MakD.in uses the X API only to publish posts a business owner has approved to the owner’s own account and to read the public metrics of those posts. Our use complies with the X Developer Agreement and Policy and the X Automation Rules. This page is the detailed disclosure referred to in our privacy policy.
Permissions we request
| Scope | What we do with it |
|---|---|
users.read | Identify the account that connects (ID, name, handle, picture). |
tweet.write, media.write | Publish the posts and images you approve to your own account. |
tweet.read | Read the public metrics (impressions, likes, reposts, replies) of posts we published, for your report. |
offline.access | Receive a refresh token so scheduled posts can go out without you signing in again. |
What we store
- Account ID, name, handle and profile picture URL.
- Encrypted OAuth 2.0 access and refresh tokens, used only by the publishing worker.
- The ID and URL of each post we publish and its public metrics.
We do not store timelines, followers, direct messages or any content from other accounts. X content is shown only to the organisation that owns the account and is never sold, shared or used to train AI models.
Automation rules we follow
- Every post is approved by the account owner, or published by their explicitly enabled autopilot for their own account only.
- No automated likes, reposts, replies, follows, unfollows or direct messages.
- No duplicate or near-duplicate posting across accounts; each organisation’s content is generated for that organisation.
- Posting volume is limited to the owner’s calendar, far below X rate limits, and stops immediately when a token is revoked.
- Content is subject to our acceptable-use rules, which prohibit spam, deception and unlawful content.
Retention and revocation
- In MakD.in: Social accounts → Disconnect revokes and deletes the token at once and cancels queued posts.
- On X: Settings → Connected apps lists MakD.in; revoking it invalidates our token.
- Account records are purged 30 days after disconnection or organisation deletion; metrics are deleted with the organisation.
Use case submitted to X
MakD.in is a marketing automation tool for small businesses. A business owner connects their own X account, reviews AI-drafted posts (text and image) in a calendar, and we publish each approved post at its scheduled time using POST /2/tweets and the media upload endpoint. We then read the public metrics of only those posts (GET /2/tweets with public_metrics) to show a simple performance report. Each business publishes a handful of posts per week. We do not read timelines, search, or any content from other users; we do not like, repost, reply, follow or send direct messages; and we do not post identical content to multiple accounts. We follow the X Automation Rules and Developer Agreement. Tokens are encrypted and deleted when the account is disconnected.
Questions: privacy@makd.in. See also our terms of service and data deletion page.