Privacy policy

Last updated 2026-10-10

Who we are

Xtant (“we”, “us”) runs the website getxtant.com, the account site dash.getxtant.com, and the Xtant apps for Mac and iPhone. Xtant reads X on your Mac, finds the posts worth a reply, and suggests replies. You post everything yourself. This page says what data Xtant keeps, where it keeps it, and for how long. Questions: hello@getxtant.com.

The short version

  • Xtant never posts for you, and it never uses the X API.
  • Your X login, your own AI keys and your Claude or ChatGPT login never reach our servers.
  • Your reply history and the posts you prepare in Create Post are saved in your iCloud, never on our servers.
  • The posts Xtant reads from X stay on our servers for at most 12 hours after they were published, apart from short-lived backups.
  • We do not sell your data, we do not show ads, and we do not use your data to train AI models.

What we keep on our servers

  • Your account. Your email address, or the identifier Sign in with Apple gives us with the name and email address Apple shares (the address can be a private relay address). The token Apple gives us so we can end your Sign in with Apple link when you delete your account. The public part of any passkey you add. Xtant has no passwords.
  • Your devices. For each signed-in device: a one-way hash of its session, its platform and name, the app and reader versions, its push notification token, the identifier of Apple’s device check (so the free credit is given once per device), and when it was last seen. While your Mac is connected, how long since you last used it, so notifications go to the device you are at.
  • Your X accounts. For each X account you add: its handle, display name, profile picture link, whether it has Premium, whether it is paused, its time zone, and its settings, including the niche text and any prompts you set for it.
  • Posts read from X. The posts X shows you, as the Mac app reads them: the author’s handle and name, profile picture link, text, media links, counts such as likes, and when it was published. With each post we keep Xtant’s decision and the suggested replies. Each post is deleted 12 hours after it was published. When you tell Xtant you replied, the suggestions and your final text are deleted at once, and only a “replied” marker stays until the 12 hours end, so your other devices keep the post hidden.
  • AI work in progress. Each AI request (its kind, the post it is for, its status and its answer) is kept with its post and deleted with it. Text you ask the AI to refine in Create Post passes through our servers only while the AI works, at most 10 minutes, and is then deleted. A voice clip you dictate on Xtant’s credits is sent to OpenAI to become text, and Xtant does not keep it.
  • Reminders. For a post you asked to be reminded about: the time, a reference to the post on your device, and the start of its text, which the reminder notification shows.
  • Notifications. A notification about a post shows the start of that post. It is sent through Apple’s push service to your iPhone, or shown by the Mac app.
  • Credits and payments. Every change to your balance: the free credit, each top-up, each daily fee, each AI charge and each refund, with its amount, its time and the transaction identifier from Stripe or Apple. We never see your card number.
  • Usage counts. Daily and hourly counts, such as posts read, decisions and AI requests, used for billing, limits and keeping Xtant working.
  • Reader health. For each Mac: the reader version, when it last read X successfully, and its last error.
  • Sign-in and download emails. When you ask for a sign-in code: your email address, one-way hashes of the code and the link, and a one-way hash of your IP address, used to limit how many sign-in emails can be sent. A code works once, for 15 minutes. When you ask the iPhone app to email you the Mac download link, we note that we sent it, to allow at most 3 a day, and remove the note after a day.
  • Logs. Cloudflare handles your IP address and the details of each request to deliver and protect Xtant, and keeps short-lived request logs (the time, the address called, errors) so we can find and fix problems.
  • Backups. Our database and your private space can be restored up to 30 days back, so data deleted from them stays in those backups for up to 30 days before it is gone for good.

What never reaches our servers

  • Your X login. Each X account signs in inside the Mac app, and its login stays in that app’s storage on your Mac.
  • Your own AI keys. They stay in your Keychain, shared between your devices by iCloud Keychain. When a feature runs on your own key, your device calls OpenAI or Anthropic itself.
  • Your Claude or ChatGPT login. A feature on your subscription runs Claude Code or Codex on your Mac, signed in as you. Xtant never reads, copies or keeps those logins.
  • Your reply history and the posts you prepare in Create Post. They are saved in your iCloud, in Xtant’s private space in your own iCloud account, never on our servers. You choose how long the history is kept: 1, 3, 6 or 12 months, or forever.
  • Your card details. You pay on Stripe’s own checkout page, or through Apple.

How Xtant uses X

The Mac app reads X from X’s own pages, signed in as you, in a pane you can watch, at a careful pace by default. It reads your home timeline, the posts of the accounts you turned notifications on for, and, with Premium+, your XPro columns. Xtant never uses the X API.

Xtant never posts, replies, likes, reposts or follows for you. On the Mac it fills X’s own reply box, compose box or schedule dialog. On the iPhone it opens the X app with your text. You press the final button every time.

AI, and who sees what

Each AI feature (choosing posts, suggesting replies, voice) runs on one of three sources, which you choose in the Mac app:

  • Xtant’s credits (the default). Our servers send OpenAI what the feature needs: the post (its text, its author, and its images, which OpenAI fetches from X), your niche text, voice notes and prompts for that X account, text you ask the AI to refine with your instruction, or your voice clip. Each request carries a one-way hash of your user id, so OpenAI can spot abuse without knowing who you are. OpenAI handles what we send under its API terms.
  • Your own key. Your device sends the same to OpenAI or Anthropic under your key. Your agreement with that provider applies.
  • Your subscription. Claude Code or Codex on your Mac sends it to Anthropic or OpenAI under your account. Your agreement with that provider applies.

Who handles data for us

  • Cloudflare · hosts this website, the API, the database and your private space on our servers, and forwards mail to hello@getxtant.com.
  • OpenAI · choosing posts, suggesting replies and voice to text, when a feature runs on Xtant’s credits.
  • Stripe · payments on the web and in the Mac app.
  • Apple · Sign in with Apple, in-app purchases on the iPhone, push notifications, and iCloud (your own account, for your history and the posts you prepare).
  • Resend · sends sign-in emails and the download link email.

Cookies

getxtant.com runs no analytics or advertising tags. When you sign in on dash.getxtant.com, your browser keeps one cookie to keep you signed in, and it sends that cookie to getxtant.com too. Cloudflare may set a cookie of its own to protect the sites from abuse.

Deleting your account

You can delete your account in the Mac app or the iPhone app. Deleting it signs out every device, erases your private space with every post and suggestion in it, and deletes your account, devices, X accounts, settings, usage counts and sign-in records. Your Sign in with Apple link is revoked at Apple. Any unused credits are lost, as the terms say.

The record of your credits stays, because we have to keep payment records for accounting, but it is no longer linked to an account: your email address, your name and your devices are gone with the account. Your reply history and the posts you prepare stay in your iCloud until you delete them in the app or in your iCloud settings.

Your choices and rights

You can pause an X account at any time, choose which source each AI feature uses, and delete your account. To ask for a copy of your data, a correction or a deletion, email hello@getxtant.com. Depending on where you live, data protection laws may give you more rights, including the right to complain to your data protection authority.

Security

Everything travels over HTTPS. Sessions and sign-in codes are stored only as one-way hashes. On your devices, your session sits in the Keychain, and you can lock the apps with Face ID or Touch ID.

Children

Xtant is not meant for children under 13, and we do not knowingly keep their data.

Changes to this page

When this page changes, the date at the top changes too.

Contact

hello@getxtant.com