Privacy

Newsletter email addresses

When you submit an email through a Tech Twitter subscription form, the address is normalized and stored temporarily with an expiring confirmation request. Resend sends a confirmation email. Only after you confirm do we add the address to the newsletter segment and send the cached latest issue and later broadcasts. Resend keeps the contact and subscription status for those deliveries. Confirmation requests expire after 24 hours and are removed by scheduled cleanup.

Every SIGNAL broadcast includes a Resend-managed unsubscribe link. The website does not create a reader account from your email, and the newsletter never asks for an X password.

Sign in with X

When you sign in to Tech Twitter with X, X tells Tech Twitter your X user id, handle, display name, and avatar. Supabase Auth runs the sign-in and stores the profile data X returns, which can include the email address on your X account, along with sign-in times. Tech Twitter uses that identity for member flows you start while signed in (for example product sponsorship) and does not post, like, follow, or send messages on your behalf. Open Mic entries from the retired program are described in the archived terms.

Cookies and local browser state

After email confirmation, the site can set a first-partytech_twitter_subscribedcookie containing an opaque access token. It expires after one year, is unavailable to browser scripts, and helps authorize reader access for someone who already subscribed. It does not contain the email address. The browser can also store local markers for subscription status, confirmation-conversion attribution, page-view count, inline prompt dismissal, and newsletter-popup timing. The pending form can remember your email in session storage so you can resend or correct it. You can remove this state through your browser's cookie and site-data controls.

Signing in to Tech Twitter with X sets first-party Supabase session cookies whose names start withsb-and hold the sign-in tokens. They are unavailable to browser scripts, sent only over HTTPS, and last until you sign out or up to 400 days. Other cookies of the same kind hold one-time codes while you sign in and are cleared when X sends you back, whether or not sign-in succeeded.

Analytics

Production deployments may enable Google Analytics, PostHog, and DataFast. These integrations stay off when their configuration is absent, and they load only after the site's analytics eligibility request succeeds. When enabled, they can receive page and interaction information needed to measure readership and improve the service. PostHog can record session replays (with form inputs masked), click heatmaps, and page performance metrics. Tech Twitter can also record an outbound link event with the destination URL, domain, link category, current page, and a shortened copy of the clicked link text. Each analytics provider handles data under its own terms and privacy practices.

Public endpoint protection

Subscription, semantic-search, and machine-evidence endpoints use fixed-window rate limits. Depending on the endpoint, the input to a rate-limit key can be a trusted proxy-provided IP address or an email address. Before a durable counter is stored in Supabase, that input becomes a keyed HMAC value, so the counter holds a hashed identifier rather than the original value. Counters expire with their rate-limit window, and a scheduled maintenance route removes expired public-control state in bounded batches.

Machine-evidence requests

Once a request to the machine-evidence endpoints /api/agent/context and /api/a2a passes the endpoint's rate limit, it is recorded with the time, endpoint, request parameters, outcome, and the client's User-Agent string, without IP addresses, to understand which evidence agents request. Free-text parameters are shortened before they are stored, and the record is not linked to the hashed rate-limit counters.

Public source material

Tech Twitter publishes selected posts, author information, engagement counts, and source links obtained through the official X API. This is public source material used to create feeds, archives, topic pages, summaries, newsletters, and machine-readable evidence. Open Mic is the one way to put a post forward: a signed-in X account can enter its own public posts. The website has no form for uploading private files.

Questions and requests

For a privacy question, a request about an email address used for the newsletter, or a request to delete your Open Mic entries and sign-in record, email daniel@indiethinkers.com. Send the request from the relevant mailbox when possible, and do not include passwords, access tokens, or unrelated sensitive data. This notice may change as the public service or its providers change. The date above identifies the current version.