---
title: "Socialnib — Privacy policy"
description: "What Socialnib sends to its servers, what stays in your browser, what we store about your account, and how to delete it."
source: https://socialnib.com/legal/privacy-policy
updated: "August 15, 2026"
---

# Socialnib — Privacy policy

*Last updated: August 15, 2026*

Socialnib runs the AI model for you, so some of your data does reach our
servers. This document says exactly which parts, why, and what never leaves your
browser.

## The short version

- To write a reply, we send the post you're replying to and the conversation around it to our own API at `api.socialnib.com`, along with your voice settings.
- We do **not** keep those posts or the replies we wrote. We keep your account details and a count of how much you've used.
- Your generation history, favourites and settings stay in your browser. We never receive them.
- We don't train models on your content, don't sell personal information, and don't run advertising trackers.
- The extension never posts to X on your behalf.

## 1. Who we are

This policy covers the Socialnib browser extension, the Socialnib API at
`api.socialnib.com`, and this website. "We", "us" and "Socialnib" mean the
maintainers of Socialnib, who are the data controller for the processing
described here. Reach us at privacy@socialnib.com.

## 2. What we send to our servers when you draft a reply

Drafting happens on our servers, not in your browser. When you trigger a draft —
by clicking into an empty reply box, pressing the keyboard shortcut, or clicking
the Socialnib icon — the extension sends the following to our API:

- **The post you are replying to**, including its visible text and the author's handle.
- **Surrounding conversation.** The chain of posts leading to it and some of the replies already on it, so the draft fits the conversation. You can reduce or disable this under Advanced.
- **The post's image**, if it has one and you have left that setting on. The extension sends the image URL and our server fetches it.
- **Your X handle**, as shown on the page, so the reply is written from your point of view.
- **Your voice settings.** Your default tone, the description of your stack, what you're optimising for, and your house rules.

We use this only to generate the reply and return it to you. **We do not store
the post content or the generated replies** after the request completes, and we
do not use them to train any model. Our server logs record operational facts
about the request — a request id, timing, how many replies came back, how many
tokens were used, and the model's classification of the post type — not the text
itself.

## 3. What stays in your browser

The following is written to your browser's own extension storage on your device.
We never receive it, and it is not synced to us:

- **Generation history and favourites**, so you can search and reuse replies that worked. Capped at the most recent 100 generations.
- **Your preferences** — default tone and shape, whether pre-drafting is on, how much thread context to include, theme.
- **Your voice settings**, which are also sent with each draft request as described above. They are held locally because they can exceed the browser's 8 KB per-item sync limit.
- **Your session tokens.** Held by the extension's background worker, which is deliberately the only part of the extension that can read them — nothing running on an X page can reach them.
- **A per-post draft cache**, so reopening the reply table for a post doesn't re-run a generation you already spent.

You can clear history, favourites and settings from the extension's settings page
at any time. Uninstalling the extension removes all of it.

## 4. What we store about your account

You sign in with Google. We use Google only to establish who you are — we do not
request access to your Gmail, Drive, contacts or calendar, and we cannot act on
your Google account. From that sign-in we store:

- **Your Google account identifier** (the stable `sub` value), which is what your account is keyed on;
- **Your email address, name and profile picture URL**, so the extension can show you which account you're signed in as;
- **Your plan and account status**, which determine your allowance;
- **Sign-in timestamps** — when the account was created and when it was last seen.

We also store, for each signed-in account:

- **Session records.** Refresh tokens are stored only as a hash, never in a form that could be replayed as a login, together with an expiry and a coarse browser description.
- **Usage counters.** A running total of the generations your account has ever run, a total for the current calendar month, plus one row per day recording generations, replies returned, token counts, and how many requests errored. The running total is how the 100-generation free allowance is enforced; the monthly total is how the paid allowance is. These contain counts only — no post text and no replies.

## 5. This website

Most of this site is static marketing content with no sign-in and nothing stored
on your device. Our hosting provider processes standard request data such as IP
address, user agent and requested URL in order to serve the site and protect it
from abuse. The site loads web fonts from Google Fonts, which involves a request
to Google's font CDN.

