This policy explains what HookPlaybook ("we") collects when you use HookPlaybook, why, and your choices. We collect as little as we need to run the Service, and we never sell personal data.
What we collect
- Account: your email address and, if you sign in with Google, your name, profile picture and Google account id.
- Your X account: if you sign in with or connect X, your X user id, handle, name, picture, follower count and email (if X gives it), and the keys X gives us to post for you, stored encrypted. We read your public posts to learn how you write, and the numbers of posts made through us.
- Posts and checks: the drafts, posts and pictures in your Schedule, and the text of posts you check (a visitor's checks are kept with a hashed IP address only).
- What you put into the Service: the content you create or upload, stored so we can provide the Service.
- Billing: your plan and subscription status. Payment details go to Paddle, our Merchant of Record, and never reach our servers.
- Security records: sign-in codes (stored only in hashed form, deleted within a day), sessions, and hashed IP addresses used to limit abuse.
- Where you came from: on your first visit, the site that sent you (or the campaign named in the link) and the page you landed on, kept with your account if you sign up.
- Usage records: how much of your plan you use, and a record of each AI request (which model answered, its size and cost) to run the Service and keep its costs in check.
Google user data
If you sign in with Google, we receive only your name, email address, profile picture and Google account id (the scopes openid, email and profile). We use them only to create your account, sign you in, and show your name and picture in the app. We do not read your Gmail, Drive, contacts or any other Google data.
We never sell this data, never use it for advertising, and never share it with anyone except the processors that host the Service for us (listed below), and only to run it. It is stored in our database on Cloudflare, sent only over encrypted connections, and readable only by the Service itself and our administrators when supporting your account. It is deleted when you delete your account (Settings, Delete account), or when you ask us at hello@hookplaybook.com. You can also remove our access at any time at myaccount.google.com/permissions.
HookPlaybook's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Why we use it
To provide the Service and your account (performance of our contract with you), to keep it secure and prevent abuse (our legitimate interest), to take payment through Paddle, and to send emails the Service needs, such as sign-in codes, payment notices and important account notices. We may also send warnings when you near your plan's limit, and product news only if you asked for it (the optional box at sign-up, or Settings); you can turn each off in Settings or from the link in the email. We keep a record of when and where you said yes or no to product news, and delete it with your account.
Cookies
We set one cookie to keep you signed in, a short-lived one during Google sign-in, and one on your first visit that remembers where you came from for 30 days (so we know which links bring people), a short-lived one during X sign-in, and one that keeps your setup for a day before you sign up. Cloudflare Turnstile, which protects the sign-in form from bots, may use its own cookies for that purpose only. We use no advertising or cross-site tracking cookies.
Who processes it for us
- Cloudflare: hosting, database, file storage, email delivery and bot protection.
- Paddle: checkout, payments, invoices and tax, as Merchant of Record.
- Google: sign-in, if you choose it.
- OpenRouter: the posts you check, your voice profile and your niche, passed on to the AI model that writes or scores posts.
- X: what you post through us, and the requests to read your own posts' numbers.
- RapidAPI (The Old Bird V2): your public X handle, to read your public posts and profile.
- Resend: your email address and first name, to send product news, only if you asked for it.
Each processes data only to provide its service to us. Some are outside your country; we rely on their standard safeguards for transfers.
How long we keep it
Your account and content are kept while your account exists and deleted when you delete it. Sessions end 30 days after your last visit. Records of AI requests are deleted after 90 days (the text of a request kept to check the Service's quality, after 30). Billing records are kept by Paddle and by us as long as tax law requires.
Your rights
You can see and correct your details in Settings, and delete your account and its data there at any time. You can also ask us for a copy of your data, or to restrict or object to its use, by emailing hello@hookplaybook.com. Where data protection law gives you the right, you can complain to your local data protection authority.
Contact
HookPlaybook. hello@hookplaybook.com. We will email you before a material change to this policy takes effect.