GrowX privacy policy

Effective date: 13 October 2026. Applies to GrowX version 0.1.0 and its hosted workspace and Chrome extension.

Who provides GrowX

Flyin Media LLC provides GrowX, a private beta research and writing workspace controlled by one owner. The owner and invited teammates use individual credentials in one shared workspace. Sources, lists, drafts, voice settings, and connected-account tools are shared; there are no private per-list permissions or public signup. Contact sebastian@flyinmedia.com for privacy, access, deletion, or support requests. This policy is available without signing in at the public privacy page.

Optional local demo

The unpaired extension offers Try local demo without login or a pairing code. Its drafts, sources, named lists, captures, settings, revision history, and recovery edits stay in a separate local browser-storage namespace on this device. Demo actions do not send requests to the GrowX backend or providers and do not access real account data. AI, X discovery, account connections, team invitations and membership, image uploads, and publishing are unavailable. Use the demo capture button for chosen text, title, and URL; context-menu captures use the regular staging area and are not imported into the demo. Exit demo retains local demo data. Clear demo data deletes only that demo namespace. The demo holds up to 100 drafts, 100 sources, 200 lists, 20 captures, and the latest 20 revisions per draft. It has no server backup and no automatic expiry; removing the extension or clearing its browser storage can erase it. External source links, if deliberately opened, use the browser normally.

What GrowX handles

Sources you choose. When you click the capture button or use Keep in GrowX, the Chrome extension reads the selected text, page title, and page or chosen link URL. This can include explicitly selected text from X, Instagram, YouTube, or other web pages. For a selection inside one identifiable X or Instagram post, it checks link destinations in that post container for an unambiguous permalink. If that is ambiguous, it keeps the page URL for you to review. A clicked link takes priority. The title is the page title, which may not describe the individual post. It does not copy surrounding unselected post text, download video or audio, or automatically retrieve captions or transcripts. Without selected text, a capture is a bookmark; add your own notes or chosen text before repurposing it. It does not scan feeds or collect a browsing-history list in the background. It does not read other sites' cookies, passwords, or form inputs. Editable selections and embedded frames are excluded; restricted pages may require manual paste. Captures are capped at 30,000 text characters, a 160-character title, and a 2,048-character HTTP/HTTPS URL, with up to 20 staged captures stored locally. A staged capture goes to the workspace backend only when you save it. Saved lists and sources are available to other authorized sessions of that workspace, including its web app and paired extensions. Lists organize content; they are not access controls.

Your writing and account data. GrowX stores saved source titles, text and notes, named lists and source membership, drafts and revision history, voice settings and writing examples, uploaded images, connected X account IDs and usernames, and records of reviewed publishing handoffs. Draft edits are saved locally for recovery and synchronized to the backend while you write. Account lists may be refreshed when the workspace opens. Explicit search and post-lookup actions retrieve the requested X content and account information. These records support research, writing, recovery, and the handoffs you choose.

Authentication and team access. The web workspace accepts individual passwords and uses a session cookie for its own login. The owner creates a one-time invitation link valid for 72 hours and shares it manually; GrowX sends no automatic invitation emails. The owner chooses a teammate login (an email address or username); invited teammates provide their name and set their own password. The backend stores member identity, invitation state, and password/session hashes. The owner can revoke a member and their sessions. The extension uses a one-time pairing code created in an authorized web session and stores its session token in Chrome local storage restricted to trusted extension contexts. Extension sessions and captures do not use Chrome sync. The backend stores password and session-token hashes. Provider API keys remain on the server and are not included in the extension. X account authorization is handled through X and Zernio; GrowX receives the connected account metadata needed to display and use that connection.

Where data goes

The extension sends workspace requests to the configured GrowX HTTPS origin. The hosted web app uses Vercel, a Cloudflare tunnel, and a persistent backend on a DigitalOcean VPS. Saved workspace content and media are stored on that backend. These infrastructure services process requests to operate the workspace and may retain operational logs, such as request metadata and IP addresses, under their own policies.

OpenAI. When you explicitly request a writing action, the backend sends the relevant draft, selected source context, voice settings and writing examples, and your requested direction to OpenAI to generate suggestions. Visiting or capturing a page does not itself start an AI request.

Zernio and X. Explicit discovery and X lookup send the requested search, post URL or identifier, and relevant account information to Zernio. Connecting an X account opens the authorization flow for that account. Uploading an image sends the selected file to provider storage. After you review and approve a handoff, GrowX sends the exact reviewed text, media references, account, and destination to Zernio. A queue or scheduled handoff may subsequently publish to X at the chosen time; a provider-draft handoff does not publish. Source notes and voice examples are not included in the publishing payload.

Provider processing and retention are also subject to those services' terms and policies. GrowX does not promise deletion of records already held by another provider. The extension does not call AI or social-provider APIs directly. External links and the hosted X-connection flow open when you choose them.

Use limits

GrowX uses the data described here to provide its source-capture, research, writing, recovery, account-connection, and reviewed-handoff features and to operate and protect them. GrowX does not sell user data, use it for advertising or credit decisions, or include an advertising, third-party analytics, or telemetry SDK in this release. It does not provide automatic replies, direct messages, or browser automation on X.

GrowX's use and transfer of user data comply with the Chrome Web Store User Data Policy, including its Limited Use requirements. This is a statement of our data-use commitments, not a claim of Google certification or Store approval. Invited teammates can access shared workspace content within the authorized workspace. Human access by the publisher is limited to user-authorized support, security needs, and legal obligations. If you email support, we use your message and address to respond to your request. Do not email passwords, pairing codes, or provider keys.

Retention, access, and deletion

Saved server content has no automatic expiry. The owner controls backup retention. Archive hides an item reversibly and does not permanently delete it. You can export drafts in the writer; contact us for assistance accessing or deleting other saved data and retained backups.

Web and extension sessions expire after 30 days and can be revoked in workspace settings. Disconnect revokes the active extension session and clears staged captures; it retains local draft recovery and does not delete server-saved content. Expired, revoked, or signed-out sessions retain recovery edits in separate owner/member namespaces so the same identity can recover them after pairing again. The explicit Clear local recovery data action erases all real-workspace recovery copies on that extension installation after confirmation. Save or export anything you want to keep before clearing or disconnecting.

For permanent deletion of this owner-controlled workspace, contact sebastian@flyinmedia.com. Deletion must cover the backend data, retained backups, and local browser/extension copies. Removing GrowX data does not retract content already published to X, cancel an accepted provider schedule, or remove records held independently by OpenAI, Zernio, or X. Backups contain private content even though live sessions and pairing codes are excluded.

Chrome permissions

• sidePanel: show the writing workspace beside the active page.
• activeTab: obtain temporary access to the chosen page after an extension gesture.
• scripting: run the packaged function that reads selected text, the title, page URL, and relevant post-link destinations for an explicit capture.
• contextMenus: offer Keep in GrowX for a chosen link or selection.
• storage: keep pairing/session data and reviewable captures locally.
• Host access to https://sebastianhardy-signal-desk.vercel.app/*: communicate with the authenticated GrowX workspace. Development builds use an explicit loopback origin instead.

The extension does not request history, cookies, debugger, persistent X-site host access, or all-sites host access. Its executable code, fonts, and icons are packaged locally.

Policy changes and contact

We will update this page and its effective date when the disclosed practices change. Questions and privacy requests: sebastian@flyinmedia.com, Flyin Media LLC. Support and private-beta access.