Privacy Policy

1. Scope and controller

This Policy describes how TableHQ LLC(“Highlighted,” “we,” “us,” or “our”) handles personal information through Highlighted FYI. It covers creator accounts, Studio, Billing, and public portfolio pages. X and Stripe handle information under their own policies when you use their services.

2. Information we collect

X identity and account information

When you sign in with X, we receive the stable X user ID and current screen name needed to create your Highlighted account and public handle. We use the returned X access token and secret only to finish that sign-in response; they are not returned to our application, stored in our database, or retained in your session.

Portfolio content

We store the profile name, biography, public X post URLs and IDs, folder titles and descriptions, layout choices, ordering, optional post context, private library notes, featured selections, action-button links, publication state, and revision timestamps you submit. We store small re-encoded profile and folder image thumbnails; the original uploaded files stay on your device. Published profiles and folders are intentionally public. Studio also keeps an account-scoped unsaved recovery copy in your browser until a save succeeds or you clear it.

Subscriptions and payments

We store your organization identifier, Stripe customer and subscription identifiers, selected price, subscription and invoice status, payment-method summary, billing event history, and related timestamps. Stripe collects and processes full payment-card and billing details. We do not receive or store complete card numbers.

Sessions, security, and technical information

We use a signed, HTTP-only session cookie backed by a server-side session record. A short-lived encrypted cookie value protects the X request-token secret during the OAuth callback. We may process IP address, request time, route, response status, browser or device information, and security events in ordinary server logs and in-memory rate limits to operate and protect the Service.

Communications

If you contact us, we receive your contact details, message, and any information you choose to include. X sign-in does not provide us with your email address, so Highlighted does not obtain an account email from X.

3. Public pages and X embeds

A public profile can expose your X handle, profile text, folder and post context, arrangement, and the public posts you selected. Search engines and other people may index, share, or copy public pages.

Public post cards load X's official widget in the visitor's browser. That connection discloses information such as the visitor's IP address and browser details directly to X, and X may use its own storage or receive information according to its policy. We request X's do-not-track embed option, but we do not control X's processing. The original post remains hosted by X. We also fetch X’s public oEmbed preview through our server and temporarily cache its text and attribution for at most one hour, within X’s advertised cache lifetime. This preview can be shortened or unavailable; it is not a permanent copy of the original post.

4. Sources of information

We receive information:

• from you when you edit Studio, choose a plan, or contact us;
• from X when you authenticate and from public X URLs you submit;
• from Stripe about customers, subscriptions, invoices, and payment status; and
• automatically from your browser and our infrastructure when you use the Service.

5. How we use information

We use information to:

• authenticate creators and maintain current handle claims;
• save Studio work and display portfolios you publish;
• provide trials, subscriptions, access control, and Billing;
• respond to support and privacy requests;
• prevent fraud, abuse, and unauthorized access;
• diagnose failures and maintain service reliability; and
• comply with law and enforce our agreements.

We do not sell personal information, share it for cross-context behavioral advertising, use private Studio content for targeted ads, or make decisions with legal or similarly significant effects based solely on automated processing.

6. Cookies and browser storage

Highlighted uses essential cookies for sign-in, OAuth security, and selected-plan return paths. Theme preferences and unsaved Studio recovery data may be stored locally in your browser. You can clear browser storage or block cookies, but doing so can sign you out, remove an unsaved recovery copy, or prevent account features from working.

Highlighted does not currently load our audience analytics or session replay on its pages. X embeds are third-party content and may use separate browser technologies controlled by X.

7. How we disclose information

We may disclose information to:

• service providers for hosting, databases, security, and technical operations;
• X for the sign-in and embed interactions you request, and Stripe for billing and payment processing;
• advisers or authorities when reasonably necessary to comply with law, protect rights and safety, or investigate abuse; and
• a successor in a merger, financing, reorganization, or sale, subject to appropriate confidentiality and notice.

We also disclose information when you intentionally publish it on a public profile or folder.

8. Legal bases

Where data-protection law requires a legal basis, we process account, portfolio, and billing information to perform our contract with you; security, reliability, support, and limited operational records for our legitimate interests; information needed to satisfy legal obligations; and information based on consent where we specifically request it. You may withdraw consent for future processing at any time, without affecting earlier processing.

9. Retention and deletion

We generally retain account and portfolio information while your account remains open. Canceling a subscription does not automatically delete the account or its public portfolio. We retain billing, security, dispute, and backup records for as long as reasonably necessary for their purpose and legal obligations, then delete or de-identify them.

You can export your links, notes, folders, profile, and uploaded thumbnails from Studio, including after a subscription ends. The export excludes X-served post text and media. You can also unpublish or delete your portfolio content from Studio.

To request account deletion, email us from information reasonably connected to the account. Deletion removes the Highlighted account and public portfolio after verification and any legally required retention; it does not delete posts or copies controlled by X or others.

10. International processing

We and our providers may process information in the United States and other countries whose laws differ from those where you live. Where required, we use a recognized transfer mechanism or another lawful safeguard. Contact us to ask about safeguards applicable to your information.

11. Security

We use reasonable administrative, technical, and organizational measures designed to protect information. No transmission, storage, or authentication system is completely secure, so we cannot guarantee absolute security.

12. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a portable copy of personal information, and to appeal a denied request. You may also complain to your local data-protection authority. You have the right to object to processing based on legitimate interests where applicable.

Submit a request to support@highlighted.fyi. We may verify your identity and authority before completing it. We will not discriminate against you for exercising a privacy right. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or targeted-ad opt-out to exercise for our own processing.

13. Children

Highlighted is not directed to children under 13, and creator accounts are limited to adults under our Terms. If you believe a child provided personal information, contact us so we can investigate and delete it where appropriate.

14. Changes and contact

We may update this Policy as the Service or law changes. We will post the new effective date and provide reasonable notice of material changes. Questions and privacy requests may be sent to support@highlighted.fyi.