Draft — to be reviewed before launch. This page isn't final and isn't legal advice. Highlighted items in brackets are details still to be supplied or decided.
Legal
Privacy policy
Effective [Effective date]
RookerAI is an AI agent that runs your X, LinkedIn or Reddit account toward a goal you set. To do that it has to read posts and act under your account, so this page says plainly what we collect, what we do with it, who else handles it, and how to have it deleted.
Who we are
RookerAI is run by [Seller legal name], [Registered address], a company registered in[Country of incorporation] [Company registration number, if any]. We are the controller of the personal data described here. You can reach us at [Contact email].
[EU / UK representative, if one is required]
The short version
- We keep your account details, the agents you set up, and what your agents read, wrote and learned, so the service can run and improve its work for you.
- Post text your agent reads and writes is sent to Anthropic's Claude to plan, judge posts and draft.
- While reading, agents note problems and requests people post publicly. Those notes go into one list our team reads as product research. Details are below.
- We don't sell your data, show ads, or use tracking or advertising cookies.
- You can delete your account, and everything in it, at any time.
What we collect and why
Your account
- Your email address, your name if your sign-in provides one, and a user id. Sign-in is handled by Firebase Authentication, with an email and password or with Google. We never see your password: Firebase holds it.
- Whether your email is verified, how you signed in, when the account was created and when it was last used.
We use these to sign you in, to keep your data separate from everyone else's, and to send account emails (verifying your address, resetting your password, and notices about your account or budget).
What you set up
- Your agents: the persona each speaks as (the facts about you it may state, tone, languages, topics and no-go rules), its goal, its strategy, what it promotes, and its limits (caps, rest hours, Act or Review mode).
- Your library: the personas, goals and offers you saved to reuse.
- Your chat with your agents, and your answers to items it flagged for you.
We use these to run your agents the way you asked.
What your agent reads and does
When you run an agent in the browser extension's side panel, it reads the X, LinkedIn or Reddit pages it opens in that tab, and keeps:
- Its plans, its journal (its "thoughts"), and the lessons it learned.
- Its actions: what it sent, skipped or flagged for you, including the text and author of the post it answered.
- The people it talked with: their handle, display name and a short note about the conversation.
- Observations of posts it read: the post and its counts (likes, replies, reposts, views), to measure how its own posts do and what works in your field.
- Your own follower count over time.
We use these so the agent remembers whom it has talked with, measures its results, and learns what to do next.
Billing (when you subscribe)
Payments are handled by Paddle (see who processes your data). We receive and keep your plan, the subscription's status and dates, Paddle's customer and subscription ids, and each payment's amount, tax, currency, invoice number and date. We never see your card or bank details.
Usage and technical data
- Your AI usage: the model calls your agents make, with tokens and cost per month, by agent. We use this to apply your plan's monthly AI budget and to show you how much of it is used.
- Your IP address and the requests your browser makes to our servers, as part of serving the site. We use it to keep the service running and secure (for example, limiting how often a password reset can be asked for). [How long request logs are kept, if at all]
Product research: what people need
While your agent reads posts, it also notes pain points and requests that people post publicly(for example, "I wish there were a tool that…"). Each note is saved with a short quote from the post, the author's display name, a link to the post, and which account's agent, which agent and which site found it.
- Who sees it: only the RookerAI team. It's one list across every customer's agents, which we read as product research. Customers can't see it, their own entries included.
- It isn't anonymous: the list keeps the post author's display name and a link to the post, and our team can see which customer account's agent noted it.
- It uses your AI budget: the notes are written by the same model call that judges posts for your agent, so that work counts toward your plan's monthly AI budget.
- It runs for every agent. There is no switch to turn it off today. [Decide: offer an opt-out?]
- How long it's kept: each need keeps its most recent pieces of evidence (older ones drop off as new ones come in), for as long as it's useful to us. [Retention for the needs list] When you delete your account, every quote, link and author name your agents added is removed from it, and a need only your agents noted is deleted. A need others' agents also noted stays, as its short summary and count, without your agents' entries.
- If you wrote a quoted post and want it removed, write to [Contact email] with the link, and we'll take it out.
[Legal basis for the needs research: legitimate interests suggested — confirm, with a balancing test]
Data about other people
Your agent reads public posts and talks with people, so your account holds some data about them: the text and author of posts it read or answered, the handles and display names of people it talked with, and its own short notes about those conversations. It's kept in your account, only for your agent's work, and goes when you delete the agent or your account. If you're one of those people and want something about you removed, write to[Contact email].
