X (Twitter)
- The policy allows AI training; it does not describe an opt-out.
- Your data is used for personalized ads, including by third-party ad companies.
- The policy allows data sales or sharing; it does not describe an opt-out.
- The policy describes staff access for safety and legal checks.
X collects a lot, trains AI on your posts, shows ads, and limits what you can recover if things go wrong.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
- Uses your content for AI training with no opt-out
- Sells or shares your data with no opt-out
Collected
They collect posts, DMs, device IDs, location, contacts if you share them, and data from ad partners.
Read the exact line
Privacy policy
“The information we collect when you use X falls into three categories.”
Training
They use your content for ads, to guess who you are, and to train their AI models.
Read the exact line
Terms of service
“this license includes the right for us to (i) analyze text and other information you provide and to otherwise provide, promote, and improve the Services, including, for example, for use with and training of our machine learning and artificial intelligence models”
Sharing
Your profile is public, and ad partners and other companies can get or combine data about you.
Read the exact line
Privacy policy
“Your profile information, which includes your display name and username, is always public, but you can use either your real name or a .”
Kept
The parts of the policy we could read do not say how long they keep your data.
Read the exact line
Terms of service
“See https://help.x.com/managing-your-account/how-to-deactivate-x-account for instructions on how to deactivate your account and the Privacy Policy for more information on what happens to your information.”
Controls
You can set preferences and deactivate your account; the policy does not describe an AI-training off switch.
Read the exact line
Privacy policy
“When you set your preferences using your settings, we collect that information so that we can respect your preferences.”
Fine print
You must be 13+. Outside the EU/UK, Texas courts apply, are waived, and is capped at $100.
Read the exact line
Terms of service
“in any event, our shall not exceed the greater of $100 USD or the amount you paid us, if any, in the past six months for the Services giving rise to the claim.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Deactivate your account if you want to leave
https://help.x.com/managing-your-account/how-to-deactivate-x-account
Review preferences in your settings
Your X settings (preferences they collect so they can respect them)
Turn off precise location and address-book sharing if you do not want those
Account settings for location and address book, as described in the privacy policy
Appeal if your account is closed by mistake
https://help.x.com/forms/account-access/appeals
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
They can use what you post, type, or generate to train their AI. The terms do not describe a way to turn that off.
Read the exact line
Terms of service
“including, for example, for use with and training of our machine learning and artificial intelligence models, whether generative or another type”
For example, a private draft or a prompt you type could be used to teach their models.
You still own your posts, but they can copy, change, and share them almost anywhere, including with other companies, without paying you.
Read the exact line
Terms of service
“you grant us a worldwide, non-exclusive, license (with the right to ) to use, copy, reproduce, process, adapt, modify, publish, transmit, display, upload, download, and distribute such Content”
For example, they could syndicate your photo or post on another site.
Companies that show ads can send them data about you, and they mix it with what they already have.
Read the exact line
Privacy policy
“Information shared by ad partners and affiliates or collected by X from the websites and apps of ad partners and affiliates may be combined with the other information you share with X”
For example, a shop’s site might tell X you looked at shoes, then X shows you shoe ads.
If they cause you harm, they say they will pay at most $100 or what you paid them recently.
Read the exact line
Terms of service
“IN NO EVENT SHALL THE OF THE X ENTITIES EXCEED THE GREATER OF ONE HUNDRED U.S. DOLLARS (U.S. $100.00) OR THE AMOUNT YOU PAID US, IF ANY, IN THE PAST SIX MONTHS”
For example, if a bug wipes your account, they cap what they owe at a small amount.
They can shut your account even if you did nothing wrong, though they say they will try to notify you.
Read the exact line
Terms of service
“To the extent permitted by law, we may also terminate your account or cease providing you with all or part of the Services for any other reason or no reason at our convenience.”
For example, they could close a long-running account because they no longer want to offer it.
You generally cannot join with other users to sue them together.
Read the exact line
Terms of service
“you agree to waive any right to bring a or other .”
For example, if many people lose money the same way, each person may have to go it alone.
Even logged out, they may try to figure out who you are from device and browsing clues.
Read the exact line
Privacy policy
“When you access X and are not signed in, we may infer your identity based on the information we collect.”
For example, using the site in a private window might still be tied back to you.
If you agree, they can collect biometric data such as for ID and security.
