Privacy and data
What the extension sends, where it goes, what is stored and how to export or delete it. The Privacy Policy is the formal statement; this page explains it in plain terms.
When anything is sent
Until you connect the extension to your account and agree to the drafting consent, it sends no content from X to Starling. Once connected, it also checks your session and plan so it can show your remaining drafts.
What is sent
| Data | When | Why |
|---|---|---|
| The post you ask about | When you press ✦, Create or Enhance, or attach a post in chat | To draft a relevant reply, quote or post |
| Text in the composer | When you choose Create or Enhance | To rewrite or build on what you wrote |
| Attached images, as small copies | When the post or your draft has images | So drafts can take the images into account |
| Your messages in the panel | When you send a message | To answer you |
| Writing samples, including posts of your own you add from your X profile | When you add them | To match your voice |
| The subjects you write about, as short topic names | When you ask for a post idea, and in the background on paid plans | To suggest what is new in your niche. Never the text of your posts, samples, messages or drafts |
| Draft outcomes: whether you used, edited or discarded a draft | After a draft is placed | To improve later drafts |
| Your own profile and post stats | While you browse X, only if you turned on the optional learning choice | To learn what works for your account |
| Account and technical details: email address, browser name you approved, extension version, time zone | When you sign up, connect and use Starling | To run your account, apply your plan and show times correctly |
Where it goes
- Starling's servers, operated by the company named in the Privacy Policy. They store your account and the data needed to draft for you, with each account's drafting data kept in its own isolated storage area.
- Starling's AI provider, which processes requests to generate drafts and answers. The current provider is listed on the Subprocessors page.
- Stripe, if you subscribe. Stripe collects your card details directly, so card numbers never reach Starling.
Starling does not sell your data and does not show ads.
What is not sent
- Your direct messages. Starling does not run on direct messages.
- Your X password. Starling never asks for it.
- Other people's posts you scroll past without asking about them.
- Anything from websites other than X. The extension only works on X.
What is stored
- Your account: email address, a salted hash of your password, your plan and billing status, and your connected browsers.
- Your writing samples, confirmed preferences, draft outcomes and, if you turned it on, your own profile and post stats.
- Usage records: when requests happened, whether they succeeded and how much of your allowance they used. They do not contain the text of your messages or drafts.
- A finished draft is kept for 15 minutes, so the extension can recover it if the connection drops.
Service logs never contain your messages, drafts, passwords or tokens. How long each kind of data is kept is set out in the Privacy Policy.
Your choices
- Change or withdraw your consent in the extension at any time, and on the writing page for what you send from there.
- Remove writing samples from the panel.
- Disconnect a browser from Devices. Removing the extension from Chrome also stops it sending anything.
- Download a copy of your data, or delete your account, from Your data.
Deleting your account
Deleting your account disconnects every browser, cancels your subscription at once so that you are not billed again, and deletes your writing samples, preferences, draft outcomes and stats from the live service. Encrypted backup copies are not edited: they disappear as the backups age out, within about three months. The part of a paid period you have not used is not refunded when you delete your account, unless the Refund policy says otherwise, so cancel first if you want to keep your plan to the end of the period. Some billing records have to be kept for legal and tax reasons; the Privacy Policy explains which ones and for how long.
Security
- The extension connects with a device token that you can revoke at any time. Resetting your password disconnects every browser.
- Traffic between the extension, the website and Starling's servers is encrypted with HTTPS.
- Found a security problem? Read security.txt or contact us.