Who processes your data
We use these service providers. Each gets only what it needs for its part.
| Provider | What for | What it gets | Where |
|---|---|---|---|
| Google Firebase Authentication | Sign-in, and the codes in verification and password-reset links | Your email, name, user id, password (held by Firebase) or Google sign-in details | [Region to confirm; Google, mainly US] |
| MongoDB Atlas | The database holding your account and app data | Everything listed under "What we collect" | AWS eu-north-1 (Stockholm, Sweden) |
| Cloudflare | Hosting the web app and our backend (Cloudflare Workers), and sending account emails from noreply@rookerai.com | Every request to the site, with your IP address; the content of those requests; your email address and the emails we send you | Cloudflare's global network; our backend runs near Stockholm |
| Anthropic (Claude API) | Planning, judging posts, drafting, reflecting and chat | The posts your agent reads and writes (with their authors), your agent's persona, goal, strategy, offer, lessons and history, and your chat messages | [Region to confirm; Anthropic, US] |
| Paddle (when you subscribe) | Checkout, payment, tax, invoices and refunds, as our reseller and merchant of record | Your name, email, billing address, payment details and purchase history, which Paddle collects itself | [Region to confirm; Paddle, UK] |
Paddle sells the subscription to you, so for payments it acts under its own privacy notice as well as on our behalf.[Confirm what Anthropic's current commercial terms say about retaining and training on API data, and state it here]
Transfers outside your country
Our database is in the EU (Stockholm), but some providers above process data in the United States, the United Kingdom or elsewhere. Where data leaves the EU, UK or your country, we rely on [Transfer mechanism: e.g. Standard Contractual Clauses, UK addendum, EU–US Data Privacy Framework — confirm per provider].
The browser extension
The RookerAI browser extension is a relay: its side panel shows our web app, and the web app asks it to read and act on the tab you opened the panel on.
- Which sites: only x.com, twitter.com, www.linkedin.com and www.reddit.com, plus our own rookerai.com. It refuses every other site and never reads other tabs.
- What it reads: the content of those pages that your agent opens in that tab: feeds, posts and comments, search results, profiles, your notifications and mentions, your own replies, and your follower count. It sends what it reads to our server, to run your agent as described above.
- What it does: types and clicks on those pages to post, comment, reply, quote or follow, within your caps, and in Act mode only after a countdown you can stop. In Review mode it posts nothing: drafts wait for you.
- What it doesn't do: it doesn't read your browsing history, other websites, or your passwords for X, LinkedIn or Reddit, and it doesn't hold your RookerAI sign-in.
- Permissions: the side panel, and running its script on the sites above (including in tabs that were already open when you installed it). Access to rookerai.com lets the panel and the site share one sign-in.
Cookies and local storage
- Firebase keeps your signed-in session in your browser's storage, so you stay signed in.
- The app keeps a draft of an agent's setup while you make it, and each running agent's short-term memory (timers, today's counts, posts already seen or handled), in your browser's local storage.
- When you sign in with Google, Google's sign-in window uses Google's own cookies.
- When you open checkout, Paddle's checkout may set cookies it needs for payment and fraud prevention. [Confirm against Paddle's cookie notice]
We use no analytics, advertising or tracking cookies, so there's no cookie banner. Clearing your browser's storage signs you out and drops these drafts.
How long we keep it, and deleting your account
- While your account is open, we keep your data so the service can work. Deleting an agent deletes its plans, journal, actions, people, observations, follower counts, lessons and chat.
- Delete account, in the app, deletes every record belonging to your account, your account's entries in the product-research list, and your sign-in, and cancels your subscription.
- After you cancel (or a subscription ends unpaid), your account becomes read-only. We keep its data for [Retention after cancellation: 90 days suggested], warn you by email before then [warning at 80 days suggested], and then delete it.
- Payment records are kept by Paddle, and by us where the law requires, for as long as tax and accounting rules require. [Our own retention for payment records]
- [Backups: whether any exist and how long deleted data can remain in them]
Your rights
Depending on where you live (for example under the GDPR, the UK GDPR or California law), you can ask us to:
- tell you what data we hold about you and give you a copy (access);
- give it to you in a machine-readable format (export);
- correct it;
- delete it (you can also do this yourself with Delete account);
- restrict or object to how we use it, including the product research above.
Write to [Contact email] from your account's email address. We'll answer within one month. You can also complain to your data protection authority. We don't sell or share personal data for advertising.
[Legal bases to confirm: contract (running the service), legitimate interests (security, product research), legal obligation (tax records)]
Security
Every request is checked against your sign-in, and every record is tied to your account so no one else can read it. Data travels encrypted (HTTPS). No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.
Children
RookerAI is not for anyone under 16, and we don't knowingly collect their data. If you think a child has an account, write to us and we'll delete it.
Changes to this policy
If we change this policy, we'll update the date at the top, and for meaningful changes we'll email you before they take effect.
Contact
[Seller legal name], [Registered address]. Email: [Contact email].