Privacy Policy | Chirpie

Chirpie ("we", "our", "us") is operated by Fireflo LLC. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at chirpie.ai and our API, CLI, MCP server, and SDK (collectively, the "Service").

1. Information We Collect

Account Information

When you create an account, we collect your name, email address, and password (hashed, never stored in plaintext).

Social Media Account Data

When you connect a social media account (X, Bluesky, LinkedIn, Threads, Mastodon, Instagram, Facebook, Telegram, Pinterest, TikTok, YouTube, or Google Business Profile), we store your platform user ID, username, display name, and profile image URL. We store OAuth access and refresh tokens encrypted with AES-256-GCM. We do not read your timeline, direct messages, or followers list.

Content You Create

We store the text of posts and threads you create through the Service, along with scheduling metadata and publishing status.

Usage Data

We track monthly aggregate usage (post counts, API call counts) for billing and rate limiting purposes. We collect standard web analytics (page views, referrer) via privacy-friendly, cookie-free analytics.

Payment Information

Payment processing is handled by Stripe. We store your Stripe customer ID and subscription ID but never store credit card numbers, CVVs, or full payment details on our servers.

2. How We Use Your Information

To provide the Service: posting content to social media platforms on your behalf
To manage your account, subscriptions, and billing
To send transactional emails (verification, password reset, welcome)
To send occasional product emails: onboarding tips, usage notices, and product updates. Every one of these includes an unsubscribe link, and unsubscribing does not affect the transactional emails above.
To enforce usage limits per your subscription plan
To monitor and improve the reliability and security of the Service
To comply with legal obligations

3. How We Share Your Information

We do not sell your personal information. We share data only with:

Connected social media platforms: to post content on your behalf, via their APIs using your authorized credentials
Stripe: to process payments
Resend: to send transactional emails
Loops: to send product emails and manage your email preferences
Sentry: to capture error reports for debugging (no personal content is sent)
Vercel: our hosting provider
Neon: our database provider

4. Requests from Public Authorities

Governments, law enforcement agencies, and other public authorities sometimes ask companies for data about the people who use them. This is how Fireflo LLC handles those requests.

We check that the request is lawful. We review every request from a government, law enforcement agency, or other public authority for legal validity before we respond. We require valid legal process: a subpoena, court order, or warrant, or the equivalent instrument under the law of the jurisdiction making the request.
We push back when it is not. If we believe a request is unlawful, overbroad, or otherwise deficient, we challenge it or ask for it to be narrowed, and we do not disclose data while that is unresolved unless the law compels us to.
We disclose the minimum. We provide only the specific data the request lawfully requires, and nothing beyond it.
We keep a record. We log every request we receive, what we disclosed in response, and the legal reasoning behind the decision.
We tell you when we can. We notify the affected customer before disclosing their data where the law permits it and the request does not prohibit it. Where we are barred from telling you, we notify you once that prohibition lifts. The one exception is an emergency involving a risk of death or serious physical injury, where we may respond without notifying you first.

What we hold is limited. It is your account email address, encrypted access tokens for the social accounts you connected, the content of the posts you chose to publish through the Service, and your usage records. We do not hold your passwords for those social platforms, and we do not hold your messages on them.

Send requests to legal@chirpie.ai. We do not accept requests by phone.

5. Data Security

We implement industry-standard security measures including: encrypted OAuth token storage (AES-256-GCM), SHA-256 hashed API keys, HTTPS-only communication, and database encryption at rest.

6. Data Retention

We retain your account data for as long as your account is active. Post content and analytics are retained per your plan tier. You can delete your account yourself at any time from the dashboard: open Billing, then Delete account. Deletion is immediate and permanent. It removes your profile, your connected social accounts and their stored access tokens, your posts and their analytics, your API keys, your usage records, and any developer app credentials you have saved, and it cancels any active subscription. Billing records held by our payment processor are kept as long as the law requires. You can also request deletion by emailing privacy@chirpie.ai.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request deletion of your data
Export your data in a portable format
Object to or restrict processing of your data

You can export your data and delete your account yourself from the dashboard, under Billing. For any other request, contact us at privacy@chirpie.ai.

8. Cookies

We use essential session cookies for authentication only. We do not use advertising cookies or third-party tracking cookies.

9. Children's Privacy

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact

For questions about this Privacy Policy, contact us at:
Fireflo LLC, privacy@chirpie.ai