generations your account has ever run, a total for the current calendar month, plus one row per day recording generations, replies returned, token counts, and how many requests errored. The running total is how the 100-generation free allowance is enforced; the monthly total is how the paid allowance is. These contain counts only — no post text and no replies.

5. This website

Most of this site is static marketing content with no sign-in and nothing stored on your device. Our hosting provider processes standard request data such as IP address, user agent and requested URL in order to serve the site and protect it from abuse. The site loads web fonts from Google Fonts, which involves a request to Google's font CDN.

We set no advertising, analytics or cross-site tracking cookies anywhere on this site. The account page sets two cookies, and only once you sign in:

• sn_at — a short-lived access token, expiring within the hour.
• sn_rt — the token that keeps you signed in, expiring after 60 days or when you sign out.

Both are strictly necessary to provide a page you asked to be signed in to, so no consent banner is required for them and none is shown. Both are HttpOnly, which means no script running on the page can read them, and SameSite=Lax, which means your browser will not send them to us when a third-party site makes a request on your behalf. They contain your session and nothing else — no name, no email, no tracking identifier — and we do not use them to build a profile of what you read here. Signing out deletes both and revokes the session on our servers. There is one further cookie during sign-in itself, which holds a random anti-forgery value for ten minutes and is deleted the moment the sign-in finishes.

6. Who else processes your data

We use a small number of service providers who process data on our instructions:

• Cloudflare — hosts this website, our API, our database and our short-lived sign-in state. Privacy policy.
• Google — provides the sign-in, and the fonts on this site. Privacy policy.
• AI model providers — receive the post and context described in section 2 in order to generate the reply, and return it to us. We select the provider and can change it as better models become available. Write to privacy@socialnib.com for the current list.

We do not sell personal information, and we do not share it for cross-context behavioural advertising as those terms are used in the CCPA and CPRA.

7. How long we keep things

• Post content and generated replies — not retained. They exist only for the duration of the request that produced them.
• Account details — for as long as your account exists, then deleted on request.
• Session records — until the refresh token expires, with expired and revoked records pruned automatically each night.
• Usage counters — retained while your account exists, as the record of your allowance. Deleted with your account.
• Operational logs — retained for a short period by our hosting provider for debugging and abuse prevention.
• Email correspondence — for as long as needed to resolve your question.

8. Legal bases for processing

Where the UK GDPR or EU GDPR applies, we rely on performance of a contract to operate your account, authenticate you, generate the replies you ask for, and enforce your allowance; and legitimate interests to keep the service secure, prevent abuse, and respond to your enquiries. Where you choose to include optional context — a post's image, or the free-text description of your stack — you are choosing what to send us.

9. International transfers

Our infrastructure runs on a global edge network, and our providers may process data outside your country, including in the United States. Where required, transfers rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard offered by the provider concerned.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. Some of these you can exercise yourself: sign out to end a session, clear history and settings from the settings page, and uninstall to remove everything held locally.

For anything held on our servers — your account, your session records or your usage counters — email privacy@socialnib.com from the address you signed in with. We will delete your account and everything attached to it on request, and will respond within the period required by applicable law. You also have the right to complain to your local data protection authority.

11. Children

Socialnib is not directed at children under 13 and we do not knowingly collect their personal information. X's own terms require users to be at least 13.

12. Security

Requests to our API travel over HTTPS and require a signed, short-lived access token. Refresh tokens are stored hashed and rotate on every use; reuse of an old token revokes the whole session family, on the assumption it was stolen. The extension holds no AI provider credentials at all, and your session token is kept in the background worker rather than anywhere a page script could read it. No method of transmission or storage is completely secure, but those are the deliberate choices behind this design.

13. Changes to this policy

If we change this policy we will update the date at the top of this page. Material changes — a new category of data, a new purpose, or a change to who processes it — will be described plainly rather than folded silently into the text.

14. Contact

Privacy questions and deletion requests: privacy@socialnib.com. Everything else: support@socialnib.com.