XTract — Privacy Policy

Overview

XTract is a Chrome browser extension that exports X/Twitter followers and following lists to CSV and JSON files. This policy describes what data the extension accesses, how it is used, and who it is shared with.

Data Collection and Use

Data the extension accesses

XTract accesses the following data solely to perform exports you initiate:

• X/Twitter session tokens (Bearer token and CSRF token) — captured from your existing browser session to authenticate API requests on your behalf. These tokens are stored locally in Chrome's extension storage and are never transmitted to any external server.
• X/Twitter public profile data — usernames, display names, bios, follower/following counts, tweet counts, verified status, profile images, locations, websites, and account creation dates of the accounts in the exported list.

How the data is used

• Session tokens are used only to make requests to X/Twitter's API to fetch follower and following data.
• Profile data is formatted into CSV and JSON files and downloaded directly to your computer.
• All data processing happens locally in your browser. No data is sent to, processed by, or stored on any external server operated by us or any third party.

Data the extension does NOT collect

• No personal information (name, email, address)
• No browsing history
• No analytics or telemetry
• No cookies (beyond reading X's existing session cookie for authentication)
• No keystroke or form data

Data Storage

• Session tokens are stored temporarily in chrome.storage.local and are automatically cleared when the associated tab is closed.
• Exported files are saved to your local device via Chrome's download API. The extension does not retain copies of exported data.

Data Sharing

XTract does not share any data with third parties. No data leaves your browser. There are no analytics services, advertising networks, or external APIs contacted other than X/Twitter's own API (to perform the export you requested).

Permissions

XTract requests the following Chrome permissions:

Permission	Why it's needed
host_permissions for x.com	To capture authentication headers and make API requests to X/Twitter
storage	To temporarily store session tokens and export settings locally
downloads	To save exported CSV and JSON files to your computer
tabs	To open the X/Twitter profile page when you start an export
webRequest	To capture authentication headers from X/Twitter network requests

Changes to This Policy

If this privacy policy is updated, the changes will be posted at this URL with an updated "Last updated" date. Continued use of the extension after changes constitutes acceptance.