Privacy Policy

Last updated October 23, 2026

Summary

ConvoOrbit helps you find conversations on X, draft replies in your own voice, follow up with people, and schedule your own posts to Facebook Pages, Instagram and TikTok. We keep what you put into your workspace so the app works, we never sell it, we show no ads, and we use no analytics or advertising trackers. Nothing is published to an account you connect unless you approve that exact post.

What we collect

• Your account. Sign-in is handled by Clerk, which keeps the email address and name you sign in with. Our servers store only your Clerk account ID.
• The waitlist. ConvoOrbit is in closed beta. If you join the waitlist, Clerk keeps the email address you give so we can send you an invitation. Ask us and we remove it.
• Your workspace. Posts you save from X (the text, the author's handle, name and profile picture link), your drafts and notes, notes about people, follow-up dates, focus topics, your voice profile, and your settings.
• Connected X account. If you connect X, we keep your X account ID, username, display name and profile picture link, the permissions you granted, and the tokens X issues. Direct messages are read only when you ask on a person's page and are shown, not stored. Messages you send from ConvoOrbit are recorded in your workspace.
• Connected Facebook Pages. If you connect Facebook, we keep the ID and name of each Page you choose and the Page access token Facebook issues. We do not access your personal profile, friends, or Page messages.
• Connected TikTok account. If you connect TikTok, we keep your TikTok account ID, username and nickname and the tokens TikTok issues, and we read your account's current posting options before each post.
• Connected Instagram account. If you connect Instagram, we keep your Instagram professional account ID, username and name and the token Instagram issues. We do not access your messages, comments or followers.
• Connected assistants. If you connect Claude, ChatGPT or Claude Code, we keep which assistant it is, when it first and last used your workspace, and whether you disconnected it. The assistant's sign-in is handled by Clerk, and we never give it a password or a connected account's token.
• Posts and media. Posts you write or schedule, the images and videos you upload for them, and the result of each send, such as the link to the published post.
• Companion extension. The browser extension reads posts already shown in your X tab to highlight ones that match your topics. It sends your workspace only what you act on: posts you save, your drafts, whether you replied, and follow-ups. When you ask it to draft a reply, it sends that post and its author for the suggestion. It also loads your focus topics. We keep only a hashed copy of the extension's sign-in key.
• Service logs. Request IDs, error codes, timings, and internal IDs such as post, account and X user IDs. Logs never contain post text, drafts, messages or tokens.

How we use it

• To run your workspace, sync it with the extension, and keep your data separate from everyone else's.
• To publish the posts you approve, at the time you choose, to the account you choose.
• To write reply suggestions and polish drafts, only when you click to ask for them.
• To keep the service secure and fix problems.

Who we share it with

We share data only with the services that run ConvoOrbit, and only what each one needs:

• Amazon Web Services hosts the app and stores your data in its Canada West (Calgary) region. The other services below may process data in other countries.
• Clerk handles sign-in.
• OpenRouter passes your request for a reply suggestion to the AI model (currently DeepSeek V3.2), run by one of OpenRouter's hosting providers: the post and its author's name, your rough point, the approach you chose, and your voice profile. Whether that provider keeps the text depends on its own policy.
• DeSlop checks and polishes draft text. When you click Polish, DeSlop keeps that text and its result for 30 days.
• X, Meta (Facebook and Instagram) and TikTok receive what you choose to send them: searches, messages and posts you approve. Instagram fetches the photo or video for a post from a private link that expires after an hour. Profile pictures in the app load straight from X's image servers, so X can see your IP address when they load.
• Assistants you connect (Claude by Anthropic, ChatGPT by OpenAI) receive the workspace data they ask for while you use them: your channels, posts, media details, voice profile, posting times, conversations and people. What they keep depends on your settings with them and their own policies.

Each of these services handles data under its own privacy policy. We do not sell or rent your data, and we do not share it for advertising.

How we protect it

Every request is tied to your signed-in account, and you can only read and change your own workspace. Access tokens for connected accounts are encrypted with AWS Key Management Service and never sent to your browser. Uploaded media is kept in private storage and shown to you through links that expire after 15 minutes.

How long we keep it

• Your workspace, posts and media stay until you delete them or ask us to delete your account.
• Uploads that never finish are removed after a day.
• Service logs are kept for 30 days.
• Database backups are kept for up to 35 days, so deleted data leaves them within that time.

Your choices and deleting your data

• Download a copy of your workspace in Settings: your saved conversations, drafts, people, notes, focus topics, voice profile and settings. Ask us for a copy of your posts and media.
• Disconnect X, a Facebook Page, an Instagram account or a TikTok account in Settings. This deletes the tokens we hold for it. You can also remove ConvoOrbit from your Facebook, Instagram, TikTok or X app settings, which stops it working at once. Disconnect an assistant in Settings → Assistants to refuse it at once.
• Delete posts and saved conversations in the app at any time. Deleting a post, or taking a file off it, also deletes the uploaded file unless another of your posts still uses it.
• Delete your account and all your data by emailing privacy@convoorbit.com from the address you sign in with. We delete everything within 30 days and reply when it is done.

You can also ask us what data we hold about you or to correct it, using the same address.

Cookies and local storage

Clerk uses cookies to keep you signed in. In your browser, the app keeps your appearance setting, a list of which X handles it has already fetched profile pictures for, unsent direct message drafts until you close the tab, and the sample workspace if you try it. The extension keeps its sign-in key, a copy of your saved posts and drafts, which posts it highlighted in the last day, your highlight settings, and profiles you collect for export, in its own browser storage. We use no advertising or analytics cookies.

Children

ConvoOrbit is not meant for anyone under 18, and we do not knowingly collect their data.

Changes

If we change this policy, we update the date at the top.

Contact

Questions about privacy: privacy@convoorbit.com.