Privacy Policy
x-growth is a private tool operated by MVP Labs for managing their own X accounts. It has no public sign-up and is not offered as a service to anyone else.
1. Who this covers
The only person who connects an account to x-growth is the operator. If you are reading this because you found the site, no data about you is collected by visiting it. The sections below describe what the tool stores about the X accounts the operator connects.
2. What is stored
When an X account is connected, x-growth stores:
- The account’s X user id, username, display name, and avatar URL, as returned by X.
- OAuth access and refresh tokens, the token expiry, and the scopes granted.
- Timestamps for when the record was created and last updated.
Alongside that, it stores content the operator creates:
- Scheduled posts and threads, including their text, any attached media references, tags, and scheduled times.
- Queue settings, tags, a product catalog, and a background context document used for drafting.
- The X post ids of anything published, and an error description if a publish failed. Error text is filtered for credential-shaped strings before it is written.
3. What is not stored
- No email addresses. The tool requests no email scope and has no field to store one.
- No passwords. Authentication to X is by OAuth; x-growth never sees an X password.
- No analytics, advertising, or third-party tracking of any kind.
- No data about other people’s X accounts beyond what is publicly visible and needed to publish or measure the operator’s own posts.
4. How tokens are protected
OAuth access and refresh tokens are encrypted at rest with AES-256-GCM before being written to the database, using a key held outside the database. They are decrypted only in memory at the moment a request to X is made. No page or API response in x-growth returns a token, in encrypted or decrypted form.
5. Cookies
x-growth sets two cookies, and only during the account-connection flow: x_oauth_state and x_oauth_verifier. They exist to prevent a forged or replayed authorization callback. Both are HTTP-only, Secure, SameSite=Lax, expire after ten minutes, and are cleared as soon as the connection attempt finishes, whether it succeeded or failed. The verifier cookie is encrypted. There are no analytics, advertising, or preference cookies.
6. Who the data is shared with
Nothing is sold, rented, or shared for marketing. Data reaches these parties only as needed to operate the tool:
- X (x.com) receives the posts the operator publishes and the API calls needed to publish and read them, under X’s own terms and privacy policy.
- A third-party X read API may be used to read public X data more cheaply than the official API. It receives the public identifiers being looked up. It never receives OAuth tokens.
- Object storage holds any media attached to a scheduled post.
- The hosting provider running the operator’s server and database.
Data may also be disclosed if required by law, or to investigate a suspected security incident.
7. How long it is kept
Account records, scheduled posts, and published-post records are kept until the operator deletes them. Disconnecting an account removes its stored tokens. Because the tool has a single operator who controls the database directly, there is no separate deletion request process.
8. Rights
If you believe x-growth holds data about you and you want it removed, contact hello@mvp-labs.com. Depending on where you live you may have rights to access, correct, or delete personal data held about you, and to object to its processing. Requests will be answered within 30 days.
9. Children
x-growth is not directed at children and is not usable by anyone other than its operator.
10. Changes
If this policy changes materially, the effective date above will change. This policy is governed by the laws of the United States of America.
11. Contact
MVP Labs, hello@mvp-labs.com