Privacy Policy
Effective 6 September 2026 · updated 25 September 2026
Legate (legate.social) is a campaign drafting studio for X content. This policy explains what information we handle when you use it, and why. The short version: we store what you create so the product works, we send content to an AI provider only when you ask for an AI feature, and we do not sell data, run ads, or train models on your content.
Information we collect
- Billing records. On a paid plan we keep your plan, subscription status, credit balances and a usage log of what each space spent. Card and address details go to Stripe and never touch Legate.
- Account details. When you sign in with Google we receive your name, email address and profile picture; with an emailed sign-in link, just the email address. We use these to create your account and show who did what inside a shared space. If you try to sign up with Google while sign-up is closed, we keep your email address on a waiting list to tell you when a place opens; ask and we remove it.
- How you found us. On your first visit we note the campaign tags in the link you followed (such as utm_source), the site that sent you (its name only, never the page), and the page you arrived on, in a cookie on this site. If you then sign up, we keep them with your account to learn which campaigns bring people. We don't use them for anything else or share them.
- Your content. Campaigns, drafts, notes, documents, saved posts, canvas items, comments and uploads you add to a space. This is the product - we store it so you and your space members can use it.
- X account connections. If you connect an X account, we store the access tokens X issues, encrypted at rest. We use them only to publish or schedule posts when you tell us to and, on a paid plan, to read that account's own posts for Research when you ask for a refresh. You can revoke access at any time from your X settings.
- AI provider keys. AI features run on a key you supply for your chosen provider or, on a paid plan, on a key Legate manages for your space. We store keys encrypted at rest and use them only to make the requests you initiate.
- Visit counts. On the public pages (the home page and sign-in), Vercel Web Analytics counts visits: the page, the site that linked to it, the country and the kind of device. It sets no cookie and doesn't identify you, and it doesn't run inside the app.
- Error reports. If something breaks, our error monitoring (Sentry) records the technical failure. It is configured not to include personal information.
What we do not do
- We do not sell or rent your information to anyone.
- We do not show ads or use advertising or cross-site tracking cookies.
- We do not use your content to train AI models, and we do not permit our providers to.
AI features
When you use an AI feature (generating drafts, rewriting, chatting with a canvas node), the relevant content - the drafts, notes and voice context involved - is sent to an AI provider and is subject to that provider's terms. On the Free plan that is the provider you configured with your own key. On a paid plan it is OpenRouter, through a key Legate manages for your space, unless you connect your own key instead. Nothing is sent to any AI provider unless you trigger a feature.
Fetching public content
When you save an X post to a swipe file or paste a link onto the canvas, our server fetches the publicly available page or X's public embed data and caches the result (text, preview, images) in your space so the card keeps rendering.
On a paid plan, Research reads the public posts and profile figures of the accounts you choose to track through X's API, using Legate's developer app, and stores them in your space. Your own connected account's posts are read with the access you granted when you connected it. Nothing is read until someone in your space asks for a refresh, apart from the weekly profile snapshot if a manager turns it on.
Service providers
We run on a small set of infrastructure providers that process data on our behalf:
- Vercel - application hosting, file storage and visit counts on the public pages
- Neon - database hosting
- Google - sign-in
- Resend - email: invitations, review requests, comment notifications and sign-in links
- Sentry - error monitoring (errors only)
- Stripe - payments and billing; card and address details go to Stripe and never touch Legate
- X Corp - when you connect an X account, publish, or track accounts for research
- OpenRouter - AI on paid plans, through a key we manage for your space
- Your chosen AI provider - when you use an AI feature with your own key
Cookies
We use cookies only to keep you signed in. There are no advertising or third-party analytics cookies.
Sharing inside and outside your space
Content in a space is visible to that space's members according to their role. If you create a share link for a draft or article, anyone with that link can view it (and comment, where enabled) without an account - treat share links accordingly.
Security
Connections use TLS. Secrets we hold for you - X tokens and AI keys - are encrypted at rest with AES-256-GCM. Access to space data is enforced by role on every request.
Retention and deletion
We keep your content while your account is active. Deleting a card, campaign or space removes it from the product. To delete your account and all associated data, email us and we will action it.
Changes
If this policy changes in a way that matters, we will note it on this page with a new effective date.
Contact
Questions or deletion requests: contact@legate.social