Privacy Policy

1. Introduction

XWipe ("we", "our", "us") is a product of BestDid Technology Ltd. This Privacy Policy explains how we collect, use, store, and protect your information when you use our bulk tweet deletion service at getxwipe.com and the XWipe apps for iPhone and Android.

2. Information We Collect

When you use XWipe, we collect the following information:

• X Account Data: Your X (Twitter) username, profile information, and OAuth access tokens necessary to perform deletions on your behalf.
• Email Address: Your email address associated with your X account, used for account communication.
• Usage Data: Deletion counts, credit balance, and basic usage analytics.
• Payment Information: Payments on the website are processed by Paystack or Stripe (cards) or NOWPayments (crypto). We do not store your credit card numbers, bank details or wallet details on our servers.
• In-App Purchase Data: In the iPhone and Android apps, credit packs are bought through the Apple App Store or Google Play (Google Play Billing), and RevenueCat processes the purchase receipt for us. We receive the product bought, its price, the store transaction or order id, which store it came from, and whether it was a test purchase, linked to your XWipe account id (which is also your RevenueCat app user id). Apple and Google handle your payment details; we never see them.
• Device Push Token: If you allow notifications in the iPhone or Android app, we store an Expo push token for your device so we can tell you when a wipe finishes and send occasional service notices. Expo delivers them through Apple Push Notification service on iPhone and Firebase Cloud Messaging on Android. Turn notifications off in your phone settings to stop them.

3. How We Use Your Information

• To authenticate you via X OAuth and perform tweet deletions
• To track your credit balance and the deletions you have used
• To process payments through Paystack, Stripe or NOWPayments
• To credit in-app purchases made through the Apple App Store or Google Play, via RevenueCat
• To send push notifications about your wipes, if you allow them
• To send important service-related communications
• To understand how the site is used, through PostHog analytics
• To improve and maintain the service

4. Data Storage & Security

We take the security of your data seriously:

• OAuth tokens are encrypted at rest using AES-256-GCM encryption before being stored in our PostgreSQL database.
• All data is transmitted over HTTPS/TLS encrypted connections.
• Database access is restricted and follows the principle of least privilege.

5. Cookies

We use a session cookie provided by NextAuth.js to keep you signed in. This is a strictly necessary cookie and does not track you across other websites. PostHog, our product analytics tool, sets a first-party cookie and local storage entry on getxwipe.com to count visits and sessions; it does not follow you to other sites, and it is switched off if your browser sends Do Not Track. We do not use advertising cookies.

6. Third-Party Services

XWipe integrates with the following services:

• X (Twitter) API: Used to access and delete your tweets. Subject to X's Privacy Policy.
• Paystack: Used for payment processing. Subject to Paystack's Privacy Policy.
• Stripe: Processes card payments for credit packs on the website. Receives your email address, your XWipe account id and the pack you are buying; your card details go to Stripe, never to us. Subject to Stripe's Privacy Policy.
• NOWPayments: Processes crypto payments for credit packs. Receives the price, the pack name and an order reference that contains your XWipe account id; the coin and wallet you pay from are handled by NOWPayments. Subject to NOWPayments' Privacy Policy.
• Resend: Sends our emails (welcome, wipe-finished reports, reminders and product announcements you can unsubscribe from). Receives your email address, your X username and the content of each email. Subject to Resend's Privacy Policy.
• PostHog: Product analytics, so we can see which pages work and where people get stuck. Receives the pages you visit, recordings of website sessions (when recording is on) with everything you type masked, and, once you sign in, your XWipe account id, X username and plan, plus checkout and payment events (pack and amount). Sent through getxwipe.com, not used for advertising. Subject to PostHog's Privacy Policy.
• Apple App Store: Processes in-app purchases in the iPhone app. Subject to Apple's Privacy Policy.
• Google Play: Processes in-app purchases in the Android app through Google Play Billing. Subject to Google's Privacy Policy.
• RevenueCat: Validates App Store and Google Play purchase receipts and tells us which credits to add. It holds the purchase receipts and your app user id (your XWipe account id). Subject to RevenueCat's Privacy Policy.
• Expo: Delivers push notifications to the iPhone and Android apps using your device push token. Subject to Expo's Privacy Policy.

7. Data Retention & Deletion

We retain your data only for as long as your account is active. You can request deletion of your account and all associated data at any time; our account deletion page explains how and what is kept. Upon account deletion:

• Your encrypted OAuth tokens are deleted
• Your account data is permanently removed from our database
• We keep your numeric X user id and how many free deletions it used, so deleting and re-joining cannot reset the free trial
• Paystack, Stripe, NOWPayments, the Apple App Store, Google Play and RevenueCat may retain transaction records as required by financial regulations

8. Your Rights

You have the right to access, correct, or delete your personal data. You can revoke XWipe's access to your X account at any time through your X account settings. To exercise any of these rights, contact us at the email below.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the updated policy on this page with a revised date.

10. Contact

If you have questions about this Privacy Policy, contact us at info@getxwipe.com.