Security Approach

1. Posts go through X's official API

tweetloom doesn't log into your account with your password, doesn't mimic a browser, and doesn't use unofficial automation. You authorize your X account via OAuth; all posts go through X's official API with the permission you grant — the same path Hootsuite, Buffer, and TweetDeck have used for years.

You can revoke the authorization at any time from X settings or within tweetloom. You can also use it without ever connecting your X account: it copies the drafts, and you post them yourself.

2. Nothing is published without your approval

This isn't a setting — it's the product's design. loom watches your sources and drafts; the publishing decision always belongs to a human:

• Tweets, threads, replies, quotes — EVERY draft lands in the approval queue first.
• What you approve goes out in one tap, or you schedule it to your best time; loom posts the scheduled ones when the time comes — but you approved that content.
• Replies and quotes go out through X's official flow with your single tap (X already restricts automated replies to accounts you haven't engaged with — we made that rule part of the design).
• A "posts by itself" mode does NOT exist in the product surface — we don't take that risk on behalf of our users.

3. The brake is always yours

• Pause: with one click, pause for 1 hour or until the end of the day — scanning, generation, and loom's scheduled posts are held until the pause ends. The ones you scheduled manually are unaffected.
• Stop: you can turn loom off entirely; your data and what it learned stop, but aren't deleted.
• Posting hours: loom posts its scheduled content only within the time range you choose.
• Daily draft limit and daily credit budget: you cap the generation volume, and loom can't exceed it.

4. No black box: the decision log

For every draft, the panel shows step by step which source it started from, what it remembered from its memory, which score it gave and why, whether it tripped the safety gate, and how it made the posting decision. If you connect Telegram, drafts land in your pocket with their content — nothing happens without your knowledge.

5. Your data

Your styles, drafts, and learned preferences are tied only to your account; they're protected by row-level access control (RLS) and are NOT used to generate content for other users. Apart from anonymous, structural statistics (e.g. 'short opening sentences get approved more'), none of your content is shared.

You can delete your account yourself from settings — your content data is fully erased. For details, see the privacy policy: tweetloom.com/en/privacy

6. Aligned with X's rules — a principled choice, not a workaround

tweetloom exists to add better content to X: tweets worth reading, replies that contribute to real conversation. That's why the product treats X's automation rules as a design input, not a boundary to skirt:

• No action that touches other accounts (replies, quotes) is ever posted automatically — it always goes out with your approval, with one tap.
• Engagement pods, automated DMs, follower inflation, mass follow/unfollow: these do NOT exist in the product and won't be added.
• Daily production caps are human-scale and built into the product — there is no setting that reaches spam tempo, even on the highest plan.
• The goal is not to game the algorithm: the algorithm-fit score exists to STRIP the patterns X explicitly discourages (clickbait, engagement bait, hashtag stuffing) out of your content.

Our founder runs the product on his own X account, under the same rules and the same limits as everyone else. This product only stays valuable while X stays healthy — our incentive points the same way as the platform's.

7. The same principle on the money side: no surprises

• The trial is card-free — since we never have your card details, a silent charge at the end of the trial is technically impossible.
• Cancelling is always one click; your access continues until the end of the period.
• If you delete your account, your subscription is cancelled automatically — deletion won't complete until the cancellation is confirmed; 'I deleted my account but kept getting charged' structurally cannot happen.
• Credit numbers aren't inflated: 1 credit = 1 tweet. There's a 14-day money-back guarantee (tweetloom.com/en/refunds).
• We never see your card details — payments are processed by an independent payment provider.