Privacy Policy

Extudio (“we”, “us”) is a hosted content studio for X at extudio.dev. This policy explains what we collect when you use the website and the studio, why, and what you can do about it. Questions go to support@extudio.dev.

We are the controller of the personal data described here. If you use Extudio on behalf of a company, that company is responsible for the content it brings in.

Account. Your email address, name and avatar, and a sign-in identifier, through our authentication provider. If you sign in with Google or X we receive the profile fields those services share (name, email, avatar); we never see your password for those services.

X connection. When you connect an X account we store its handle, display name, avatar and the OAuth tokens X issues us. Tokens are encrypted at rest and are used only to publish the posts you schedule and to read what the X API needs for that. We do not read your DMs or timeline.

Your content. Everything you create in the studio: your brand profile (voice, pillars, glossary, audience), drafts, the content bank, scheduled and published posts, chat sessions, schedule slots, settings and the images you generate.

Billing. Your plan, subscription status and a customer identifier at our payment processor. Card details go directly to the processor; we never store them.

Usage. A ledger of metered actions (text generations, image generations, posts) so we can enforce plan allowances, plus standard server logs (IP address, user agent, request path, timestamp) kept for security and debugging.

Website analytics. On the marketing pages only (never inside the studio) we may load Google Analytics to count visits and see which pages are read. The studio and auth screens load no analytics.

• To run the service: sign you in, keep your studio, publish your scheduled posts at the time you chose.
• To generate content: your brand profile and the request you make are sent to an AI model to draft text or images. We send what is needed for that draft and nothing else.
• To bill you and enforce plan limits.
• To keep the service secure, prevent abuse and fix problems.
• To contact you about your account (a failed post, a billing issue, a change to these terms). We do not send marketing email unless you opt in.

Drafts and images are produced by third-party AI models, reached through a model gateway. The text we send is built on our servers from your brand profile and your request; we do not send your X tokens, your email or your billing details to a model. Our model providers are contractually restricted from using API traffic to train their models, but their own policies govern retention on their side.

AI output can be wrong, biased or off-brand. You review it before anything is published; nothing is posted to X without an action you took or a schedule you set.

We do not sell personal data. We share it with providers who process it for us, under their own terms and data processing agreements:

• Clerk — authentication and account records.
• X Corp. — publishing to your X account and the OAuth connection, under X’s privacy policy.
• OpenRouter and the AI model providers it routes to — text and image generation.
• Stripe — payments and subscriptions.
• Railway — hosting, the database and the object storage that holds generated images.
• Google — analytics on the marketing pages, and sign-in if you choose it.

We may also disclose data when the law requires it, to protect the rights or safety of our users or the service, or as part of a merger or acquisition (with notice to you).

Your content and account data stay as long as your account exists. X tokens are deleted when you disconnect the account. Server logs are kept for a limited period for security and are then discarded. Billing records are kept as long as tax and accounting law require.

When you delete your account we delete your studio, media and X connections; we keep only what we are legally required to keep, and backups age out on their own schedule.

• Export everything in your studio as JSON from Settings → Export, at any time.
• Clear your studio content from Settings → Clear, or disconnect an X account from Settings.
• Delete your account by emailing support@extudio.dev from the address on the account; we complete it within 30 days.
• Access, correct, restrict or object to processing, and port your data, where the law where you live gives you those rights (including the GDPR and UK GDPR). Email us and we will respond within a month.

If you are in the EEA or UK you can also complain to your local data protection authority. We would rather hear from you first.

The studio uses strictly necessary cookies to keep you signed in. The marketing pages may set analytics cookies through Google Analytics; you can block them in your browser without affecting the studio. We do not use advertising cookies.

All traffic is encrypted in transit. X tokens are encrypted at rest with a key held only on our servers. Access to production systems is limited to the people who run the service. No system is perfectly secure; if we learn of a breach that affects you we will tell you without undue delay.

Our providers run in the United States and the European Union. Where data leaves the EEA or UK we rely on the providers’ standard contractual clauses or an adequacy decision.

Extudio is not for anyone under 18. We do not knowingly collect data from children; if you believe we have, email us and we will delete it.

We update this page when our practices change and move the date at the top. For a material change we email the address on your account before it takes effect.