LogoFirecrest
Get started

Privacy policy

Last updated: Oct 15, 2026

1. Introduction

Firecrest helps you write posts and replies for X that fit your niche, and can publish them to the X account you connect. This policy explains what personal data we collect, why, who receives it, how long we keep it, and the rights you have over it.

2. Who is responsible for your data

Squared Sums Pte Ltd ("we", "us", "our"), 160 Robinson Road, #14-04 SBF Centre, Singapore 068914, operates Firecrest and is the data controller for personal data processed through the Service. You can reach us at [email protected]. Messages to that address also reach our data protection officer.

3. What we collect

  • Account details. Your email address, and a display name and profile picture if you set them.
  • Content you create. Your onboarding answers, brand profiles, drafts, posts and replies, the images you attach, and the web pages you ask us to read.
  • Connected X accounts. The profile details X shares when you connect an account, and an access credential so we can act with the permissions you granted. We also keep a daily record of your connected X account's public profile: counts, name, bio, location and pictures.
  • Payment details. Stripe processes your payment. We receive your subscription status and the billing name and email Stripe reports back. Card numbers never reach us.
  • Usage information. We record how you use the Service, such as the features you use, the actions you take and time spent in the app, to understand and improve it. These records never contain the text you write. To object, email us at [email protected]; we stop recording for your account and delete what we kept.
  • AI cost records. For each request we send an AI provider on your behalf, which feature made it, which model answered and what it cost.
  • Technical data. The IP address and browser of each sign-in session, and the time zone you choose.

4. Why we use it, and on what basis

  • To provide the Service you signed up for (contract): your account, brand profiles, drafts and replies, publishing to X when you tell us to, billing, plan limits and account emails.
  • To run and improve the business (legitimate interest): usage analytics, tracking what the Service costs to run, reporting your follower growth and showing your accounts on the analytics dashboard, and keeping it secure.
  • To meet legal duties (legal obligation): keeping payment and tax records.
  • To send product news and offers (consent): only if you ticked the optional box when you bought your plan. You can withdraw that consent at any time.

We do not sell your personal data.

5. Analytics

We use Umami to understand how people use the product. Umami sets no cookies, stores no identifier on your device, and anonymises IP addresses, so this site shows no cookie consent banner for analytics. Our usage information sets no cookie and stores nothing on your device either.

6. Cookies

  • Essential cookies. Required for basic platform functionality and security: the session cookies that keep you signed in.
  • Preference cookies. Store your language preference. Your light/dark theme and the account you last selected are kept in your browser's local storage.

We use no advertising or cross-site tracking cookies. You can control cookie preferences through your browser settings.

7. Who receives it

  • Anthropic (AI provider): receives your onboarding answers, the pages you ask us to read, your X profile details and public posts from X, to build your brand profiles and draft your posts and replies.
  • xAI (AI provider): when we use xAI in place of Anthropic, it receives the same data for the same purpose. We instruct xAI not to store these requests or its responses.
  • GetXAPI (X data provider): receives your keywords, language, X handle and X account id to find public posts on X and read your public profile. It never receives your drafts.
  • X Corp: lets us read your profile and posts, and receives what you publish, which appears publicly under your X account. X's own terms and privacy policy govern it after that.
  • Stripe (payments): payment processing, subscriptions, and the billing portal.
  • Resend (email): sends our emails, so it receives your email address and the message.
  • S3-compatible object storage: stores your profile picture and the images you attach to posts.
  • Umami (analytics): as described in section 5.
  • Discord (internal alerts): operational notifications to our team, which can carry a masked email address or your X handle.

Each provider processes data under its own privacy policy and our data processing arrangements with them.

8. International data transfers

Your data is processed outside Singapore, mainly in the United States, where Anthropic, xAI and most of the other providers above are based. Where data is transferred internationally, we rely on standard contractual safeguards and provider-level data protection commitments.

9. Security

We encrypt traffic to and from the Service and your X access credentials, and card details never reach our servers. No method of storage or transmission is perfectly secure: if we discover a breach affecting your personal data, we will tell you and the relevant authority as the law requires.

10. How long we keep it

  • Account details and your content: while your account exists.
  • Text from the pages you ask us to read: used during onboarding only and deleted within about a day.
  • Connected X accounts: while your account exists. Disconnecting an account deletes its access credential and profile details. The daily record of its public profile stays while your account exists and is deleted with it.
  • Payment records: kept for accounting and tax purposes, including after you delete your account.
  • Retention. Usage information is kept for up to 25 months.
  • AI cost records: kept after you delete your account, detached from it.
  • Technical data: sign-in session details until you sign out or delete your account, and your time zone while your account exists.
  • The deletion summary: kept with no time limit.

11. Deleting your account

You can delete your account from your settings. We delete it permanently 30 days later; until then you can cancel the deletion.

When you delete your account, we delete your account data, your content and your connected X accounts. We keep:

  • payment records, for accounting and tax purposes;
  • usage and AI cost records, detached from your account so they can no longer be linked to you;
  • an anonymous summary of your plan, how long you were a customer, and the reason you gave for leaving.

Because these records can't be linked to you, we can't erase them on request.

12. Your rights

Subject to applicable data protection laws, you have the right to:

  • Access your personal data and request copies.
  • Correct inaccurate or incomplete data.
  • Request deletion of your data (right to be forgotten).
  • Restrict how we process your data.
  • Object to processing based on legitimate interest, including usage analytics. Objecting to usage analytics does not stop the daily record of your public X profile.
  • Receive your data in a portable format.
  • Withdraw consent for optional processing.
  • Lodge a complaint with the Singapore Personal Data Protection Commission (PDPC) or another competent supervisory authority.

For any request other than deleting your account, email [email protected] and we will respond within the time the law allows.

13. Children

Firecrest is not directed to users under 16 years of age, and we do not knowingly collect personal data from children under 16. If we learn that we have collected such data, we will delete it.

14. Changes to this policy

We may update this policy from time to time. We will announce material changes through the Service or by email, and change the "Last updated" date above.

15. Contact

For questions about this policy or to exercise your rights, contact us at [email protected], or by post at Squared Sums Pte Ltd, 160 Robinson Road, #14-04 SBF Centre, Singapore 068914.