Privacy Policy

1. Who We Are

blew by setupr is an AI-native Model Context Protocol (MCP) server operated by Setupr. Blew enables users of modern AI clients—including ChatGPT, Claude, Codex, Cursor, and Windsurf—to publish high-impact thought leadership and content directly to X (formerly Twitter) and LinkedIn from regular conversational chats.

For any privacy questions or requests, you can contact our privacy officer directly at legal@setupr.com.

2. Information We Collect

We collect only the bare minimum technical data required to securely route your authorized posts to social networks:

• Authentication Details: Your email address and unique account identifier provided during Google Sign-In or email signup via Supabase Auth.
• OAuth 2.0 Credentials: When you connect X or LinkedIn in your setup dashboard, we receive an authorized access token and refresh token granted by the respective platform through official OAuth 2.0 PKCE / OIDC protocols.
• Public Handle & Profile Identifiers: Your public username (e.g., @username on X) and LinkedIn profile ID/vanity name so you can verify connected profiles in your setup view.
• Publishing Activity & Quotas: Timestamps of posts published via the MCP tool, post status (published or failed), and your remaining post quota balance.

3. What We Never Collect or Store

Unlike traditional social media dashboards or monitoring platforms, Blew adheres to strict privacy isolation:

• No Account Passwords: We never handle or store your X or LinkedIn passwords.
• No Chat Transcripts or Prompts: Your prompts, personal notes, brainstorming sessions, and model chain-of-thought stay strictly inside your AI interface. Blew only receives the final string you explicitly approve to post.
• No Direct Messages (DMs): We do not request, read, or process private direct messages.
• No Timeline or Feed Crawling: We do not read or scrape your personal timelines, followers' feeds, or reading history.
• No Payment Card Numbers: All billing and top-up orders are processed by Razorpay. Blew never sees or stores full credit card numbers or banking passwords.

4. How Your Data Is Used

We use the data collected strictly for the following operational purposes:

• Authenticating MCP requests using your personal Bearer token or authenticated user session.
• Validating that your account has an active post quota before submitting content.
• Passing the approved post text and media payload to our secure background dispatch engine to publish on your authorized X or LinkedIn account.
• Providing account management features, quota top-ups, and customer support.

We do not sell, rent, monetize, or trade your personal information or connected account tokens to any third parties, data aggregators, or advertising networks.

5. Third-Party Platforms & APIs

When you use Blew to publish content, your data is processed in accordance with the policies of the connected platforms:

• X (Twitter) API v2: By connecting your X account, you also agree to X Terms of Service and X Privacy Policy.
• LinkedIn API: By connecting your LinkedIn account, you also agree to the LinkedIn User Agreement and LinkedIn Privacy Policy.
• AI Clients (OpenAI ChatGPT, Anthropic Claude): The Model Context Protocol establishes an encrypted channel between your client and our MCP server. Data handling inside your chat session is governed by OpenAI's or Anthropic's respective terms.
• Supabase & Cloud Infrastructure: Database and authentication services are hosted on ISO 27001 / SOC 2 compliant infrastructure with encrypted database storage.

6. Data Security & Retention

We implement strong administrative, technical, and physical safeguards:

• All network communications are strictly encrypted using TLS 1.3 in transit.
• OAuth refresh and access tokens are secured at rest with AES-256 encryption.
• Post execution logs are retained for up to 90 days for debugging and audit purposes, after which they are automatically pruned.

7. User Rights and Token Revocation

You retain complete sovereignty over your data and linked accounts:

• Instant Disconnect: You can disconnect your X or LinkedIn profile at any moment by visiting https://blew.setupr.com/setup and clicking "Disconnect". This deletes the active tokens from our database immediately.
• Third-Party Revocation: You can revoke Blew's access directly from your X Connected Apps Settings or LinkedIn Permitted Services Settings.
• Account Deletion: To completely delete your account and all associated records, email us at legal@setupr.com with the subject "Data Deletion Request".

8. Changes to this Policy

We may periodically update this Privacy Policy to reflect improvements to our MCP server or changes in regulatory standards. If we make material modifications, we will update the "Effective Date" at the top of this page.