Your writing. Your data.

Information we collect

bangers & bash is not for anyone under 18. We delete an account we learn belongs to a minor. We use your birth month and year to check eligibility. We do not collect your birth day or an identity document.

Starting your account. Email sign-in verifies your address. New verified accounts receive a welcome email when delivery capacity is available. We keep the versions and time of your Terms acknowledgment and Privacy notice review, and your birth month and year, with the eligibility-check version and server-recorded time, separately from optional permissions. Your data export includes this record, and account removal erases it. Accounts with preserved early access can upload their own X analytics files without connecting X. The account you name for these files is unverified; uploaded measurements are labeled separately from live tracking.

Account and writing. When you sign in, we save your email, sign-in session, drafts, notes, planned posts and workspace preferences. Images you upload and their descriptions are stored privately for your account. In a local workspace, writing stays in that browser unless you choose to import it into a signed-in account. Settings shows which mode you are using.

X analytics. If you connect X and enable collection, we save your profile details, post text and timestamps, and the reach and interaction counts X returns. Where available, we also save daily follower, following and post totals. We do not collect your full follower list.

Requests and feedback. For early-access requests, we save your name, email, X handle, approximate follower count, X Premium answer, reason for joining, any optional posting details, consent and request time. Enterprise inquiries save your email, optional company name and message. We use these details to review requests and respond. In-app feedback includes your message, account, page and app version. Drafts and screenshots are not attached automatically.

Optional product questions. If you separately allow product questions in Daybreak, we save your selected answer and the permission version and time to help choose what to build. This does not allow analytics, follow-up email or a new source connection. Answers have a 90-day retention target with hourly cleanup. Turn this permission off to remove its answers and cards; the control stays reachable in Your data if Daybreak is off. Your export includes these answers and account removal erases them.

Product activity. For signed-in accounts, we record one workspace visit per UTC day and whether the first imported insight was displayed. These counts help us measure activation and retention. They do not include page URLs, writing, prompts or post metrics.

Optional draft learning. For enabled founder accounts, we record draft starts and saved revisions, suggestion use, confirmed publications, and measured outcomes. These events include length, selected tags, feature flags and estimates, but no draft text. They link to the published post when available. You can turn this off in Settings → Export.

Research you paste. If you choose to extract research cards, the selected text is sent to Claude once. We save only the resulting cards, their exact source excerpts and the tool you named, separately from measured X analytics. Cards are labeled unverified and scheduled for deletion after 14 days. We do not save the full paste.

Prompt library. We count prompt views and copies to protect the library.

How we use your data

We use your data to run bangers & bash for you: measuring your posts, estimating how your drafts may land, and preparing the insights and suggestions you see.

We never sell your data, and we never use it to target ads.

Your posts power your own account. They’re used for your measurements, estimates and suggestions, not to build anything for other accounts, and they are never used to train an outside company's AI model.

Connecting and posting to X

You authorize access on X; we never ask for your X password. Read access lets us verify your profile and collect available analytics. Ongoing access lets enabled checks continue between visits. Your X subscription type is used to check long-post eligibility. Connection tokens are encrypted in storage.

Publishing requires additional permission. When you choose to publish, the reviewed text, selected image and image description are sent to X. If scheduling is available for your account and you confirm a schedule, we store the content, delivery window, timezone and timing preference so it can run while your browser is closed. Drafts and unconfirmed plans do not send themselves.

We save publication attempts and confirmations to show delivery status and help prevent duplicate posts. Profile pictures load from X’s image service. Visiting X is subject to X’s own privacy policy.

Services we use

We use service providers to run the workspace, deliver sign-in codes and support the features you choose.

Cloudflare

Hosts the connected workspace, stores account and workspace records in D1, and stores uploaded images in private R2 storage. Our public marketing site uses Cloudflare Web Analytics for page visits and performance, without cookies or browser storage. This beacon is not loaded in the app.

PostHog

Only with your separate analytics permission in Settings, receives setup milestones and their times with a private random identifier called a BangerID. It does not receive your email, X handle, posts, drafts, prompts or survey answers. Client IP addresses are discarded before events are stored; session recording and automatic interaction capture are off. Our current paid plan provides a seven-year event query window. This window does not guarantee automatic deletion. Account removal queues a separate provider-erasure request using only your BangerID; an operator verifies its completion. The request is kept until completion, then its receipt is removed after 30 days.

Resend

Receives your email address to deliver sign-in codes, a welcome email, a copy of the Terms and Privacy notice if you ask for one, and the emails you turn on: breakout alerts, weekly briefs and schedule check-ins.

Anthropic

Intelligence sends your request and relevant stored X posts to Claude for answers and rewrites. When enabled, post tagging and weekly briefs also use stored posts and their available measurements. An optional research extraction sends the text you paste. We do not send your email or X access token. AI requests are bounded and metered per account. Anthropic says its asynchronous Batch API may keep batch inputs and results for up to 29 days.

X

Handles account authorization, supplies permitted analytics and receives posts you authorize for publication.

Stripe

Handles checkout and subscription management when available. It receives your email and billing identifiers, not drafts. Card details are entered on Stripe and are not stored by this app.

Errors. When something breaks, we record where it happened (a page or feature), the type of error and when, so we can fix it. We collect only a page category and error type, never the error message, your posts, drafts or what you typed. Signed-in failure counts use your private BangerID and are kept for 90 days; reports hide small groups. A grouped issue expires after 90 days without another occurrence. This stays in our own database and is not shared with an analytics company.

Our hosting services also process technical request information to deliver and protect the site. We use operational logs and usage counts to diagnose errors and manage service limits.

