Privacy policy

This policy explains which personal data Own Edge processes, why, and what rights you have. As of 23 October 2026.

1. Controller

souveraign minds GmbH
Wipfelweg 9a
44265 Dortmund
Germany
Represented by: Andreas Christiani (managing director)
Register: Amtsgericht Dortmund, HRB 32685
VAT ID: DE277514575
Email: information@souveraign.de

2. What we process

• X account data: your X user ID, handle, display name, follower count and account creation date.
• Your posts: text, timestamps and metrics (impressions, replies, likes, bookmarks, reposts, quotes, and since 23 October 2026 the profile visits X counts for each of your posts) of your latest original posts, and for the Deep Check also of your own replies.
• For the Deep Check: for each substantive reply, the follower count of the account you replied to and the time of their post. We do not store the text of other people's posts.
• For the Weekly Report: replies and mentions other accounts sent you (the post ID, the author's X user ID, the time and the post it answers, never the text), and for the accounts you talk with most their handle and follower count. These are public data of other X users; they are shown only to you, never in a shared result.
• OAuth tokens from X, stored encrypted (AES-256-GCM).
• Optional: your email address, and your choices for the 4-week reminder and the benchmark pool.
• Payments: checkout session ID, payment ID, product, amount, currency and status from Stripe, for the Weekly Report also the subscription ID, its status and the end of the paid month, plus the version and time of your consent to the immediate start. If your account has no email address, we use the address you entered at checkout once for the purchase confirmation and do not store it. We never see card details.
• Technical data: a signed session cookie, a short-lived login cookie, and a keyed hash of your IP address for rate limiting.
• Email log: type, time and delivery status of the mails we sent you. The log holds no email addresses.
• Usage events: which steps of Own Edge you take while logged in (for example that you opened a report, clicked a locked part, opened the purchase dialog or went to the checkout), with the time and the report concerned, linked to your account. They are deleted with your account.

3. Purposes and legal bases

• Running the checks you request and showing you the result: performance of a contract, Art. 6 (1) (b) GDPR.
• Adding pseudonymised numbers to the benchmark pool: your separate consent, Art. 6 (1) (a) GDPR. Withdraw any time on your account page, which deletes your pool rows, or by deleting your account.
• The 4-week reminder and waitlist emails: your consent, Art. 6 (1) (a) GDPR, confirmed by double opt-in for the waitlist.
• Security, abuse prevention and cost limits: legitimate interest, Art. 6 (1) (f) GDPR.
• Counting which accounts reply to you and whom you reply to, for your Weekly Report: for you a performance of the contract, Art. 6 (1) (b) GDPR; for the other accounts, whose public replies and handles we read, legitimate interest, Art. 6 (1) (f) GDPR: you see who you are in conversation with, we store no text and nothing leaves your report.
• Understanding where people stop between the free check and the purchase, so we can fix that step: legitimate interest, Art. 6 (1) (f) GDPR. Visits before login are only counted: page, time and a rough source category (such as "from X" or "from a shared result"), without IP address, cookie or any other identifier, so they are not linked to anyone.

We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). The classification of your posts only feeds the statistics in your own report.

4. Processors and recipients

Processors acting on our instructions under Art. 28 GDPR:

• Anthropic PBC, USA: classification of your post texts. We send the text, the date and your handle of each post, never your metrics.
• Resend: sending the emails listed above.
• Hetzner Online GmbH, Gunzenhausen, Germany: running the website, the database and the job worker on a server in Germany.
• Telegram: a short operator notice when a check finishes or fails, with your X handle, the size, cost and duration of the check. It holds no post texts, metrics or email addresses.

Independent parties, not our processors:

• X Corp.: the source of your data. We read it through the official X API after you granted read-only access, and X sees that access.
• Stripe and Link: the checkout runs on Stripe's pages. With Stripe Managed Payments, Link is the merchant of record for your purchase, is the controller for the payment details you enter there and handles them under Stripe's privacy policy. We only receive the payment status and identifiers listed above.

Where data is processed outside the EU, transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.

5. Benchmark pool

Only with your separate opt-in. The pool holds numbers and category labels per post (reach, bookmarks, replies, post type, hook and similar), your follower range and the week of posting. It holds no text, no handle and no post IDs; keys are one-way pseudonyms, so the rows stay pseudonymous rather than anonymous and remain linked to you. Unticking the pool on your account page, or deleting your account, removes your pool rows.

6. Shared results

Only if you click "Share result". We create a public link that shows your handle, the number of posts measured, their period and up to three findings, each with one of your own public posts as an example, plus a preview image. It shows no post metrics beyond those findings. Anyone with the link can open it, and X may show the preview when the link is posted. We count views of the link without storing who viewed it. "Stop sharing" switches the link off at once.

7. Storage and deletion

We keep your data while your account exists. You can delete your account at any time in your account page; this deletes your account, tokens, posts, labels, checks, reports, usage events, pool rows and the replies and accounts read for the Weekly Report, ends a running Weekly Report at once and revokes our access at X. Posts you deleted on X are removed with the next check. Payment records are kept as required for bookkeeping, without link to your deleted account.

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection, and the right to withdraw consent. You can lodge a complaint with a data protection supervisory authority.

9. Cookies

We use only technically necessary cookies: a session cookie (30 days) and a login cookie (10 minutes). No analytics cookies, no third-party tracking, nothing stored in your browser for statistics.