p Plume

Privacy Policy

Last updated: August 2026

Plume ("we", "us") is an AI content studio for X (Twitter) at plumeio.com, plus an optional Chrome extension (the "reply assistant"). This policy explains what we collect, why, and your choices. Questions: hello@plumeio.com. Operator legal entity: [to be completed by the operator].

What we collect

Account: your email and a hashed password, handled by our auth provider (Supabase). We never see your password in plain text. If you sign up with X or Google, we receive basic profile info from that provider, not your password.
Consent records: whether you accepted the Terms (and when) and whether you opted in to marketing email, kept as proof of consent.
Your content: the posts, drafts, threads, articles, ideas, style profile (rulebook/archetype), cover images, and settings you create in Plume.
X connection: if you connect X for auto-publishing, we store OAuth tokens (encrypted at rest) to post on your behalf. We never receive or store your X password.
Analytics you choose to sync: if you use the extension to import your X analytics, the metrics you trigger are sent to your workspace.
Usage and billing: one row per AI action (model, token counts, cost) to enforce fair-use limits and account correctly, plus your plan, prepaid expiry, and referral records (your referral code, who referred you, and any credits). No post content is stored in the usage logs.

We do not sell your data, and we do not use your private content to train third-party models beyond producing your own outputs.

How we use it

To run the product: draft posts in your style, plan your calendar, critique drafts, find references, and (if enabled) publish to X on your schedule.
To operate billing and the referral programme, enforce plan limits and the free-trial cap, and show you your own usage and cost.
To send service messages, and, only if you opted in, product updates and tips (you can opt out anytime).
To secure the service and prevent abuse.

AI processing and subprocessors

To provide the Service we share the data needed with providers who process it on our behalf under their own terms and do not use your private content to train their models for others:

AI providers (for example Anthropic, OpenAI, fal.ai): generate text and images from your inputs. Video captions may be fetched or transcribed to rank relevance in Discover.
Infrastructure (Supabase, Vercel): host the app, database, and files.
Payment providers: a crypto processor (for example NOWPayments) and, where offered, a card processor (for example Lemon Squeezy) handle checkout. We receive the payment and the plan you bought; we do not receive or store card numbers.
Email: a delivery provider sends service and (opted-in) product emails.

The Plume browser extension

The extension is optional. It helps you draft replies on X and (only when you ask it to) read public posts or your own analytics. It performs no automation: it returns text for you to review and post manually. It talks only to plumeio.com and your auth provider, using your Plume sign-in token stored locally on your device. Why each permission is needed:

storage: keep your Plume session and settings on your device.
cookies (x.com): read the twid cookie only to detect which X account you are signed into, so you can link it to the right workspace. We do not read auth/session tokens or your password.
tabs: when you click "Analyze patterns" / "Style profile", open a background tab on the public X profile to read public post text and metrics, then close it. Used only for actions you start.
clipboardWrite: copy a drafted reply to your clipboard on click.
Host access to x.com, twitter.com, analytics.x.com: show the reply button in the timeline and, on your request, read your analytics to sync to your workspace.

Payments

Paid plans are billed in cryptocurrency (for example USDC or USDT) and, where offered, by card through a third-party processor. We receive the on-chain or card-provider confirmation and the plan you bought; we do not collect card numbers. See our Refunds policy and Terms of Use.

Retention and deletion

We keep your data while your account is active. You can delete your content in-app, or email hello@plumeio.com to delete your account and associated data. Disconnecting X revokes our posting access and removes the stored tokens. We may keep limited records (for example billing and consent logs) where the law requires, and routine backups for a limited time.

Your rights

You can access, export, correct, or delete your data, and withdraw marketing consent, at any time. Just ask. Depending on where you live (for example EU/UK GDPR), you may have additional rights; we honour them.

Changes

We will update this page when our practices change and revise the "Last updated" date.

Contact

hello@plumeio.com