Read the exact line
Privacy policy
“Based on your consent, we may collect and use your biometric information for safety, security, and identification purposes.”
For example, they might use a face or similar check if you turn that on.
You still own what you post, even though you give them a wide license to use it.
Read the exact line
Terms of service
“You retain your rights to any Content, including anything referenced therein, you submit, input, create, generate, post, or display on or through the Services.”
For example, you can still reuse your own writing elsewhere.
They have a public program for people to report security bugs.
Read the exact line
Terms of service
“If you are a security researcher, you are required to comply with the rules of our Vulnerability Reporting Program (https://hackerone.com/x).”
For example, a researcher can report a leak through HackerOne instead of staying silent.
You have to be 13 or older. They do not describe extra age checks beyond that rule.
Read the exact line
Terms of service
“in any case, you must be at least 13 years old to use X.”
For example, a 12-year-old is not allowed, but they may only rely on you saying your age.
Words to know
Legal words from the lines above, in plain English.
- pseudonymous
- Your name is swapped for a code, but the company keeps the key and can still link the data back to you. For example, your chats are filed under user 48213 instead of your name, but staff can still look up who that is.
- limitation of liability
- A cap on what the company will ever pay you if something goes wrong, often only what you paid in the last year. For example, if a leak of your data costs you thousands, the most you may get back is a month's subscription fee.
- worldwide license
- You let the company use your content anywhere on earth, usually for free and for as long as it likes. For example, a video you post can be shown in ads in any country without asking you again.
- royalty-free
- The company can use your content without ever paying you for it. For example, your photo can appear in the app's ads and you get nothing.
- sublicensable
- The company can pass its rights over your content on to other companies without asking you. For example, an app can let an advertiser or a partner reuse your video under the licence you gave.
- affiliates
- Other companies owned by or connected to the same parent company. For example, if you use one app, its sister apps under the same owner may also get your data.
- class action waiver
- You agree not to join with other users in one lawsuit; each person must complain alone. For example, if a bug overcharges a million people, you cannot all sue together for a refund.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- biometric
- Measurements of your body that identify you, like your face, fingerprint or voice. For example, a selfie used to unlock the app or a voice recording matched to you.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- inputs and outputs
- Inputs are what you type, say or upload to an AI; outputs are what it gives back to you. For example, the question you ask a chatbot is an input and its answer is an output, and both may be stored.
How we got here · grade F · score 31/100 · 15 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect account details, posts, DMs, device and ad IDs, approximate location, optional precise location and address book, and data from ad partners.
Does it record your voice, face or body, and what happens to that?
They may collect biometric information with your consent for safety, security, and identification, which is tied to using the service.
Are your chats and uploads used to train AI models, and is that off by default?
The terms say they may use your content to train machine learning and AI models. They do not describe a way to opt out.
Can employees or contractors read your conversations, and when?
They say they may read and disclose information for law, rule-breaking, fraud, support, and safety—not as routine sampling of all chats.
Are you profiled or tracked for advertising?
They show ads and collect data from ad partners, cookies, device IDs, and sites that embed X content.
Do they sell or share your data, and can you opt out?
They combine data with ad partners and may make your content available to other companies. The parts we read do not describe an opt-out.
What rights do they take over what you type and what the AI makes?
You own your content but grant a worldwide sublicensable license for any purpose. Profile info is always public.
How long do they keep your data after you delete it, and can you delete it in the app?
Not stated in the documents.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They infer identity, interests, and ad profiles from activity, even when you are signed out. Full view/edit/off controls for that profile are not described.
Do they commit to basic security, and have they leaked data?
They require security researchers to use their Vulnerability Reporting Program on HackerOne.
Is there a real age gate, and are teens protected?
You must be at least 13. They do not describe extra age checks beyond that statement.
Will they tell you when the rules change, and is the policy specific?
The terms are dated and they try to notify you of big changes, then continued use means you accept. The privacy excerpt has no date and is thin on retention.
Can they close your account without warning, and can you get your data out first?
They can close your account, including for convenience in some versions, and say they will make reasonable efforts to notify you. Export of your data is not described here.
If something goes wrong, who pays?
The service is “AS IS.” For many users their total payout is capped at $100 or what you paid in the last six months.
Do subscriptions renew on their own, and can you get a refund?
Not stated in the documents.
The privacy policy is 1,444 words at a college level (Flesch reading ease 43.7); the terms are 18,872 words at a college graduate level.
