1. Introduction
This Privacy Policy explains how RunXForMe ("we," "us," or "our") collects, uses, stores, shares and protects information when you use www.runxforme.com (the "Service"). RunXForMe is operated by a sole trader based in Australia.
By using the Service, you agree to the collection and use of information as described here. If you do not agree, please do not use the Service.
IMPORTANT: The Service publishes content to your X account automatically on your behalf. It also retrieves content from a public Instagram account you nominate, which may belong to someone other than you. Please read Sections 2.4 and 2.5 carefully.
2. Information We Collect
2.1 Account Information
Authentication is handled by Clerk, a third-party identity provider. Depending on how you sign up, we or Clerk collect:
- Email address
- Name and profile image, if you sign in with Apple or Google
- A hashed password, if you register with email and password (we never see or store your plaintext password)
- Account identifiers, sign-in method, and session data
- Account creation date and last sign-in time
We do not store your Apple or Google password, and we do not receive it.
2.2 Subscription and Payment Information
Payments are processed by Stripe. We do not collect, receive or store your card number, CVV or bank details. We receive and store:
- Your Stripe customer identifier
- Your plan, subscription status, trial status and renewal date
- Transaction confirmations and billing history metadata
- Whether a payment succeeded or failed
Stripe handles all card data under its own privacy policy and PCI-DSS obligations.
2.3 Your X Account Connection
When you connect your X account, you authorise us through X's own secure authorisation screen. We never receive, request or store your X password.
We store:
- Your X user ID, handle and display name
- An OAuth access token and refresh token permitting posting on your behalf, encrypted before storage
- The scopes you granted
- Connection status and date
Tokens are used solely to publish posts you have configured. You can disconnect at any time from your dashboard, which deletes the stored tokens, and you can also revoke access from your X account settings.
2.4 Instagram Source Information
You nominate a public Instagram account as a content source. We never ask for, receive or store your Instagram password, and we do not log in to Instagram.
We collect and store:
- The Instagram username you enter
- Public metadata about that account's video and photo posts (post identifiers, captions, timestamps, media URLs, and similar public fields)
- A small still image from each post, stored so your dashboard can show you what is queued
- A record of which posts have been published, so the same post is not published twice
This information is retrieved through a third-party content-retrieval provider. We send that provider the Instagram username you entered and receive publicly available post data in return.
Note on third-party information: the Instagram account you nominate may belong to another person. Public post data about that account, and personal information contained in that content, will be processed by us and our providers as a result of your instruction. You must only nominate accounts whose content you own or have permission to use. You are responsible for having the necessary rights and consents.
2.5 Media Files
Video and photo files from Instagram are handled ephemerally:
- A video or photo is downloaded to temporary storage for a single publishing job
- It is uploaded to X
- It is then deleted
Instagram media files are not retained on our servers, not archived, and not kept after the publishing job completes. They are not streamed directly from Instagram to X, they pass briefly through temporary storage during the job.
Images you attach to a post you write in the dashboard are different: they are stored in our database from the moment you add the post until it is published or you remove it, because they exist nowhere else for the Service to fetch. Once the post is published the stored image files are deleted and only a small thumbnail is kept for your history.
We do not use your media for AI training, advertising, or any purpose other than publishing it as you instructed.
2.6 AI Caption Generation
Captions are generated by OpenAI. To generate a caption we transmit the Instagram post's caption text, related public metadata and the still image from the post to OpenAI's API. If you ask the AI to write or rewrite a post you compose yourself, the notes you typed and a reduced copy of the first attached image are sent in the same way. Data sent to the OpenAI API is not used to train OpenAI's models. OpenAI may retain API data for a limited period for abuse monitoring in accordance with its own policies, which we do not control.
If AI captions are not enabled, the Instagram caption is reused instead and nothing is sent to OpenAI.
2.7 Posting History and Logs
We store a record of activity on your account, including:
- Which posts have been selected and published
- The generated caption for each post
- The resulting X post identifier
- Timestamps, success or failure status, and error reasons
- Pause, resume and configuration changes
This record is what prevents duplicate posting and lets you see what the Service has done.
2.8 Automatically Collected Technical Data
When you use the Service we collect:
- IP address
- Browser type and version, device type and operating system
- Pages visited, features used and interaction data
- Referring website
- Approximate location at country or city level, derived from IP address
- Error reports, stack traces, performance data and session context (via Sentry)
- Aggregate page-view measurement (via Vercel Analytics, which does not use cookies and does not track you across sites)
- Server and request logs
2.9 Communications
If you email us, or use the contact form on the site, we retain your message, email address and our reply so we can respond and keep a support record.
2.10 Cookies and Similar Technologies
See Section 5.
