Privacy Policy
Last updated October 14, 2026
BuzzyX ("we", "us") is a workspace for growing on X. This policy explains what we collect when you use buzzyx.com, why, and what control you have. We keep it short on purpose.
What we collect
- Your X account basics. When you sign in with X we store your X user ID, username, display name and profile picture URL. We use the X user ID as your identity, since usernames can change.
- X access tokens. X gives us a token so we can act for you. Tokens are encrypted at rest with a key we hold separately from the database. We never send tokens to your browser or to any third party.
- Posts you publish through BuzzyX. If you enable posting and publish from Compose, we keep the text, the time, and the ID X assigned, so you can see your history. We only publish what you write, when you press the button.
- Early access and preferences. Whether you joined the early access list and which planned features you said you want.
- Session cookie. A random session identifier in an HttpOnly cookie keeps you signed in for up to 30 days. It contains no personal data.
- Usage analytics. We use DataFast to count visits, pages and a handful of product events (for example "joined early access"). DataFast sets a visitor identifier in your browser. We do not send your X identity, username or tokens to DataFast.
AI features
When you use Compose Assist, the draft you are editing and up to eight of your own recent public posts (as style samples) are sent to Anthropic, the maker of Claude, to generate suggestions. Nothing else about your account is sent: no tokens, no username, no identifiers. Anthropic's API does not use this data to train models. Suggestions are only ever drafts; you review and edit them, and nothing is published unless you press Post. We keep a count of your AI usage and token counts for quotas and cost control, not the content.
What we don't do
- We don't ask for your email, password or payment details to sign in.
- We don't sell or rent your data, and we don't run advertising.
- We don't post, like, follow, or message from your account unless you explicitly trigger it.
- We don't read your direct messages. We never request that permission.
Permissions we ask X for
At sign-in we request read access to your profile (users.read, tweet.read) and a refresh token (offline.access) so you don't have to re-authorise every two hours. Posting requires a separate permission (tweet.write) that we only request when you turn posting on, and you can turn it off again in Settings. You can also revoke BuzzyX entirely from your X account settings at any time.
Where data lives
Everything runs on Cloudflare's network: the application on Cloudflare Workers and the database on Cloudflare D1. DataFast processes analytics on our behalf, and Anthropic processes Compose Assist requests. We don't use any other hosting or data processors.
Retention and deletion
We keep your data while your account exists. Sessions expire after 30 days of inactivity. To delete your account and everything tied to it, email divv@divvlaunches.com from an address you can verify as yours, or message us from your X account, and we'll remove it within 30 days. Revoking BuzzyX on X stops us from accessing your account immediately but does not by itself delete stored data.
Security
Traffic is HTTPS only. Tokens are encrypted, session identifiers are hashed, and state-changing requests are protected against cross-site forgery. No system is perfectly secure; if you believe you've found a problem, please tell us at the address above.
Children
BuzzyX is not directed at people under 13, and X itself requires users to be at least 13.
Changes
If this policy changes in a way that matters, we'll update the date above and, for significant changes, note it on the dashboard.