Privacy

Last updated 19 August 2026

Mutuals helps you find people at companies you are targeting and decide how to approach them. This page says what that involves for your data, in plain terms.

What we store

• Your X account identity. Your numeric X id, handle and display name, plus when we first and last saw you.
• Your email, if you join the waitlist, along with your name and anything you told us about which companies you are after.
• Your campaigns. The role or product you named, your target companies, and the profile text you wrote or that we generated from a CV you uploaded.
• Results. The public X profiles we found for your targets, our scores and notes, and any drafts you generated or edited.
• Credits. An append-only record of every credit granted and spent, so a balance can always be explained.
• Whether your outreach links were opened.Each draft carries its own link to a short page about you. If it is opened we record that it happened, when, and the browser’s user agent so we can tell a person apart from the preview fetchers that load every link in a message automatically. We do not store the reader’s IP address and we cannot tell you who opened it, only that somebody did. Those pages are never indexed by search engines.

What we deliberately do not store

• Your X access tokens.They live in an encrypted, http-only cookie in your own browser and are never written to our database. A database holding live tokens would expose every user's X account at once if it were ever read.
• Your CV. If you upload one, it is held in memory long enough to read, then discarded. The generated summary is kept, the file is not.
• Card details.Payments run through Stripe's own hosted checkout. Card numbers never reach our servers.
• Your X direct messages. We never request the permission to read or send them.

What we never do

We do not message anyone on your behalf.Mutuals drafts text and you decide whether to send it, from your own account. There is no automation that posts, follows, likes or messages as you. This is a product decision, not a limitation, and it is also what keeps us inside X's developer rules.

We do not sell your data, and we do not share it for advertising.

People you search for

Mutuals reads public X profiles: bios, display names, follower counts, verified organisation badges, and who an account follows. It only ever sees what any logged-in X user could see. We cache those public results so the same company does not have to be looked up repeatedly, and that cache is shared between users because the information is not specific to whoever asked for it.

We do not build profiles of people by combining X data with data from other sources, and we do not enrich it with off-platform personal information.

Who else sees your data

• Anthropic, when a draft is generated or a CV is read. The prospect's public profile and your own profile text are sent to Claude to write the message.
• Supabase, which hosts the database.
• Vercel, which hosts and serves the site, and provides the traffic counts we use to see which pages get visited. Those counts are aggregate and cookieless: page views, referrers and countries. No profile is built about you and nothing is sold to anyone.
• Stripe, for payments, and Resend, for the emails we send you.
• X, whose API we query as you, using the access you granted.

Your choices

You can disconnect X at any time from the header, which removes the stored tokens from your browser. To have your account and its data deleted, or to get a copy of it, email us and we will do it. There is no self-serve delete button yet; until there is, a request by email is the way, and we will not make it difficult.

Beta

Mutuals is in beta. Things change often, occasionally break, and this page will be updated when the behaviour behind it does.

Contact

Reply to any email from us, or write to the address on the terms page.