Privacy policy

Last updated 2026-10-17

This policy explains what personal data BangerX (bangerx.so) processes, why, and your rights.

1. Controller

Gojambel GmbH, Undinestraße 3, 81927 München, Germany. Managing director: David Klein. Commercial register: Amtsgericht München, HRB 115693. VAT ID: DE185743564. Contact: hello@bangerx.so.

2. What we process

When you sign in we receive from 𝕏: your numeric 𝕏 user ID, @handle, display name, profile image URL, your email address if 𝕏 provides a confirmed one, and OAuth access and refresh tokens. Tokens are stored encrypted and used only on our servers to call the official 𝕏 API on your behalf. They are never sent to your browser. Legal basis: performance of the contract, Art. 6(1)(b) GDPR.

b) Data we read from 𝕏 (server side, official 𝕏 API)

Voice import: once, after you subscribe, we read up to your 100 latest own posts and replies to other people (text and public like/repost/reply counts). We keep the 20 best of your own posts as “voice samples”, and up to 100 of your own posts and up to 100 of your replies with their counts as “post history” (used for best-time suggestions, Recycle and the growth tracker; no further reads are needed for these). Replies are used only to show your reply activity in the growth tracker, never as voice samples or for Recycle.
Follower snapshot: every day we read your follower count once and store it with the date (kept until you delete your account).
Weekly digest: each week we read your 10 latest own posts and replies and merge them into the post history.
Paste-a-link fallback: when you paste a post URL on the web we read that single post (text and public counts). This is capped at 10 per month.

Legal basis: Art. 6(1)(b) GDPR. We never train or fine-tune models on 𝕏 content. Your posts are used only as prompt context to write for you.

b2) Chrome extension (BangerX Radar)

The extension runs on x.com and reads the posts visible on the page you are viewing, locally in your browser, to rank them (post id, author handle, age, and the visible reply/repost/like/view counts). This ranking never leaves your device.
It sends a post to our server only when you explicitly ask for reply drafts for that one post (by pressing Draft on its badge or the R key): the post id, the post text (up to 1,000 characters), the author’s handle and the post URL. There is no bulk upload, no crawling, no hidden tabs and no browsing history collection.
It never clicks, types, likes, follows, replies or posts on 𝕏 for you. “Reply on 𝕏” opens 𝕏’s own reply screen in a new tab, prefilled; you press Reply.
We store an extension token: only its SHA-256 hash is kept on our server (the raw token lives in your browser’s extension storage). You can revoke tokens in Settings; revoked tokens are purged. The extension also stores your target list and settings in your browser and, if you sync them, on our server.
We store the reply drafts we generated for you (with the post text they answer) for 30 days, then delete them. When you open a draft’s reply screen we record that (a counter for your Daily Plan: “replies started”).
Legal basis: Art. 6(1)(b) GDPR (providing the feature you request).
Chrome Web Store limited use. Data the extension handles is used only to provide the reply drafts you ask for. We do not sell it, do not use or transfer it for advertising, personalised ads, credit or lending decisions, and do not transfer it except as needed to provide the feature, to comply with law, or as part of a merger or sale. Humans do not read it unless you ask us to, it is needed for security or abuse, or the law requires it.

b3) Target accounts, daily plan and streak

You may enter up to 50 𝕏 handles as “targets” (handles only, entered by you; we do not read their timelines). We store your daily goals and daily counters (replies started, posts) per local calendar day to show your plan and streak. Legal basis: Art. 6(1)(b) GDPR.

c) Content you write in BangerX

Drafts you paste, the Ready Posts, scores and rewrites we generate, recycled drafts, scheduled posts, and the reply suggestions. Drafts are stored with your account until you delete the account. Reply targets (posts you pasted for the reply sniper) are deleted automatically after 30 days. Legal basis: Art. 6(1)(b) GDPR.

