Privacy policy
Last updated November 7, 2026
What niche collects, who receives it, and what you can ask us to do with it. This page describes what the app does today.
Who is responsible
gomtu operates niche and is responsible for this data. Reach us at gomgomheetuja@gmail.com.
What we collect
- X sign-in
- When you sign in, X gives us your X user ID, handle, display name, profile image address, and follower count, and access and refresh tokens. We store these with an expiry time and a random session ID. We ask X only to read your account and posts and to keep you signed in. We cannot post for you.
- Shared with gomtu.xyz
- The same sign-in is shared with gomtu.xyz, our main site. One session cookie works across gomtu.xyz and its subdomains. gomtu.xyz reads and updates the same stored sign-in, uses your X tokens to keep you signed in and to read your X account for its own features, and stores your following, post, and list counts if you sign in there. It also reads and updates your creator profile here. This page covers niche, not the rest of gomtu.xyz.
- Your profile and rate card
- Handle, X user ID, display name, avatar, bio, follower count, engagement rate, and topic tags, and whether you are discoverable. If you enter them: asking rates, minimum budget, settlement preference, notes for advertisers, and a Telegram contact handle. gomtu.xyz can create or update this profile from its analysis of your account, usually after you sign in there. Its admin tools can also create one from public data for an account it already tracks, and older profiles were imported from an earlier version. You stay off Find creators until you opt in.
- Public X data
- Public profile and post data for creators, including post text, view and engagement counts, and topic labels, from gomtu.xyz's X analytics. We use it to show topic signals and to compute a suggested price. If we have none for a creator who opted in, we add their handle to that analysis queue.
- Wallets
- Each wallet address you link, what it is for, and when you verified it. To link one you sign a message naming your X account, the address, and a one-time code. We store that message and code and check your signature. We do not store the signature.
- Payments
- For a pass: the transaction hash, sending address, USDC amount, pass, time, and your X user ID.
- Campaigns and deals
- Campaign briefs, requirements, budgets, deadlines, tags, and visibility. Invitations and invite links. Applications and pitches. Offers and their amounts and deadlines. Reviews, including the reasons given.
- Submitted posts
- The post URL you submit, and what TwitterAPI.io returns for it: post text, post time, author, whether it is a reply, repost, or quote, and view and engagement counts. We also store the verification result and later metric updates.
- Telegram channels
- Telegram channel verification is not live, and its routes are turned off. A profile imported from an earlier version may still carry channel data. The only Telegram data you can enter today is the contact handle above.
- Security records
- Audit logs of who did what and when, with the campaign and payment details involved. Rate limit counters, which hold a keyed hash of your IP address or X identity, the type of request, and a time window, not the IP address itself. Server error logs.
- Support messages
- Whatever you send us when you contact support.
Who receives it
We use these services to run the app. This is what each one receives.
- Supabase
- Hosts our database, so it holds everything under What we collect. Your browser does not connect to it directly.
- Vercel
- Hosts the app, so it receives every request, including your IP address, browser details, and the page you asked for. It also runs the image service described below, and keeps our server logs.
- X
- Handles your sign-in at x.com. Our server sends api.x.com the sign-in code and your access token, to read your profile once when you sign in.
- TwitterAPI.io
- Receives the ID of each submitted post, to return its text and metrics. gomtu.xyz's X analytics also sends it public handles, to fetch their posts.
- Other X data providers
- gomtu.xyz's X analytics may also send public handles to other providers, such as Sorsa, for audience figures.
- AI model providers
- gomtu.xyz's X analytics sends the text of public posts to AI models, from providers such as OpenAI and Anthropic, to label topics and sentiment. It sends public post data only.
- Base RPC providers
- Our server sends the RPC provider we configure, which may be Infura, each transaction hash it needs to check, and any wallet address whose USDC balance it reads. When you connect a wallet, your browser also talks to the public Base endpoints mainnet.base.org and sepolia.base.org. They can see your wallet address, for example to show your balance, and your IP address.
What others can see
- Anyone, signed in or not
- A public campaign: its title, brief, requirements, budget, X account, the campaign creator's handle, tags, status, posting window, and how many creators are at each stage, but not who they are. If you are discoverable, your entry on Find creators: handle, display name, avatar, follower count, and profile tags.
- Invited people
- A private campaign is hidden from Discover. Only someone with an invite link or invitation can reach it.
- Advertisers with an active pass
- If you are discoverable, your entry on Find creators also shows them your bio, engagement rate, asking price for a single post, and topic signals: the topics your classified posts cover, with post counts, topic share, median views, and when that analysis was last updated. This lasts only while their pass has not expired.
- Advertisers searching for creators on a campaign
- If you are discoverable, the creator search on a campaign shows all of that, and also your suggested price and your record across campaigns: posts submitted and verified, average views, and median cost per thousand views. It also shows the tags of public campaigns you have applied to or been added to. On a manual campaign the search needs the advertiser's active pass. On a campaign funded through the on-chain escrow it is open without a pass while that campaign takes offers.
- The advertiser on your campaign
- If you apply to a campaign or are added to it, its advertiser can see, with or without a pass, your handle, X user ID, display name, avatar, follower count, engagement rate, pitch, asking price, suggested price, offer, deadlines, submitted post, metrics, verification result, and review. They can export a campaign report as a file.
How long we keep it
Records are kept with no automatic deletion schedule. Nothing in the app removes them on a timer.
- Signing out deletes that session's stored sign-in, including its X tokens, and clears the cookie. Other sessions, expired ones included, can stay stored.
- Payment records are kept, because the stored transaction hash is what stops a payment being used twice.
- Audit logs are kept, and the database refuses to change or delete them.
Asking for access or deletion
Email gomgomheetuja@gmail.com or message us on X to ask for a copy of your data or for it to be deleted. We do not hold your email address, so we may ask you to prove you control the X account, for example by messaging us from it.
Some of it cannot be deleted:
- On-chain transactions are public and permanent. Nobody can delete them, including us.
- Payment and audit records stay, for the reasons above.
- Records that other people rely on, such as a campaign's applications, offers, submissions, and reviews, may stay.
- Copies held by the services above, and anything public on X, are not ours to delete.
- Public X data held by gomtu.xyz's X analytics may stay.
Your sign-in is shared with gomtu.xyz, so deleting it signs you out there too. If you sign in to gomtu.xyz again, its analysis can create a new profile for you here.
What we do not do
- niche runs no analytics and no advertising trackers. gomtu.xyz runs Google Analytics on its own pages, and a cookie it sets for the whole domain can be sent along with requests here. niche does not read it.
- We do not sell your personal data.
Changes and contact
We will update the date at the top of this page when this policy changes. Questions go through Support.