Privacy Policy
Effective 2026-09-18
follow.show reads public X data with your permission, classifies it with an automated model and shows you the result. This policy explains what we store, on what legal basis, for how long, and what rights you have under the GDPR.
1. Controller
The data controller is TrzaskIT Patryk Trzaska, ul. Mikołaja Kopernika 38a lok. 12, 05-091 Ząbki, Poland, NIP 1251813020, REGON 545327816. Contact for all privacy matters: [email protected].
2. What we process and why
2.1 Your account (you, the signed-in user)
| Data | Purpose | Legal basis |
|---|---|---|
| X user id, handle, display name, avatar, e-mail address (if X shares it) | Creating and identifying your account, signing you in | Contract (Art. 6(1)(b) GDPR) |
| X OAuth access and refresh tokens (encrypted at rest) | Fetching your followers and following on your behalf, read-only | Contract |
| Analysis runs, aggregates, saved segments, share cards | Providing the dashboard and the reports you asked for | Contract |
| Plan, Stripe customer and subscription ids, subscription status | Billing paid plans; we never store card numbers | Contract, legal obligation (accounting) |
| Audit log (sign-in, connect/disconnect, deletions, plan changes) with timestamps | Security, abuse prevention, proving what happened to your data | Legitimate interest (Art. 6(1)(f)) |
| Server logs with IP address, user agent and request ids (short-lived) | Operating and securing the service, rate limiting | Legitimate interest |
2.2 Accounts in your network (third parties)
To build your report we fetch the public profile of each account that follows you or that you follow: X user id, handle, display name, bio, website, location, avatar URL, follower and following counts, verification flag, and whether the account follows you or is followed by you. We do not read posts, likes, direct messages or anything not visible on a public profile.
From the bio, name, website and location we derive a probabilistic classification (account type, industry, roles, topics, each with a confidence score). This is automated processing, but it is not used to make decisions with legal or similarly significant effects on anyone; it only helps you understand the composition of your audience.
Legal basis: our legitimate interest, and yours, in understanding the audience of an account you own (Art. 6(1)(f) GDPR). We minimise the data (only public profile fields), restrict it to your own network, show third-party profiles only to you, and never publish lists of people. Share cards contain aggregate percentages only.
Profile data and classifications are stored once per X account and reused across analyses so that the same profile is not re-fetched and re-classified needlessly.
3. Where the data goes (processors)
| Provider | Role | Location |
|---|---|---|
| OVH | Hosting of the application and database | EU (France/Poland) |
| Cloudflare | DNS, TLS and DDoS protection in front of the site | Global edge; EU data-processing terms |
| X Corp | Source of profile and follow data via the X API; OAuth sign-in | USA (EU–US Data Privacy Framework / SCCs) |
| OpenRouter / TypeSafe (Jev model) | Classification: receives name, handle, bio, website domain and location of a profile and returns category probabilities; no account data of yours is sent | USA (SCCs) |
| Stripe | Payments and subscriptions; receives your e-mail and payment details directly | USA/EU (Stripe Payments Europe; SCCs) |
We do not sell personal data and do not use it for advertising. There are no third-party analytics or tracking scripts on the site.
4. Cookies and local storage
- Session cookies (strictly necessary): keep you signed in. They expire when the session ends or you sign out.
- Theme preference (local storage): remembers light or dark mode.
- Cloudflare may set a technical cookie for bot protection. Stripe sets its own cookies on the checkout page under its policy.
No consent banner is needed because we use no optional cookies.
5. Retention
- Your account and analyses: until you delete them or your account. Deleting your account removes your profile, tokens, analyses, memberships, segments and share cards; audit entries are anonymised (the link to your account is removed).
- OAuth tokens: deleted immediately when you disconnect X or delete your account.
- Third-party profile data: kept as a shared cache so that repeat analyses do not re-fetch and re-classify the same public profile; deleted on request (section 6).
- Server logs: rotated automatically by size, typically covering days to a few weeks.
- Billing records: as long as required by Polish accounting and tax law (currently 5 years from the end of the tax year).
- Database backups: encrypted, kept for at most 90 days.
6. Your rights
Under the GDPR you can:
- access the data we hold about you and receive a copy (portability);
- correct inaccurate data;
- delete your data, available self-service in Settings (delete analysis, disconnect X, delete account);
- restrict or object to processing based on legitimate interest;
- lodge a complaint with a supervisory authority: in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority of the EU country where you live.
If you are not a user but your X account appears in someone’s analysis, you can object to the processing of your public profile data or ask for its removal by e-mailing [email protected] with your X handle. We respond within 30 days.
7. Security
Traffic is encrypted with TLS. OAuth tokens are encrypted at rest with a key held outside the database. Access is read-only against X. The database and job queue are not reachable from the internet. Backups are encrypted before leaving the server. To report a vulnerability, e-mail [email protected].
8. Children
The service is not directed at children under 16 and we do not knowingly process their data.
9. Changes
We will announce material changes in the app or by e-mail before they take effect. The effective date at the top of this page tells you which version applies. See also the Terms of Service.