Privacy Policy

Your privacy is important to us. Here's how XCuts handles your data.

Last updated: January 1, 1970

Privacy Policy

XCuts is built to need as little of your data as possible. This page explains exactly what that means.

The short version

  • There is no account, no login, and no backend server for XCuts.
  • We don't collect, track, or store anything about you or your usage. XCuts sends no analytics or telemetry to us, ever.
  • Your settings, your scheduled-post data, your feed-filter criteria, and your OpenAI API key (if you add one) are saved locally in your browser and never sent to us.
  • If you use AI tweet enhancement or the AI feed filter, the relevant text (your draft, or posts in your timeline) is sent directly from your browser to OpenAI using your own API key — we never see or relay that traffic.
  • All network traffic XCuts generates goes to exactly two places: x.com (the page you're on) and, only when you use an AI feature, api.openai.com.
  • We don't sell or share data, because we don't have any to sell or share.

What we don't collect

XCuts has no server component. There is nothing for the extension to send data to, so there is no analytics, no crash reporting, no usage tracking, and no account system. We have no way of knowing who has installed the extension, how it's used, or what you post. We do not receive your draft text, your timeline content, your OpenAI API key, or your scheduling data — none of it passes through us at any point.

What's stored, and where

The extension stores a small amount of data locally in your browser using the standard chrome.storage.local API:

  • Your preferences (theme, default schedule offset, randomize-minutes setting, timezone preview choices, focus mode state).
  • Your scheduled-post tracking data (the posts you've scheduled and their send times), used only to power the scheduling UI on x.com.
  • Your AI feed filter settings, if you enable that feature: whether it's on, your custom filter criteria (the text describing what to hide), and your chosen model.
  • Your OpenAI API key, if you choose to add one for AI tweet enhancement and/or the AI feed filter. The same key is used for both features.

This data stays on your device, inside your browser's extension storage. It is never transmitted to us — again, because we don't run a server for it to go to. Uninstalling the extension or clearing its storage removes this data. This is plain browser extension storage, not an encrypted vault or system keychain — treat your API key with the same care you would any credential stored in a browser.

AI tweet enhancement and OpenAI

The AI enhancement feature is optional and only runs when you trigger it. When you use it:

  1. Your draft text and your OpenAI API key are read from local storage.
  2. Your browser sends a request directly to OpenAI's API (api.openai.com).
  3. OpenAI's response is shown back to you in the composer.

XCuts is a pass-through for this one request — the data never touches a server we operate. Your use of this feature is governed by OpenAI's own privacy policy, and any usage costs are billed directly by OpenAI to your account. We recommend reviewing OpenAI's policy if you plan to use this feature.

AI feed filter and OpenAI

The AI feed filter is a separate, optional feature you turn on yourself. When enabled, it reads the text of posts in your home timeline as you scroll and sends that text to OpenAI's API, using your own API key, to classify each post against filter criteria you write (for example, "hide generic motivational threads"). Posts OpenAI classifies as a match are hidden from your view of the timeline; nothing else happens to them.

As with AI enhancement:

  • The request goes directly from your browser to api.openai.com — it never passes through a server we operate, and we never see the post text or the classification results.
  • Your filter criteria and the fact that the feature is enabled are stored locally, as described above.
  • Your use of this feature is governed by OpenAI's own privacy policy, and usage costs are billed directly by OpenAI to your account.
  • The feed filter is off by default. It only reads and transmits post text while it is enabled.

Browser permissions

The extension requests a small set of permissions, each used only for what's described:

  • storage — to save your settings and API key locally in your browser, as described above.
  • clipboardRead — to support the "paste" button next to the API key field in the extension's settings popup, so you can paste your OpenAI API key in without clicking into the field first.
  • Host access to x.com / twitter.com — to inject the scheduling, timezone preview, focus mode, and (if enabled) AI feed filter UI into the page.
  • Host access to api.openai.com — to send the AI enhancement and AI feed filter requests described above, which only happen when you explicitly trigger AI enhancement or turn on the feed filter.

No other sites are accessed, and no permission is used for tracking or analytics.

Cookies and tracking

XCuts does not use cookies, pixels, fingerprinting, or any other tracking technology. We have no analytics of any kind.

Children's privacy

XCuts does not knowingly collect data from anyone, of any age, because it does not collect data at all.

Changes to this policy

If this policy changes, the update will be published on this page.

Contact

Questions about this policy? Reach out at hello@aiagent.app or open an issue on GitHub.