How PersonaXpand keeps your accounts and data safe

Connecting your social accounts

Every network connects through its official login (OAuth). You sign in on the network's own page, approve what PersonaXpand may do, and the network gives us a key for those actions. We never see or store your social media password. The one exception is Telegram, where you paste a bot token that you create in Telegram yourself.

When you disconnect an account, PersonaXpand stops posting and replying with it straight away. Where the network offers a way to cancel access, we also ask it to cancel ours, and you can always remove PersonaXpand from the network's own settings as well.

• Official network logins only, no scraping and no shared passwords
• Access keys encrypted with AES-256-GCM before they are stored
• Disconnect any account at any time and posting and replies with it stop straight away

Auto-replies: you stay in control

Auto-replies are off for every account until you switch them on. When you do, replies to DMs, comments and mentions wait for your approval by default, and you choose whether any of them may send without you. Daily limits stop a busy post from producing a flood of replies.

Protecting your PersonaXpand account

• Passwords are stored only as salted hashes, never in readable form
• Five wrong passwords lock sign-in for 15 minutes
• Sign-in and sign-up are rate limited, and sign-up is protected by a bot check
• You can sign in with a passkey instead of a password
• Throwaway email addresses cannot be used to sign up

The website and the app

• Every page is served over HTTPS, and browsers are told to use HTTPS only for a year (HSTS)
• Sign-in cookies are secure and cannot be read by page scripts
• Every form is protected against cross-site request forgery
• The app cannot be framed by other websites
• Messages that Meta, Threads, X and Stripe send to us are only accepted with a valid signature

Where your data is stored

PersonaXpand runs on Microsoft Azure, and your data is stored in Azure's India region. We chose that region for its capacity and its cost, which helps keep PersonaXpand affordable. Every service that receives any of your data, and why, is listed in the privacy policy.

AI and your messages

AI drafts and replies are written by Google Gemini through Google's paid API. Under Google's terms for paid use, your prompts and the replies are not used to improve Google's products and are logged only for a limited time to detect abuse. If Gemini is unavailable, the same request may go to OpenAI as a backup so the feature keeps working.

Nothing is sent to an AI provider unless you use an AI feature: auto-replies are off until you switch them on, and AI writing tools run only when you press them.

Deleting your account

When you delete your account you have seven days to change your mind by signing in again. After that, your account and content are permanently deleted, and we ask Facebook, Instagram, Google, YouTube, X and TikTok to cancel our access. We keep only a small amount of usage and anti-abuse records, for example to stop repeat free-trial sign-ups.

What we do not claim

PersonaXpand is not SOC 2 or ISO 27001 certified, and we have not published a third-party penetration test. Sign-in does not offer one-time codes from an authenticator app yet; passkeys are the stronger option we offer today. We would rather tell you this than let you assume otherwise.

Report a security issue

If you think you have found a security problem in PersonaXpand, email [email protected] with the details and how to reproduce it. Please do not test against other people's accounts or data. Our contact details are also published in security.txt.