3. How We Use Your Information
We use the information we collect to:
Provide the Service
- Authenticate you and maintain your session
- Retrieve videos and photos from the Instagram source you nominated
- Generate captions and publish posts to your connected X account
- Track published posts to prevent duplicates
- Apply your plan's posting limits and backfill depth
- Display your dashboard, history and status
Manage subscriptions
- Process payments, trials, renewals and cancellations through Stripe
- Enforce plan entitlements
- Handle billing enquiries
Maintain and improve the Service
- Diagnose errors and failed posts
- Monitor performance, uptime and reliability
- Understand usage patterns and improve features
Communicate with you
- Send service and transactional emails, such as failed posts, expired connections, payment issues and account notices
- Respond to support enquiries
Security, abuse prevention and legal compliance
- Detect and prevent fraud, abuse and Terms violations
- Investigate copyright and misuse complaints
- Comply with law, respond to lawful requests, and enforce our Terms
We do not sell your personal information. We do not use your content for advertising. We do not use your content or data to train AI models.
4. How We Share Your Information
We share information only as described below.
4.1 Service Providers
| Provider | Purpose | What is shared |
|---|---|---|
| X Corp. | Publishing posts to your account | Access token, video or image files, post text |
| OpenAI | AI caption and post writing | Instagram post caption text, public metadata and a still image; for posts you write, your notes and a reduced first image |
| Clerk | Authentication and account management | Email, name, profile image, credentials, session data |
| Neon | Database hosting | All stored application data |
| Stripe | Payment processing | Email, billing details you enter, transaction data |
| Vercel | Hosting, delivery and aggregate site analytics | Technical and request data |
| Sentry | Error monitoring | Error data, technical data, IP address, session context |
| Arcjet | Bot filtering and abuse protection | IP address and request metadata |
| Resend | Delivering email we send, including replies to the contact form | Your email address and message |
| Third-party content-retrieval provider | Retrieving public Instagram post data | The Instagram username you entered |
Their privacy policies:
- X: https://x.com/en/privacy
- OpenAI: https://openai.com/policies/privacy-policy
- Clerk: https://clerk.com/legal/privacy
- Neon: https://neon.com/privacy-policy
- Stripe: https://stripe.com/privacy
- Vercel: https://vercel.com/legal/privacy-policy
- Sentry: https://sentry.io/privacy/
- Arcjet: https://arcjet.com/privacy-policy
- Resend: https://resend.com/legal/privacy-policy
We identify our content-retrieval provider by category rather than by name for commercial reasons. If you are entitled under applicable data protection law to know the identity of a recipient of your personal information, contact us at support@runxforme.com and we will provide it.
4.2 Legal Requirements
We may disclose information where we reasonably believe it is necessary to:
- Comply with a law, court order, subpoena or government request
- Enforce our Terms of Service
- Investigate or prevent fraud, abuse, or security threats
- Respond to a copyright or rights-holder complaint
- Report unlawful content, including suspected child exploitation material, to the appropriate authorities
- Protect the rights, property or safety of any person
4.3 Business Transfers
If the business is sold, merged or transferred, your information may be transferred as part of that transaction. We will notify you if this happens.
4.4 With Your Consent
We may share information for other purposes where you have expressly consented.
5. Cookies and Tracking
5.1 Essential Cookies
Required for the Service to work: authentication and session cookies set by Clerk, security and CSRF protection, and load balancing.
5.2 Functional and Analytics
We use limited technical and performance data to monitor the Service: error and performance monitoring through Sentry, and cookieless, aggregate page-view measurement through Vercel Analytics. Vercel Analytics does not follow you across other websites.
5.3 No Advertising Cookies
We do not use advertising cookies, tracking pixels for ad networks, or share data with advertisers.
5.4 Managing Cookies
You can control cookies through your browser settings. Disabling essential cookies will prevent you from signing in and using the Service.
EU/UK visitors: where consent is required for non-essential cookies, we rely on your consent, which you may withdraw at any time through your browser settings or by contacting us.
6. Data Retention
| Data | Retention |
|---|---|
| Instagram video and photo files | Deleted immediately after each publishing job; not retained |
| Images attached to posts you write | Stored until the post is published or you remove it, then deleted; a small thumbnail is kept in posting history |
| Account information | Until your account is deleted |
| X access tokens | Until you disconnect, your account is deleted, or the token expires or is revoked |
| Instagram source username, post metadata and stills | Until you remove the source or your account is deleted |
| Posting history | Until your account is deleted |
| Payment and billing records | Retained by Stripe and by us as required by Australian tax and accounting law, generally 7 years, even after account deletion |
| Error and technical logs | Typically 30 to 90 days, per our providers' retention settings |
| Support emails | Up to 2 years |
| Backups | Deleted data may persist in encrypted backups for a limited period before being overwritten |
Content published to X is not covered by this policy. Once a post is live on X, it is governed by X's privacy policy and is subject to X's retention. Deleting your RunXForMe account does not delete posts already published, you must delete those from X yourself.
