Privacy Policy
Last updated: 2 August 2026
This policy covers two different kinds of data, and it's worth separating them up front:
- Your data — the account you create to use tweetroom. We are the controller for this.
- Data you collect through tweetroom — the public X profiles and email addresses returned by your scrapes. For that data you are the controller and we act as your processor.
1. Controller
APRYCO, LLC, a company registered in Delaware, United States. Privacy contact: team@jojapi.com.
2. Your account data
| What | Why | Lawful basis |
|---|---|---|
| Name, email, profile picture from Google | Create and authenticate your account | Performance of a contract |
| Billing identifiers and subscription status | Take payment, apply credits | Performance of a contract |
| Job history, credit ledger, usage counts | Show your dashboard, bill accurately, prevent abuse | Contract and legitimate interests |
| Server logs and error reports | Keep the service secure and working | Legitimate interests |
We ask Google only for your basic profile and email address. We never request access to your Gmail, Drive or contacts, and we don't store your Google password.
3. Data processed on your behalf
When you run a scrape, we retrieve publicly available X profile information for the accounts you target, and query third-party sources for associated email addresses. The results are stored against your account so you can view and export them.
We process this data only to provide the service to you, on your instructions. We do not sell it, and we do not use it to build marketing lists of our own.
A cached copy of handle-to-email lookups is retained at the platform level so the same handle is not re-queried against the upstream provider repeatedly. Your contact list, filters and exports remain private to your account.
4. Your obligations as controller
Because you determine who gets scraped and what happens next, the duties of a controller sit with you: establishing a lawful basis, issuing privacy notices to the people you contact where required, and responding to their access, objection and erasure requests. If someone asks you to delete their data, delete it from your contact list — and tell us if you need help.
5. Sub-processors
| Provider | Purpose |
|---|---|
| Cloudflare | Application hosting, CDN, database (D1) and job queue |
| Sign-in (OAuth) | |
| Stripe | Payment processing and subscription management |
| JoJ API | X profile and email-lookup data |
We never see or store your full card number — Stripe handles payment details directly.
6. International transfers
Our providers operate globally, so data may be processed outside your country. Where data leaves the EEA or UK, transfers rely on Standard Contractual Clauses or an adequacy decision.
7. Retention
- Account and billing records: while your account is open, then as tax law requires.
- Scrape results and contacts: until you delete them, or 30 days after your account is closed.
- Server logs: a rolling short window for security and debugging.
8. Your rights
Depending on where you live you may have the right to access, correct, delete, port or restrict the data we hold about you, and to object to processing based on legitimate interests. Email team@jojapi.comand we'll respond within one month. You can also complain to your local data-protection authority.
9. Cookies
We set a session cookie so you stay signed in, plus a small preference cookie that remembers how you last filtered your scrape list. Cloudflare may set cookies needed for security and routing. We do not run third-party advertising or cross-site tracking cookies, which is why you aren't asked to accept a consent banner.
10. Security
Traffic is encrypted in transit, data is encrypted at rest by our providers, access to production systems is restricted, and passwords are never handled by us because sign-in is delegated to Google. No system is perfectly secure; if a breach affects you we will notify you and the relevant authority as the law requires.
11. Changes
We'll post updates here and, for material changes, notify you by email before they take effect.