The Twitter (X) Privacy Policy, effective 15 January 2026, says X collects what you give it, what it records while you use X and what partners send it, then uses that data to run X, show ads and help train its AI models. X states plainly that it doesn't sell your personal information, but it keeps most data for as long as your account exists, and some for set periods of 12, 13 or 18 months.
X's own policy starts by admitting that most people want something short and easy to understand. So here's the version that matters: what's collected, how long it's kept, who sees it and the settings that change any of it.
What X collects about you
The policy sorts everything into three groups:
| Category | Examples X lists | Public? |
|---|---|---|
| Information you provide | Display name, username, password, email or phone, date of birth, display language, payment card details for paid services | Name and username are always public |
| Information from using X | Your posts, Spaces, lists, bookmarks, Communities, likes and replies, DM contents and recipients, device and approximate location | Posts are public unless protected; DMs aren't |
| Information from third parties | Cookie IDs, hashed emails and actions on other sites from ad partners, plus data from services you link to X | No |
Two details surprise people. First, the device data goes further than you'd guess: X lists your advertising ID, carrier, apps installed and even battery level. Second, if you set up a Professional Account, any street address, contact email and contact phone you add will always be public.
Does X read your direct messages?
X's policy says it collects information when you use Direct Messages, including the contents of the messages, the recipients, and the date and time. For Encrypted Messages it lists metadata, not contents. Treat ordinary DMs as something X can access, and don't send passwords, card numbers or anything confidential that way.
Does X sell your data?
No, according to its own policy: section 6 says, in X's words, that it doesn't sell your personal information. But that isn't the whole picture. X shares data with service providers, advertisers, its affiliates and, depending on your settings, business partners. And the policy says X may share, sell or transfer information about you as part of a merger, acquisition, reorganisation, sale of assets or bankruptcy.
There's a setting for the partner sharing. In your Privacy and Safety settings, the Data sharing with business partners option controls whether X shares your personal information with those partners.
Does X use your posts to train AI?
Yes. The policy says X may use the information it collects, plus publicly available information, to help train its machine learning and artificial intelligence models. It goes further for outside companies: if you don't opt out, some third-party collaborators that receive your data may use it for their own purposes, including training their own AI models. Check your data sharing settings if that bothers you.
How long X keeps your data
| Type of data | How long X keeps it |
|---|---|
| Profile details (display name, username, password, email) | For as long as your account exists |
| Posts and interactions | For as long as your account exists, or until the content is removed |
| Payment card details | While you use paid services; transaction records longer, as the law requires |
| Emails and other messages you send X | Up to 18 months |
| Cookies and data collected through them | Up to 13 months |
| Ad views and interactions, and data from ad partners | Up to 12 months |
| Browsing data from X buttons and embeds on other websites | Deleted, obfuscated or aggregated within 30 days |
| Email or phone used to create an account that was suspended | Possibly indefinitely, to stop repeat offenders |
X can keep anything longer when the law, a legal claim or a safety investigation requires it. And deleting a post on X doesn't wipe copies elsewhere: the policy warns that search engines and other third parties may keep their own copies.
How to delete your X data
- Deactivate your account from your settings. X says your data is then queued for deletion.
- Wait out the 30-day window. For up to 30 days after deactivation, the account can still be restored if it was deactivated by accident.
- Download your data first if you want a copy, because X lets you request a copy of your information, such as your posts.
- Expect an identity check on any access or deletion request, because X verifies who you are before acting.
For the companies behind the policy, see X's legal entities and headquarters.
The settings that change what X collects
The policy keeps pointing back to your settings, and these are the ones that make a real difference:
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
- Data sharing with business partners, under Privacy and Safety.
- Precise location, which is off unless you choose to share it.
- Address book upload, which X only uses if you choose to share your contacts.
- Find me by email or phone: X says it uses your contact details to help others find your account only if your settings permit.
If you want a quicker way through all of them, my X account privacy audit goes setting by setting, and you can make your Twitter account private so only approved followers see your posts. It's also worth knowing what X now shows about where an account is based.
My verdict
The X Privacy Policy is more honest than most about the trade: X is a public platform, it collects a lot, and it uses your posts to train AI. It doesn't sell your data in the usual sense, and the retention limits for cookies and ad data are clear. My advice is simple: post as if it's public forever, keep sensitive conversations out of DMs, and spend five minutes on the data sharing settings. That gets you most of the control the policy offers.
If you have a privacy question, the guide to contacting X support explains who to try and what to expect.
If you want the full set, start at the Twitter (X) Help: 21 Guides to Features, Verification, Video Fixes and Tools.
Frequently asked questions
Does X sell your personal information?
X's Privacy Policy says it doesn't sell your personal information. It does share data with service providers, advertisers, affiliates and, depending on your settings, business partners.
Does X use my posts to train AI?
Yes. X's Privacy Policy says it may use the information it collects and publicly available information to help train its machine learning and AI models.
How long does X keep my data?
Profile details and posts are kept for as long as your account exists. Emails to X are kept up to 18 months, cookie data up to 13 months and ad interaction data up to 12 months.
Can I get my X account back after deactivating it?
Yes, for a limited time. X's Privacy Policy says that for up to 30 days after deactivation, an account can still be restored.
