Security & X Safety
Updated: October 19, 2026
X account access
You connect an X account through X authorization. PostGrowly sends requests to X's API at api.x.com using the permissions you approve; it does not ask for your X password. Connection tokens are encrypted on the server with AES-256-GCM and are not sent to the browser as readable credentials.
Automation safeguards
Campaigns run only from the triggers and rules you configure. The app checks for duplicate deliveries and opt-outs, supports STOP opt-outs, checks a 100 automatic-DM daily safety ceiling per PostGrowly account (UTC day), and automatically pauses a campaign after its 48-hour window. To limit repeated engagement reads, campaign checks happen every 15 minutes during the first four hours, every 30 minutes through the first day, then hourly. These limits reduce unintended activity; they do not guarantee that X will accept a request or that an account will never be restricted.
Your role
Review posts, campaign triggers, recipients, and message content before enabling automation. Keep your X account secure and disconnect it if you no longer want PostGrowly to act on its behalf. Follow X's current rules and applicable laws.
Private media and security reports
Uploaded and generated images are stored in a private bucket and previewed with temporary signed links. To report a suspected security issue or request help, contact contact@postgrowly.com. Never email passwords or access tokens.