p Plume

Privacy Policy

Last updated: June 2026

Plume (“we”, “us”) is an AI content studio for X (Twitter) at plumeio.com, plus an optional Chrome extension (the “reply assistant”). This policy explains what we collect, why, and your choices. Questions: hello@plumeio.com.

What we collect

Account: your email and a hashed password, handled by our auth provider (Supabase). We never see your password in plain text.
Your content: the posts, drafts, threads, articles, ideas, style profile (rulebook/archetype) and settings you create in Plume.
X connection: if you connect X for auto-publishing, we store OAuth tokens (encrypted at rest) to post on your behalf. We never receive or store your X password.
Analytics you choose to sync: if you use the extension to import your X analytics, the metrics you trigger are sent to your workspace.
Usage logs: one row per AI generation (model, token counts, cost) to enforce fair-use limits and bill correctly. No content is stored in these logs.

We do not sell your data, and we do not use your private content to train third-party models beyond producing your own outputs.

How we use it

To run the product: draft posts in your style, plan your calendar, critique drafts, find videos, and (if enabled) publish to X on your schedule.
To enforce plan limits and the free-trial cap, and to show you your own usage and cost.
To secure the service and prevent abuse.

AI processing & subprocessors

To generate text and images we send the necessary inputs to AI providers (e.g. Anthropic, OpenAI, fal.ai) and store data with infrastructure providers (Supabase, Vercel). They process data on our behalf under their own terms and do not use your private content to train their models for others. Video captions may be fetched/transcribed to rank relevance when you use Discover.

The Plume browser extension

The extension is optional. It helps you draft replies on X and (only when you ask it to) read public posts or your own analytics. It performs no automation: it returns text for you to review and post manually. It talks only to plumeio.com and your auth provider, using your Plume sign-in token stored locally on your device. Why each permission is needed:

storage: keep your Plume session and settings on your device.
cookies (x.com): read the twid cookie only to detect which X account you’re signed into, so you can link it to the right workspace. We do not read auth/session tokens or your password.
tabs: when you click “Analyze patterns” / “Style profile”, open a background tab on the public X profile to read public post text and metrics, then close it. Used only for actions you start.
clipboardWrite: copy a drafted reply to your clipboard on click.
Host access to x.com, twitter.com, analytics.x.com: show the reply button in the timeline and, on your request, read your analytics to sync to your workspace.

Payments

Subscriptions are paid in cryptocurrency (e.g. USDC/USDT). We receive the on-chain payment and the plan you bought; we do not collect card numbers. See our Refunds policy and Terms.

Retention & deletion

We keep your data while your account is active. You can delete your content in-app, or email hello@plumeio.com to delete your account and associated data. Disconnecting X revokes our posting access and removes the stored tokens.

Your rights

You can access, export, correct, or delete your data. Just ask. Depending on where you live (e.g. EU/UK GDPR), you may have additional rights; we honour them.

Changes

We’ll update this page when our practices change and revise the “Last updated” date.

Contact

hello@plumeio.com