Cookies and device storage

Sign-in uses a session cookie. Browser storage keeps appearance and window preferences, local writing, and recovery copies of unfinished work. Signed-in notes save automatically; unfinished Compose text can remain on your device until you save it to your account.

Clearing browser storage removes local writing and recovery copies. It does not delete a server account. Export anything you want to keep first.

The homepage launch film may play from YouTube in its privacy-enhanced mode. Nothing loads from YouTube until you press play; after that, YouTube handles the playback under its own privacy policy.

Contact forms use a daily changing, protected network identifier to limit repeated requests. The form does not store your raw IP address in its records.

How long data is kept

Scheduled cleanup removes older records from the active database in batches, so removal may finish after the retention period stated below.

• Pasted research cards: saved cards and exact source excerpts expire after 14 days; scheduled cleanup removes them in bounded batches. The full pasted text is not stored.
• Draft learning events: raw metadata events are scheduled for deletion after 90 days. Turning the setting off stops new events; existing events age out.
• Collected X posts, profile details and analytics: kept in the active database while your X connection remains active, until you disconnect or request account removal. Tracking a post stops within seven days; that does not delete its stored data.
• Daily account counts: scheduled for deletion after 90 days.
• X API cost estimates: call-level records are scheduled for deletion after 90 days. They record operation and estimated cost, not post content or X’s invoice.
• AI usage estimates: call-level records keep model, token counts and estimated cost, not prompts or answers. They are scheduled for deletion after 90 days.
• Product activity: daily visits and setup milestones use a random BangerID, never your email, name, handle or X identifier. They contain counts and times, never post text, prompts or answers. In our database, records are kept for 13 months, then only totals remain. A flag with no timestamp prevents the same setup milestone from being counted again while your account exists. Account removal deletes the private mapping, so remaining analytics cannot be linked back to your account. Access to that mapping is limited to audited administrator lookups. Reports hide counts for small groups.
• Generated writing versions and Second Wave drafts: scheduled for removal after 30 days. Minimal request records remain with your account to prevent repeat charges and are erased on account removal.
• Writing and images: kept until you remove them or request account removal. Images still attached to saved writing or an unresolved publication must be detached or resolved before removal.
• Account records, inquiries, feedback and publication receipts: these do not currently have an automatic expiry. Contact us to request removal. Disconnecting X keeps publication receipts to help prevent duplicate sends.

Deleting active records does not immediately erase recovery backups. Older copies may remain for up to 30 days, the hosting provider’s recovery window; deletions are reapplied if a backup is ever restored.

The optional creator survey

Once it’s available in your account, Settings, under About you, lets you answer a short survey about how you think and write, so suggestions fit you as well as your numbers. Every question is optional, and skipping one is recorded as a skip, nothing more.

We store your answers, which question version they answered and when. They are private to your account. Three uses are each off until you turn them on: tailoring Intelligence suggestions, improving bangers & bash (research summaries never include your name or handle), and emailing you about your answers. Your answers are treated as your own statements, never as instructions to publish anything.

Your off-limits list (topics, words or claims you never want written, suggested or shown) works differently: it applies everywhere as soon as you set it, needs no consent because it only ever removes things, and stays until you change it in Settings, even if you delete your survey answers.

With tailoring on, Intelligence reads your answers next to your posts to fit its tone and suggestions. They are treated as your own descriptions, never as facts about how posts perform. If you cancel, we may ask what could have worked better; answering is optional, happens after the cancellation is done, and never changes it.

Each optional survey use records its notice version, permission time and withdrawal. Older preferences without current version evidence require a new choice. You can edit any answer, turn each use off, or delete all your answers at once in Settings. Answers are included in your export and removed when your account is deleted.

Posts removed from X

When X confirms that a post was removed, we erase its stored text, media references and measurements, and remove it from reports, Intelligence context and exports. We keep only its post ID, account owner and removal time to prevent it from being imported again. That record is erased when you remove your account. Detection uses existing collection checks, so removal may not appear immediately.

Your choices and requests

Export. In Settings, export saved writing, collected post measurements and available account snapshots. The complete account download also includes your survey answers, consent history, billing records and private service records. Credentials are never included; oversized exports are handled through support instead of returning an incomplete file. Image references are included, but image files are not; keep your original files separately.

Disconnect X. Settings lets you stop collection and remove stored access tokens, X profile details, collected posts and account snapshots from the active database. Pending schedules that have not begun sending are canceled. Your writing, image library and publication receipts remain in your account. Disconnecting does not delete posts already published on X. If X cannot confirm revocation, remove the app in your X account settings too.

Delete or correct information. You can edit or remove writing in the workspace. Whole-account deletion is available in Settings → Account. Disconnect X, export anything you want to keep and refund unused purchased credits first. Removal stops renewals and waits for active work, billing, refunds and disputes to settle. Uploaded account files are removed; already published X posts stay on X. Provider copies follow their retention and removal processes. Email privacy@arclabshq.com for account, image or inquiry removal, a correction, or a privacy question. Include the email associated with your account or request so we can verify it belongs to you.

We will update the date above when this notice changes. For help using the product, visit Support.

Who’s responsible

bangers & bash is built and run by Arc Labs LLC, an American company in North Carolina. Alex Reeder, the founder, answers for how your data is handled. Email privacy@arclabshq.com and a person reads it.

What we never do on X. We never post, reply or DM without you, and we don’t run auto-DMs, follow loops or engagement pods. Scheduled posts only send after you confirm them.

How your access is protected. X connection tokens are encrypted in storage, we never ask for your X password, and every account’s data is kept separate from every other account’s.