7. Stopping the Service and Deleting Your Account
From your dashboard you can, at any time and without contacting us:
- Pause or turn off the automation, which stops future posts immediately
- Disconnect your X account, which deletes the stored access tokens
- Cancel your subscription through the Stripe billing portal
Account deletion is handled by us on request. There is no self-service delete button yet. Email support@runxforme.com from the address on your account and we will delete it. When we do:
- All automation stops
- Your X access tokens are deleted, which ends our ability to post to your account (you can also revoke RunXForMe from your X account settings)
- Your account data, source configuration, stored stills and posting history are deleted from our database
- Your Stripe subscription is cancelled
- Instagram media files are already deleted, as they are never retained; images attached to unpublished posts you wrote are deleted with the rest of your account data
- None of the Service's functions will continue to operate
Exceptions: billing records retained for legal and tax compliance, data required to resolve a dispute or enforce our Terms, and residual copies in encrypted backups until those backups cycle out.
8. Data Security
Technical measures
- HTTPS/TLS encryption in transit
- Encryption of X access tokens before storage
- Encryption at rest for database storage
- Credentials handled by Clerk; payment data handled by Stripe; neither passwords nor card details are stored by us
- Access controls and regular dependency and security updates
Operational measures
- Access to production data limited to what is necessary to operate the Service
- Hosting on reputable managed platforms
- Error and anomaly monitoring
Limitations
No method of transmission or storage is completely secure. We cannot guarantee absolute security. In particular, if your X access token were compromised, an attacker could post to your X account. You should use a strong, unique password, secure your email account, enable two-factor authentication on your X account, and disconnect RunXForMe if you no longer use it.
9. International Data Transfers
The Service operates globally and your information may be transferred to and processed in countries other than your own, including the United States and other jurisdictions where our providers operate. These countries may have different data protection standards than yours.
Where required, we rely on appropriate safeguards, such as Standard Contractual Clauses and our providers' own transfer mechanisms. By using the Service you consent to these transfers.
10. Your Privacy Rights
10.1 General Rights
Subject to applicable law, you may request to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete information
- Delete your personal information
- Object to or restrict certain processing
- Port your data to another service
- Withdraw consent where processing is based on consent
10.2 Australia
We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth) as a matter of practice. You may request access to and correction of your personal information at any time.
10.3 EU and UK (GDPR)
If you are in the EU or UK you additionally have the right to lodge a complaint with your national supervisory authority, the right to be informed of a data breach affecting you, and the right not to be subject to solely automated decision-making producing legal or similarly significant effects.
Our lawful bases for processing are:
- Contract, to provide the Service you signed up for
- Legitimate interests, for security, abuse prevention, service improvement and support
- Legal obligation, for tax, accounting and lawful requests
- Consent, where specifically requested, such as non-essential cookies
10.4 California (CCPA/CPRA)
California residents have the right to know what personal information is collected and disclosed, to request deletion, to correct inaccurate information, to opt out of sale or sharing, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under California law.
10.5 Exercising Your Rights
Email support@runxforme.com with your request and the email address on your account. We will respond within 30 days, or sooner where the law requires. We may need to verify your identity first.
11. Children's Privacy
The Service is not intended for anyone under 18, and we do not knowingly collect information from anyone under 18. If we discover that a user is under 18, we will terminate the account and delete the associated data. If you believe a child under 18 has used the Service, contact support@runxforme.com.
12. Automated Processing
The Service is automated by design. It selects posts, generates captions and publishes them without individual human review. Captions are generated by AI and may be inaccurate, inappropriate or misleading; you remain responsible for everything published to your account. We do not use automated processing to make decisions producing legal or similarly significant effects about you.
13. Data Breach Notification
If we become aware of a data breach likely to result in serious harm, we will notify affected users without undue delay, notify the Office of the Australian Information Commissioner and any other relevant authority as required by law, describe the nature of the breach and the steps taken, and provide guidance on protecting yourself. For EU/UK users, notification to the relevant authority will be made within 72 hours of becoming aware, as required by GDPR.
14. Third-Party Sites
The Service links to and integrates with third-party services, including Instagram and X. This Privacy Policy does not apply to them. Review their policies separately.
15. Do Not Track
We do not currently respond to Do Not Track browser signals, as there is no consistent industry standard for interpreting them.
16. Changes to This Policy
We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised "Last updated" date. For material changes affecting your rights, we will provide prominent notice or email account holders before the changes take effect. Continued use after changes take effect indicates acceptance.
17. Contact and Complaints
Email: support@runxforme.com
We respond to privacy enquiries within 30 days.
If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (www.oaic.gov.au) or, if you are in the EU or UK, to your national data protection authority.
Summary: Key Privacy Points
- Instagram media files are never stored. They are downloaded to temporary storage for one publish job, uploaded to X, then deleted. Images you attach to a post you write are kept only until that post is published.
- We never receive your Instagram password. Public accounts only, no login.
- We never receive your X password. You authorise through X's own screen, and tokens are encrypted.
- We never store your card details. Stripe handles all payment data.
- We do not sell your data, use it for advertising, or train AI on your content.
- Captions are AI-generated and published without human review. You are responsible for what appears on your account.
- Content you publish to X is governed by X's privacy policy. Deleting your RunXForMe account does not delete posts already on X.
- The Instagram account you nominate may belong to someone else. Only use content you own or have permission to use.
For questions: support@runxforme.com