Privacy
Darboon reads public replies on X so that the people and teams who post can understand them and keep abuse off their posts. This page says what it keeps, for how long, who else handles it, and how to have it deleted. It covers two groups of people: our customers, and the people whose replies are read.
Who is responsible
Darboon, California, United States, runs Darboon and decides how this data is used. Contact: support@darboon.com When an agency or team uses Darboon for a client's X account, it does so for that client, and Darboon handles the replies on its instructions; write to us if you need a data processing agreement.
What we keep, and for how long
| What | How long |
|---|---|
| Your account: X user id, handle and name, and the access tokens X issues (never your password). If you sign in with Google or Microsoft, only the id and name that provider gives us. Your workspace, its members and their roles. | Until you ask us to delete your account |
| The posts you protect or analyze, and every reply and quote post read for them: the text, the text read from its pictures, and its author's id, handle, name and follower count. | While the post is protected or analyzed (7 days unless you extend it), and deleted when it ends |
| Flagged accounts: for a reply judged abusive, or in a theme you chose to act on, the reply's text, its author's id, handle, name and follower count, the reason, and what was done (hidden, muted, listed). | Until you clear it ("Not hostile, undo") or ask us to delete your account |
| Pictures in replies, when image checking is on: never the picture itself, only a fingerprint of it, the text read from it and the verdict, with nothing about who posted it or where. | The text read, 30 days |
| Payments: a reference to the card saved with Stripe, and what you were charged. Card numbers never reach us. | As long as tax and accounting law requires |
For individual users who opt in, the operator keeps a private record of the accounts found posting abuse under their own posts (the account, the date and a link to the reply), to check how accurate Darboon is and to recognise coordinated campaigns. Our legal basis is our legitimate interest in preventing abuse. It never includes brands', agencies' or teams' workspaces, it is never published or shared, and entries are deleted after 12 months, when the user opts out, or when they mark the account as not hostile. If you are in that record and want to see what we hold, object to it or have it deleted, write to us at the address below.
We do not sell data or use it for advertising. The site sets one cookie, to keep you signed in; there are no analytics or advertising cookies.
Who else handles it
- X Corp, through its API: to read replies and to hide and mute on your behalf.
- Anthropic (United States): its Claude models judge and group replies, receiving the post and its replies. Anthropic keeps what it receives only for a limited time, for safety and abuse monitoring, and does not use it to train its models.
- Amazon Web Services (United States, us-east-1): hosting and storage, Amazon's Titan model that groups replies by meaning, and Claude run inside AWS as a backup when Anthropic's service is unavailable. Models run inside AWS do not keep what they receive.
- Google: Cloud Vision reads the text in pictures when image checking is on, and Google Sheets when you send accounts to a list. With "Create a Google Sheet for me", Google lets Darboon create that sheet in your Drive and open only the sheets it creates; it cannot see anything else in your Drive.
- twitterapi.io, a data provider that may be used to read public replies and the list of accounts you follow, only to provide the service.
- Stripe, for payments.
Data is processed in the United States. For people in the European Union and the United Kingdom, these transfers rely on each provider's data protection terms (for AWS, Google and Stripe, the standard contractual clauses).
Why we may use it
For customers, to provide the service you signed up for. For the people whose replies are read: the replies are public and addressed to our customer's post, and we use them in our customer's legitimate interest, and ours, in understanding responses to their posts and keeping abuse off them. Hiding and muting are decided automatically and can be undone in one click; a hidden reply is not deleted from X.
Nobody reads replies as a matter of routine. The operator may look at flagged replies to check accuracy or to answer a support request.
Security
Everything is sent over HTTPS and stored in AWS, encrypted at rest. Only the operator has access to the servers and the stored data.
Messages from Darboon
The service's X account may send you a direct message about your own account, for example if your card is declined or your gift credit runs out, and to tell you when someone has given you a gift, even if you have not signed up. It does not message you for any other reason, and X delivers it only if your settings accept messages from it.
Emails from Darboon
When we write to a business about Darboon, the links in that email are unique to it. So we can see whether a deck it links to was opened and how far it was read, whether the email was answered, and whether an account was made from it. No cookie is used for this: the link itself carries it. We keep the address we wrote to and these events for 12 months, or until you ask us to delete them. Reply "no" to any of our emails and we will not write again.
The overlap page
An individual account can share a page where a visitor who signs in with X sees which accounts that person blocked they themselves follow. The visitor's sign-in is used for that one check and is not stored.
Your rights
You can ask us what we hold about you, to correct it, to delete it, to have a copy, or to stop using it, whether you are a customer or someone whose replies were read; we answer within a month. To stop all access at once, revoke the app in your X settings. If you are in the EU or UK and are unhappy with our answer, you can complain to your data protection authority. Contact: support@darboon.com