Privacy policy

Sift imports the posts you have bookmarked on X, sorts them into categories, and emails you a digest. This page describes the data that involves: what is stored, where it goes, how long it stays, and what removes it.

Sift is an independent product. It is not affiliated with, sponsored by or endorsed by X Corp. X appears here only as the source of the content and as the identity provider you choose to connect. Post content stays subject to X's own terms and to the rights of the people who wrote it.

Three separate things, and it is worth keeping them apart: your account, the post content your bookmarks point at, and what we generated from that content.

Post content and author profiles live in a store shared across all users, keyed by X's own ids. Two people who bookmark the same post point at one copy of it. That is both a cost decision — we never pay X twice for the same post — and the reason the deletion section below is careful about what deleting your account does and does not remove.

• No password. Connecting runs X's OAuth 2.0 authorization flow with PKCE. Your credentials go to x.com and never reach this app.
• No location data. X's policy forbids storing or aggregating location information separately from the post it belongs to, so we do not extract it at all. The database has no place, latitude or longitude columns to fill in, and there is no map feature planned.
• No write access. The permissions we request are read-only — tweet.read, users.read, bookmark.read and offline.access for token refresh. Nothing on the connection can post, reply, like, follow, unfollow or send a message.
• No wider account access. We do not read your direct messages, your followers or following lists, your likes, your drafts or your private lists. Only the bookmarks you saved, and the profiles of the people who wrote them.
• No enrichment and no matching. We do not buy data about you, and we do not try to connect your X identity to any off-X identifier. The only account we ever handle is the one you connected yourself.
• No advertising or analytics trackers. The app sets two kinds of cookie: a signed, http-only session cookie that lasts 30 days, and two short-lived cookies that carry the OAuth handshake and expire after ten minutes. There is no analytics script, no advertising pixel and no third-party tag on any page.

Post content: only for as long as it exists on X. This is the commitment that shapes the most code. Every night we ask X's batch compliance endpoint which of the posts we hold have been deleted, withheld or suspended, and we act on the answer within 24 hours — before the next digest is generated, so a post that has gone from X cannot arrive in your inbox afterwards.

What is left in your library is a tombstone: the entry stays, marked as no longer available on X, with the content removed. A bookmark you remember saving should not vanish without explanation, and X's requirement is that the content go, not that the record of your having saved something be hidden from you.

Two services outside our own infrastructure receive post text. Both are named here because you cannot consent to something you have not been told, and because X's redistribution rules make this the part of the design most worth being precise about.

Nothing else. Your bookmarks are not sold, not shared with advertisers, not used to train our own models, and not shown to other users. There is no public profile, no shared collection and no feature that exposes one person's library to another.

Our reading of X's policy is that a processor operating on post content under contract, on our instruction, is not a third-party recipient in the sense the redistribution rules mean — the same reasoning that allows the content to sit on a managed database at all. We think that is right, and it is an interpretation rather than something the policy states outright, which is why it is written down here instead of assumed.

Several things this document promises are obligations we inherited from X's Developer Policy rather than choices we made. Knowing which is which tells you how likely they are to change.

• Deletion within 24 hours. Anyone storing X content offline must keep it current with X and remove what has been deleted there.
• Export capped at 500 posts per person per day, and only as a download you request — not an automated feed. This is X's number, not ours.
• Generated text kept visually separate from post content. Categories, tags and summaries are ours; presenting them inside a post would be altering the post, which the display rules forbid.
• Attribution and a link back to the canonical post on x.com, everywhere a bookmark is displayed, including in the email.
• No implied affiliation with X. Hence the absence of X's logo anywhere in our branding.

• OAuth tokens are encrypted before they are written to the database. A refresh token rotates when it is used, and the previous one stops working.
• The session cookie is http-only, same-site, signed with HMAC-SHA256, and marked secure whenever the app is served over HTTPS. It carries a signed user id and an expiry — not a token, and nothing readable by a script in your browser.
• Requested permissions are the minimum the product needs. Read-only scopes are both cheaper for us and a smaller thing to ask you to approve.
• Every X API call is logged with its cost, and per-user and global spending limits stop runaway usage. That is a financial control, but it doubles as an early signal that something is reading more than it should.
• No security posture is a guarantee. If data we hold is exposed, the operator's notification duties are one of the open items at the end of this page — a promise about timing is exactly the kind of thing that should be written by someone qualified to make it.

• Take it with you. Pro can download a CSV of up to 500 posts per day — post id, canonical link, author, dates, post text, and the category, tags and summary in ai_ prefixed columns.
• Turn the email off without disconnecting anything, from Settings. The library keeps working.
• Revoke us at X from your X account settings at any time. Syncing stops immediately; what we already hold stays until you delete your account.
• Delete everything. One button in Settings, described precisely in the next section.

Deleting your account revokes our access token at X first, then removes, in a single transaction: your bookmark list, the categories, tags and summaries generated for you, your sync state, your digest history, your export counts, your subscription record, your stored tokens and your user row.

Two things survive, and it would be dishonest to imply otherwise:

• The shared post and author cache. Post rows and author profiles are not your data — other people have bookmarked the same posts, and deleting the rows would break their libraries and make us pay X again for identical content. Deleting your account removes the link between you and those posts, which is the part that was ever about you.
• The metered API usage log, kept with your user id set to null. It is the record of money already spent at X and has to reconcile against X's own billing. Once the id is removed it no longer identifies you.

There is no support ticket to raise, no waiting period and no "deactivated" state that quietly keeps everything in case you come back.

X changes its API pricing and its policy, and both are explicitly subject to change on their side. When something in this document stops being true, the honest fix is to change the document and date it, not to leave text that describes a version of the product that no longer exists.

The caps and prices quoted anywhere on this site are read from the same configuration the software enforces, so the pricing section and the terms cannot describe limits the app does not apply. That is a property of how the pages are built, not a policy promise.