d) Subscription and payment

Payments are handled by Creem (Armitage Labs OÜ, Tallinn, Estonia) as merchant of record and reseller. We receive your subscription status, period dates, and a customer and subscription ID. We do not receive card details. Legal basis: Art. 6(1)(b) GDPR; statutory retention duties, Art. 6(1)(c) GDPR.

e) Email

We send transactional email (subscription confirmations, cancellation and refund confirmations) and the weekly digest to the digest email address you confirm. Sending uses Lettermint B.V.; open and click tracking is not used. You can turn the digest off in Settings. Legal basis: Art. 6(1)(b) GDPR.

f) Usage records

For each AI call, 𝕏 API read or published post we store a cost record (user, kind, time, model, token counts, cost) so we can enforce the fair-use limits (for example 30 reply-draft calls and 5 Ready Posts calls per day, 15 Banger-mode runs, 20 scheduled posts and 10 paste-link reads per billing period) and keep the service affordable. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.

g) Technical data and cookies

IP address, timestamps and request paths in server logs for security and operation (Art. 6(1)(f) GDPR). We use only essential cookies (session). See the cookie policy.

3. Recipients and processors

Hetzner Online GmbH (Germany): hosting of the application and its SQLite database and backups, in the EU. The hosting location and the processing agreement can be confirmed with hello@bangerx.so.
OpenRouter, Inc. (USA) and the underlying model providers it routes to, currently from Anthropic, OpenAI, xAI and DeepSeek-hosting providers depending on the model: receive your draft, voice samples and, for the reply sniper, the pasted post text, to generate scores, rewrites, replies and digests. We request provider routing that denies data collection, and keep logging and training disabled in our OpenRouter account. This is not a guarantee of zero retention by every downstream provider, and the providers still process the content needed to answer each request.
Creem (Armitage Labs OÜ, Estonia): payments, VAT, refunds.
Google (Chrome Web Store): distributes the extension; Google processes install and update data under its own policy.
Lettermint B.V. (Netherlands): email delivery.
X Corp. (USA): the 𝕏 API itself, called with your own token; 𝕏’s privacy policy governs data on 𝕏.

4. Transfers outside the EEA

OpenRouter and some model providers may process data in the USA or elsewhere. International transfers are subject to Chapter V GDPR and rely on an adequacy decision (including the EU-US Data Privacy Framework where the recipient is certified), standard contractual clauses or another Chapter V safeguard, depending on the provider. The safeguards that apply to each recipient can be requested at hello@bangerx.so.

5. Retention and deletion

Account data and content: until you delete your account.
Account deletion (Settings → Delete account) cancels billing and immediately deletes your profile, 𝕏 tokens, extension tokens, drafts, scheduled posts, reply targets and reply drafts, digests, voice samples, post history, targets, daily plan and follower snapshots. Cost records are kept without any link to you (user ID replaced by “deleted”).
Records of refund and withdrawal requests and the related invoices are kept for the statutory retention periods under German commercial and tax law (six to eight years, depending on the document), then deleted.
Reply drafts and reply targets: 30 days. Revoked extension tokens and expired sessions: removed daily. Voice samples and post history: replaced/merged every week. Follower snapshots, target list and daily plan: until you delete your account.
Invoices and payment records are held by Creem under its own retention duties.

6. Your rights

Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)) and complaint to a supervisory authority (Art. 77), for example the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA). Write to hello@bangerx.so. You can also revoke BangerX’s access to your account at any time in your 𝕏 settings.

7. Security

Technical and organisational measures include: OAuth tokens encrypted at rest; extension tokens stored only as SHA-256 hashes; HTTPS only; secrets kept on the server and never sent to the browser; access to production data limited to the operator; and automatic deletion of expired sessions and old reply data. A summary of the measures can be requested at hello@bangerx.so.

8. Changes

We may update this policy when providers or features change. The date at the top shows the last revision.

This policy is published in English. It is not a certification: providers, transfer safeguards and retention periods are kept in line with the current deployment.