Privacy Policy

“TwitterAPI.io”, “we” and “us” mean the operator of the website twitterapi.io, the dashboard, the API at api.twitterapi.io and the free tools on the website. TwitterAPI.io is an independent service and is not affiliated with X Corp.

This policy covers information about the people who visit our website and the customers who create an account. It does not cover the public X content that customers request through the API; see “Public X data requested through the API” at the end of section 2 for how we handle that.

Account information (from Google sign-in)

You create an account by signing in with Google. We do not offer passwords. When you sign in, Google sends us your name, your email address, the address of your profile picture and your Google account identifier, and we store those four items on your account. Section 3 describes exactly how we handle this Google user data.

Your account record also holds what we create for you or record at sign-up: your API key, your credit balance, plan and billing settings, usage counters, your referral code and the code you signed up with, a webhook address if you set one, whether you agreed to marketing email, and the IP address and browser request headers (such as the user agent) of the sign-up request together with the result of the bot check.

Billing information

Card payments are processed by Stripe. Crypto payments are processed by NOWPayments. We do not receive or store full card numbers or security codes; you enter them on Stripe's form. From Stripe we keep your customer and payment-method identifiers, the card brand, its last four digits, expiry date and a card fingerprint, and the amounts and identifiers of your checkouts, invoices and subscriptions. For crypto payments we keep the currency, the deposit address, the amounts and the status.

API usage information

When you call the API we record which endpoint was called, when, by which account and API key, a summary of the request parameters (for example the usernames or search terms you looked up), the status and a shortened summary of the response, the response time, the number of credits charged and the IP address the request came from. We need these records to bill you, to enforce rate limits, to investigate errors and to prevent abuse. Section 7 says how long each log is kept.

To answer a request we pass its parameters to the upstream providers we use to fetch X data. If you use the endpoints that act on your own X account (for example posting or following), the X login cookies or credentials you send with the request are passed on to perform the action. We do not store those X credentials on our servers.

Website and device information

When you browse the website, we and our analytics and advertising providers collect information such as the pages you view, the page you arrived from, your approximate location derived from your IP address, your browser and device type, and identifiers stored in cookies. We also record how you first reached us (for example the first and the most recent page you landed on, the referring site, campaign parameters in the link, an advertising click identifier, an analytics identifier, your time zone offset or a referral code) and attach it to your account when you sign up, so that we can understand which channels bring customers and credit referrals correctly.

Free tools

The free tools on the website (for example the follow checker or the shadowban check) look up public X accounts and posts. Each lookup appears in our server logs with the time, the username or post you looked up and your IP address, and we keep short-lived counters per IP address, or per account when you are signed in, to apply the daily limits. Results are cached for 15 minutes. Anonymous visitors pass a Cloudflare Turnstile check before a lookup.

Affiliate program

If you take part in the affiliate program we keep your referral code, the accounts that signed up through it, the commission they generated and the payout details you give us, such as the email address a payout is sent to.

Messages you send us

If you email us or contact support we keep the message, your email address and our reply.

Public X data requested through the API

The API returns content that is publicly available on X, such as public profiles and posts, in response to the requests our customers make. That content may include personal information about X users. Customers decide what to request and are responsible for using it lawfully, as set out in our Terms of Service. If you are an X user and have a concern about how your public information is used through our service, contact us at hello@twitterapi.io.

TwitterAPI.io uses Google only to sign you in. We request the basic sign-in scopes openid, email and profile. We do not request access to your Gmail, Drive, Calendar, contacts or any other Google service.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove TwitterAPI.io's access to your Google account at any time in your Google Account settings, under the list of third-party apps with access to your account.

• To provide the service: create and secure your account, issue API keys, answer API requests.
• To bill you: count usage, charge credits, process payments, refunds and affiliate payouts.
• To keep the service safe: enforce rate limits and the free-tool limits, detect fraud, abuse and duplicate accounts, and investigate incidents.
• To support you: answer questions and tell you about problems with your account or your payments.
• To tell you about the service: changes to pricing or terms, security notices and, where the law allows, product news. You can opt out of marketing email at any time.
• To understand and improve the product and our marketing: measure which pages and features are used, which channels bring visitors and customers, and whether our advertising works.
• To comply with the law and enforce our terms.

Where the EU or UK General Data Protection Regulation applies, we rely on these legal bases: performing our contract with you (providing and billing the service), our legitimate interests (security, fraud prevention, product improvement, measuring our marketing), your consent where the law requires it, and legal obligations (tax and accounting records).

We do not sell your personal information. We share it only with the recipients below.

We do not send personal information to any AI or language-model provider.

We may also share information:

• when the law, a court order or a lawful request from an authority requires it;
• to protect our rights, our customers or the public, for example when investigating fraud or abuse;
• with a buyer or successor if the business is merged, sold or reorganised, under commitments no weaker than this policy.

We use cookies and browser storage for three purposes:

• Necessary. Keeping you signed in, remembering your language and theme, passing the bot check, and remembering a referral code or the campaign that brought you here so that it can be credited when you sign up.
• Analytics. Google Analytics, Microsoft Clarity and Ahrefs Analytics tell us which pages are visited and where the site is hard to use. Clarity records interactions such as clicks and scrolling.
• Advertising measurement. Google Ads, Microsoft Advertising, Reddit and OpenAI tags tell us whether a visit that started from one of our ads led to a sign-up or a purchase.

You can block or delete cookies in your browser settings and use the opt-out tools the providers offer. If you block necessary cookies, signing in will not work.

Public X content returned by the API (for example posts and public profile data of X accounts) may be kept in our systems without a fixed deletion date. That is information about X accounts, not about our customers.

You can ask us at any time to give you a copy of the personal information we hold about you, to correct it, to delete your account and the information in it, to stop sending you marketing email, or to stop or limit a particular use of your information. Write to hello@twitterapi.io from the email address of your account. There is no delete button in the dashboard yet, so deletion is done by our staff on request; we may ask you to confirm that the account is yours. When we delete an account we keep the payment and invoice records that accounting and tax rules require.

Depending on where you live you may have further rights under laws such as the GDPR or the California Consumer Privacy Act, including the right to object to processing, the right to data portability, the right not to be treated differently for exercising your rights, and the right to complain to your local data protection authority.

To withdraw TwitterAPI.io's access to your Google account, remove it in your Google Account settings. Removing access does not delete the account you created with us; ask us if you want that deleted too.

• All connections to the website and the API are encrypted in transit with HTTPS.
• We never receive your Google password or your full card number; sign-in is handled by Google and card entry by Stripe.
• Our servers talk to each other over a private network, and access to production systems and customer data is limited to the operator of the service.
• Rate limits, bot checks and monitoring are in place to detect and stop abuse.

No system is perfectly secure. If we learn of a breach that affects your personal information we will tell you and the authorities as the law requires. Keep your API key secret; you can replace it in the dashboard if you think it has leaked.

We and our service providers process information in several countries, which may be outside the country where you live and may have different data protection rules. Where the law requires it, we rely on appropriate safeguards for those transfers, such as standard contractual clauses.

The service is for developers and businesses. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has created an account, write to us and we will delete it.

We may update this policy when the service or the law changes. We will change the date at the top of this page, and if a change is significant we will also tell account holders by email.

Questions about this policy or your information: hello@twitterapi.io.

See also our Terms of Service and Refund Policy.