Privacy Policy.

This Privacy Policy explains how Streak X collects, uses, stores, and shares information when you visit streakx.online, create an account, connect an X account, or use the Streak X service.

By using Streak X, you acknowledge the practices described here. If you do not agree with this policy, please do not use the service.

We collect the information needed to operate your account and track your progress:

• Account information: your email address, authentication identifiers, and account creation and sign-in records. If you choose Google sign-in, we also receive basic Google account information, such as your name and profile picture, through Supabase. Streak X does not receive your Google password or store your plaintext email-account password.
• Connected X information: the public X username and public account identifier returned by X after you authorize the connection. We do not request your X email, private messages, or permission to publish or interact for you.
• Goal and progress information: daily post and reply goals, public activity counts, goal completion, streak history, refresh usage, and synchronization timestamps.
• Preferences: your time zone and automatic-sync preference.
• Subscription information: your Creem customer, product, and subscription identifiers, billing interval, subscription status, and current access period. Streak X does not receive or store your full payment-card number.
• Technical information: essential session cookies and information ordinarily included in web requests, such as IP address, browser type, device type, and diagnostic records generated by our hosting and security providers.
• Anonymous website analytics: page path, filtered query parameters, referrer, approximate city and country, browser, operating system, device type, and event timestamp collected through Vercel Web Analytics for aggregated traffic statistics.

We receive information directly from you when you register, select goals, or choose a time zone. If you sign in with Google, Google provides basic account information to Supabase for authentication. When you connect X, X returns your public account identifier and username through OAuth. We retrieve public post and reply activity associated with that account through a public-data provider. Creem sends us subscription events needed to grant, maintain, or remove paid access.

Streak X does not ask for or receive your X password and does not publish posts or replies on your behalf. We use the short-lived X access token only to retrieve the connected identity during the callback and do not store it in our database or request a refresh token.

We use information to authenticate users, provide the dashboard and activity heat map, calculate streaks, synchronize public X activity, apply local-day boundaries, manage subscriptions, understand aggregate website traffic, improve the service, prevent abuse, troubleshoot failures, communicate about accounts, and comply with legal obligations.

Where applicable law requires a legal basis, we process information to perform our contract with you, pursue legitimate interests in operating, understanding, improving, and securing Streak X, comply with law, and obtain consent where required.

We disclose information only as needed to operate Streak X, complete transactions, protect the service, or comply with law. Current service providers include:

• Supabase for authentication and database hosting.
• Google for authentication when you choose Google sign-in.
• X for securely authorizing and identifying the account you connect.
• Vercel for application hosting, delivery, and anonymous Web Analytics.
• Creem as Merchant of Record for checkout, payments, taxes, subscription management, refunds, and chargebacks.
• Our SMTP email provider for confirmation, password-reset, and other transactional account emails.
• A third-party public-data provider for retrieving public account activity used by the tracking features.

These providers process information under their own terms and privacy notices. We may also disclose information when required by law, to investigate misuse or security incidents, or as part of a merger, financing, acquisition, or sale of assets with appropriate protections.

We do not sell personal information or share it for cross-context behavioral advertising.

Streak X uses essential cookies or similar browser storage to keep you signed in, protect authentication flows, remember your time zone, and maintain basic service operation. These technologies are required for the requested service.

Vercel Web Analytics does not use cookies. It records anonymous page-view information for aggregated statistics without associating it with an individual customer or IP address, and its temporary visitor-identification hash is discarded after 24 hours.

We do not currently use third-party advertising cookies or behavioral advertising trackers. If this changes, we will update this policy and provide any controls required by law.

We retain account and progress information while your account remains active and as reasonably necessary to provide the service. Subscription and transaction-related records may be kept longer when required for accounting, fraud prevention, dispute handling, or legal compliance.

You may request account deletion by emailing support@streakx.online from your registered address. We may retain limited records where required by law or needed to establish, exercise, or defend legal claims. Backup copies may remain temporarily until normal backup cycles complete.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These include authenticated access, restricted server credentials, database row-level access controls, and HTTPS in production.

No internet service can guarantee absolute security. You are responsible for using a strong, unique password and protecting access to your email account and devices.

Streak X and its service providers may process information in countries other than your own. Those countries may have different data-protection laws. Where required, we and our providers use appropriate safeguards for international transfers.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, or to receive a portable copy. You may update available account information in Settings, disconnect your X account, cancel your subscription through the Creem customer portal, or contact us with a privacy request.

We may ask you to verify your identity before completing a request. You may also have the right to complain to your local data-protection authority.

Streak X is not directed to children under 13, and paid subscriptions are intended for people legally able to enter a binding contract. We do not knowingly collect personal information from children under 13. Contact us if you believe a child has provided information so we can investigate and delete it where appropriate.

We may update this policy as Streak X changes or legal requirements evolve. We will post the revised policy here and update its effective date. If a change materially affects how we use personal information, we will provide additional notice when reasonably required.

For privacy questions or requests, contact Streak X at support@streakx.online. Include “Privacy request” in the subject line and write from the email associated with your account when possible.