Who runs this, and what it is not

• Social Signature is an independent public service. No sign-in, no advertising, no analytics cookies, no sale or rental of anything here to anyone. A paid tier for greater API access may be offered; that changes nothing on this page.
• Everything this service holds about you is listed below. We do not say "no tracking", because the daily budgets rely on short-lived identifiers, and you deserve to know which.

The one cookie

• A single signed cookie enforces your daily budgets. It holds a random id and today's date, expires at the end of the day, and identifies nothing about you. It is the only cookie this site sets.

Quota counters

• Counters keyed by the day's cookie id enforce your personal daily budgets for lookups, research requests and dispute filings. A salted, daily-changing hash of your IP address enforces the shared network allowance; the address itself is never stored. Counters keyed by a hash of an API key enforce that key's daily calls.
• All counter rows self-delete within days. Every request to the service's own endpoints — a lookup, a research request, a filing, an API call, accepted or refused — is logged for a limited period with the address, the browser signature and what was asked for. That log is visible only to the operator and exists so that abuse can be seen and blocked.

Post records

• Each looked-up post's rebuilt record (the post as X publicly served it, plus what we measured about it) is kept server-side so shared links, reports and account records keep working. It contains post content and nothing about you. Post records are retained; they are not purged on a schedule.
• Published fact-checks that cite a post are recorded against it as they are found and shown on its record: the publisher, its rating in its own words, the date and a link. The absence of one is not a clean bill.
• If an AI assessment was computed for a post (only when someone ticked the box), it is stored beside that record and reused while the post's content, the assessment method and the fact-checks on record for it are unchanged, and for a limited period; after that, the next request that asks for one computes a fresh assessment and the earlier one is kept as history. The assessment is produced by a language model from the post text, the page the post links to if any, a live web search for the post's claims when one is available, the fact-checks on record for the post, and a description of the attached images made by a vision model. Each assessment states what it inspected and whether the search ran. Nothing about you is sent to the model or the search.

Account records

• When someone looks up an account, we resolve it from what X publicly serves at that moment and show its public identity: numeric id, handle, display name, creation date, follower count and subscriber flag. A lookup alone does not store the identity. Protected accounts are shown as protected and are never researched.
• When someone requests a research run for an account, one job runs. It fetches the account's most recent public posts as X publicly serves them and stores them as post records tied to the account; it then publishes an account record holding the identity above, those posts (text, date, counts), and the fact-check section described next. The record also notes when research last ran and whether a dispute is open.
• Fact-check entries, when the fact-check lookup has run, are relayed from a public index of published fact-checks: the publisher's name and site, the rating in the publisher's own words, the review date, the claim text and a link. Each entry states whether it cites a post this account wrote, only names the handle, or lists the account holder as the claimant in the publisher's own record. Entries that merely match a display name are listed under their own heading as possible name matches, are never counted, and never appear in the API. Records built before the fact-check lookup existed say so on their face. This service rates nothing and infers nothing about anyone's intent.
• Only public, non-protected accounts are researched, in two cases: when a person asks about that specific account, and once a day for accounts whose own posts were cited in recently published fact-checks. That daily list is read from the fact-check publishers' own citations, never from watching the platform, and the operator can pull any account from it. There is no crawling of X and no list of accounts to watch.
• Account records are retained until removed (see below). A record becomes eligible for a fresh research run on a later request once it has aged, and is refreshed by the daily run on a day the account is on that list.
• Research run bookkeeping (job id, timestamps, status, and the day's cookie id or API key hash that requested it) is kept for a limited period after the run finishes, then deleted.

Disputes and removal requests (only if you file one)

• Stored exactly: the account id, whether it is a dispute or a removal request, whether you said you are that account, the contact address if you gave one (required for removal), your text verbatim, the time, the day's random cookie id, the filing's status, and the operator's note when it is resolved. No IP, no name unless you typed one.
• Filing a dispute marks the record "a dispute has been filed (unverified)" immediately. Findings stay visible while the operator reviews. Filings are kept as part of the record's history, including after resolution, so a repeat filing can be judged against the last one. Write to records@socialsignature.app to have a filing deleted.
• Removal is verified by hand: the operator replies to the contact you gave before anything is removed. A completed removal deletes the account record and the post records the research run stored for it, marks your filing resolved, and keeps the account's numeric id on a permanent do-not-recreate list so that a later lookup cannot rebuild the record. Post records captured by the post-lookup tool on their own are not tied to an account and are not removed by this process.

API keys

• A key is issued by hand and shown once; only a hash of it is stored, with a label, its tier, when it was issued or revoked, and a contact if you gave one. Key rows persist until the key is revoked. Each call spends one count against that key's daily allowance.

Suggestions (only if you send one)

• Stored exactly: the kind you picked, your text verbatim, the contact if you typed one, the time, and the day's random cookie id. No IP, no name unless you typed one. Suggestions are read; they are not answered, and a contact is used only if a detail needs checking. Kept until closed by the operator, or deleted on request with enough detail to find it.

Problem reports (only if you send one)

• Stored exactly: the post id, your checkbox choices, your description text verbatim, the record card as the server rebuilt it, a version stamp, the time, and the day's random cookie id. No IP, no name, no email. Your text is stored as you typed it; please don't include personal information. Reports are deleted on a fixed schedule, or earlier on request with enough detail to find the row.

What third parties see

• X sees this service's requests when we fetch a post, a timeline or a record on your behalf, not you. Images and video on a record load directly from X's servers, which therefore see your IP address and browser like any image load. We send no referrer, but that's all hiding a referrer hides.
• When the fact-check lookup runs, the fact-check index receives the handle or display name being researched, not anything about you.
• When an AI assessment runs, a web search provider receives a query made from the post's text, and the vision model receives the post's images. Neither receives anything about you.
• The human-check widget and our cookieless usage counter are third-party services; they see the connection like any embedded widget does. Our hosting provider's connection logs see IP addresses under its own retention policies. That is outside our storage, and we won't pretend otherwise.

Your rights, plainly

• Ask what is held about you, ask for a filing or report to be deleted, or request removal of an account record: the dispute form on the record page, or records@socialsignature.app. Verification for removal is manual, by reply. Public identity fields and public posts are what X publishes; removing our record does not change what X shows.