**We set no advertising, analytics or cross-site tracking cookies anywhere on this
site.** The account page sets two cookies, and only once you sign in:

- **`sn_at`** — a short-lived access token, expiring within the hour.
- **`sn_rt`** — the token that keeps you signed in, expiring after 60 days or when you sign out.

Both are strictly necessary to provide a page you asked to be signed in to, so no
consent banner is required for them and none is shown. Both are `HttpOnly`,
which means no script running on the page can read them, and `SameSite=Lax`,
which means your browser will not send them to us when a third-party site makes a
request on your behalf. They contain your session and nothing else — no name, no
email, no tracking identifier — and we do not use them to build a profile of what
you read here. Signing out deletes both and revokes the session on our servers.
There is one further cookie during sign-in itself, which holds a random
anti-forgery value for ten minutes and is deleted the moment the sign-in finishes.

## 6. Who else processes your data

We use a small number of service providers who process data on our instructions:

- **Cloudflare** — hosts this website, our API, our database and our short-lived sign-in state. <https://www.cloudflare.com/privacypolicy/>
- **Google** — provides the sign-in, and the fonts on this site. <https://policies.google.com/privacy>
- **AI model providers** — receive the post and context described in section 2 in order to generate the reply, and return it to us. We select the provider and can change it as better models become available. Write to privacy@socialnib.com for the current list.

We do not sell personal information, and we do not share it for cross-context
behavioural advertising as those terms are used in the CCPA and CPRA.

## 7. How long we keep things

- **Post content and generated replies** — not retained. They exist only for the duration of the request that produced them.
- **Account details** — for as long as your account exists, then deleted on request.
- **Session records** — until the refresh token expires, with expired and revoked records pruned automatically each night.
- **Usage counters** — retained while your account exists, as the record of your allowance. Deleted with your account.
- **Operational logs** — retained for a short period by our hosting provider for debugging and abuse prevention.
- **Email correspondence** — for as long as needed to resolve your question.

## 8. Legal bases for processing

Where the UK GDPR or EU GDPR applies, we rely on **performance of a contract** to
operate your account, authenticate you, generate the replies you ask for, and
enforce your allowance; and **legitimate interests** to keep the service secure,
prevent abuse, and respond to your enquiries. Where you choose to include
optional context — a post's image, or the free-text description of your stack —
you are choosing what to send us.

## 9. International transfers

Our infrastructure runs on a global edge network, and our providers may process
data outside your country, including in the United States. Where required,
transfers rely on the European Commission's Standard Contractual Clauses or an
equivalent safeguard offered by the provider concerned.

## 10. Your rights

Depending on where you live, you may have the right to access, correct, delete,
restrict or object to processing of your personal data, to data portability, and
to withdraw consent. Some of these you can exercise yourself: sign out to end a
session, clear history and settings from the settings page, and uninstall to
remove everything held locally.

For anything held on our servers — your account, your session records or your
usage counters — email privacy@socialnib.com from the address you signed in with.
We will delete your account and everything attached to it on request, and will
respond within the period required by applicable law. You also have the right to
complain to your local data protection authority.

## 11. Children

Socialnib is not directed at children under 13 and we do not knowingly collect
their personal information. X's own terms require users to be at least 13.

## 12. Security

Requests to our API travel over HTTPS and require a signed, short-lived access
token. Refresh tokens are stored hashed and rotate on every use; reuse of an old
token revokes the whole session family, on the assumption it was stolen. The
extension holds no AI provider credentials at all, and your session token is kept
in the background worker rather than anywhere a page script could read it. No
method of transmission or storage is completely secure, but those are the
deliberate choices behind this design.

## 13. Changes to this policy

If we change this policy we will update the date at the top of this page.
Material changes — a new category of data, a new purpose, or a change to who
processes it — will be described plainly rather than folded silently into the
text.

## 14. Contact

Privacy questions and deletion requests: privacy@socialnib.com. Everything else:
support@socialnib.com.