Privacy Policy

Your privacy is important to us. Here's how XCuts handles your data.

Last updated: January 1, 1970

Privacy Policy

XCuts is built to need as little of your data as possible. This page explains exactly what that means.

The short version

  • No XCuts account is required. Optional crossposting connects to your existing Bluesky or Mastodon account.
  • We do not use a tracking SDK. The XCuts classifier records per-request usage counts and a random install id for rate limiting.
  • Your settings, scheduled-post data, and OpenAI API key (if you add one) stay in your browser. The XCuts classifier receives your filter criteria while it runs.
  • AI tweet enhancement sends your draft directly from your browser to OpenAI using your own API key — we never see or relay that traffic.
  • The AI feed filter has two engines you choose between. The default, the XCuts classifier, sends the text of timeline posts to a small service we run, which forwards it to TypeSafe AI for classification and returns a score. We do not store the post text. The alternative, OpenAI with your own key, goes directly from your browser to OpenAI and never touches us.
  • AI requests go to xcuts.studio.gold for the XCuts classifier or api.openai.com for features that use your own key. Cross-posting also contacts the Bluesky or Mastodon destination you select.
  • We do not sell data. TypeSafe AI processes timeline post text and filter criteria for the XCuts classifier.

What we don't collect

There is no analytics SDK, no crash reporting, and no account system in XCuts. We do not receive your draft text, your OpenAI API key, your scheduling data, or your preferences. The one exception to "nothing reaches us" is the AI feed filter when it runs on the XCuts classifier, described in its own section below — and even there, we keep counts, not content.

What's stored, and where

The extension stores a small amount of data locally in your browser using the standard chrome.storage.local API:

  • Your preferences (theme, default schedule offset, randomize-minutes setting, timezone preview choices, focus mode state).
  • Your scheduled-post tracking data (the posts you've scheduled and their send times), used only to power the scheduling UI on x.com.
  • Your AI feed filter settings, if you enable that feature: whether it's on, your custom filter criteria (the text describing what to hide or which interests to highlight), your chosen engine and strictness, and your chosen OpenAI model.
  • Your OpenAI API key, if you choose to add one for AI tweet enhancement and/or the AI feed filter. The same key is used for both features.
  • A random install id (a UUID generated on your device), created the first time the XCuts classifier is used. It is not derived from anything about you or your browser and is used to rate-limit our classifier service per install and measure service usage.

This data stays in your browser's extension storage, except for the install id, post text, and filter criteria sent to our classifier service while it runs. Uninstalling the extension or clearing its storage removes the local data. This is plain browser extension storage, not an encrypted vault or system keychain — treat your API key with the same care you would any credential stored in a browser.

AI tweet enhancement and OpenAI

The AI enhancement feature is optional and only runs when you trigger it. When you use it:

  1. Your draft text and your OpenAI API key are read from local storage.
  2. Your browser sends a request directly to OpenAI's API (api.openai.com).
  3. OpenAI's response is shown back to you in the composer.

The data never touches a server we operate. Your use of this feature is governed by OpenAI's own privacy policy, and any usage costs are billed directly by OpenAI to your account. We recommend reviewing OpenAI's policy if you plan to use this feature.

AI feed filter

The AI feed filter is a separate, optional feature you turn on yourself. When enabled, it reads the text of posts in your home timeline as you scroll and classifies each post against filter criteria you write (for example, "hide generic motivational threads"). Depending on the selected mode, the extension hides or blurs unwanted posts, highlights relevant posts, or shows only matching posts. These actions change your local view; they do not modify posts on X. The feed filter is off by default and only reads and transmits post text while it is enabled. You pick which engine does the classifying:

XCuts classifier (default)

  1. Your browser sends the batch of post texts and IDs, your filter criteria, and your random install id to our classifier service at xcuts.studio.gold.
  2. Our service forwards the post texts, IDs, and criteria to TypeSafe AI, which returns a match probability per post. We hold the TypeSafe API key so you don't need one.
  3. The probabilities come back to your browser, which applies your selected presentation and strictness settings.

What our service keeps: per request, the install id, how many posts were classified, how many tokens that cost, how long it took, and how many posts scored above each strictness level. That is it — we do not store post text, post ids, or your criteria, and the install id is never linked to an X account, IP address, or any identity. We use these counts to size the service and to understand its cost. TypeSafe AI processes the post text under its own privacy policy.

OpenAI with your own key

  • The request goes directly from your browser to api.openai.com — it never passes through a server we operate, and we never see the post text or the classification results.
  • Your use of this option is governed by OpenAI's own privacy policy, and usage costs are billed directly by OpenAI to your account.

In both cases your filter criteria and the fact that the feature is enabled are stored locally, as described above.

Crossposting

Crossposting is optional. If you connect Mastodon, the extension stores your instance URL, access token, account handle, and instance limits locally. If you connect Bluesky, it stores your handle and app password locally. These credentials authenticate requests to the selected service; they are not sent to the XCuts classifier.

When you select a crossposting destination, the extension sends your post text and supported media to that service. It may download media from X's media hosts for the transfer. The destination service processes and retains the content under its own privacy policy. Removing a saved connection clears its local credentials; it does not delete posts already published there.

Browser permissions

The extension requests a small set of permissions, each used only for what's described:

  • storage — to save your settings, API key, and optional crossposting credentials locally in your browser, as described above.

  • clipboardRead — to support the "paste" button next to the API key field in the extension's settings popup, so you can paste your OpenAI API key in without clicking into the field first.

  • Host access to x.com / twitter.com — to inject the scheduling, timezone preview, focus mode, and (if enabled) AI feed filter UI into the page.

  • Host access to api.openai.com — to send the AI enhancement and OpenAI feed-filter requests described above, which only happen when you explicitly trigger AI enhancement or turn on the feed filter with the OpenAI engine.

  • Optional HTTPS host access — requested for crossposting destinations and supported media downloads. The extension checks permitted destinations before sending requests.

The XCuts classifier service is reached with a standard cross-origin request from the extension's background worker and needs no extra host permission. The service records the usage counts described above.

Marketing website

The website has separate, optional analytics integrations. When configured, PostHog can record page views, interactions, and session recordings with inputs masked. Plausible can record page views. These integrations run on the website, not in the browser extension. Their activation depends on the website deployment configuration.

Cookies and tracking

The XCuts extension does not use cookies, pixels, fingerprinting, or a client-side analytics SDK. The classifier service records per-request usage counts and a random install id, as described above.

Children's privacy

The extension is not directed at children. AI and crossposting requests can contain personal information in the content users choose to process. Our classifier records the install identifier and usage counts described above.

Changes to this policy

If this policy changes, the update will be published on this page.

Contact

Questions about this policy? Reach out at hello@aiagent.app or open an issue on GitHub.