Privacy Policy

XXmachine ("we", "us", or "our") operates as a private content automation platform for social media agencies. This Privacy Policy explains how we collect, use, and protect information when you use our service.

By accessing XXmachine, you agree to the data practices described in this policy. If you do not agree, please discontinue use of the service.

Account information: When you register, we collect your email address, display name, and a hashed password. We never store passwords in plain text.

Platform credentials: To enable posting and analytics, we store OAuth access tokens for platforms you connect (Instagram, Threads). For username-based tracking (Twitter/X, TikTok), we store only the public username.

Content data: We store metadata about posts you schedule (captions, image URLs, publish status, timestamps). We do not store media files directly — these remain in your connected Google Drive or external CDN.

Usage data: Session identifiers (stored as signed cookies), IP address, and browser user-agent are logged for security and session management purposes.

Analytics data: Platform statistics (follower counts, view counts) fetched from connected accounts are cached in our database for dashboard display.

We use the information we collect to:

• Authenticate you and maintain your session
• Publish content to connected social media platforms on your behalf
• Display analytics and performance data in your dashboard
• Run scheduled automation (cron jobs for publishing, token refresh)
• Provide fan management and messaging features

We do not sell, rent, or share your personal information with third parties for marketing purposes.

XXmachine integrates with the following third-party services. Their privacy policies govern their data handling:

• Meta (Instagram, Threads): OAuth authentication and content publishing via the Graph API
• Apify: Used to scrape public profile statistics from Twitter/X, TikTok, and Instagram where official APIs are unavailable
• Google Drive: Optional storage for generated media content via service account credentials
• Supabase / PostgreSQL: Database hosting for all application data
• xAI Grok / Anthropic / Google Gemini: AI APIs used for content generation and fan profile analysis

We retain your data for as long as your account is active. You may request deletion of your account and associated data at any time by contacting an administrator.

Platform stats snapshots (analytics history) are retained for up to 90 days. Session records are deleted upon logout or after 30 days of inactivity.

We take reasonable technical measures to protect your data, including:

• HMAC-SHA256 signed session cookies
• bcrypt password hashing
• TLS encryption in transit
• SSL-secured database connections

No method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your data.

If you are located in the European Economic Area, you have the following rights:

• Access: Request a copy of personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data
• Restriction: Request that we limit processing of your data
• Portability: Request your data in a structured, machine-readable format

To exercise these rights, contact your platform administrator.

We use a single, strictly necessary session cookie (xm_sid) to maintain your authenticated session. This cookie is HttpOnly and does not track you across other websites. We do not use advertising or analytics cookies.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the service after changes constitutes acceptance of the updated policy.

XXmachine is operated by CUTTOKS LTD, company number 14321119.

Data-deletion instructions are available on the Data Deletion page.