What the extension accesses

XPorter accesses the following to perform the exports you start and build the local seen-post dataset:

• X.com session cookies — to authenticate API requests on your behalf, making the same calls X.com already makes in your browser. No credentials are stored or copied.
• X.com API responses — profile info, posts and follower/following lists, processed locally to build your export file (CSV, JSON or XLSX).
• Posts already loaded while you browse X.com — non-reply posts and their public metrics are deduplicated by post ID and stored locally in IndexedDB. No additional request is made and page URLs are not stored.
• Extension settings — your preferences (language, theme, export options) stored locally via Chrome's storage.local.

What XPorter does NOT do

• Does not collect or store your X.com password
• Does not send your exported data, X content, usernames, or browsing history anywhere
• Does not use analytics, advertising, or tracking SDKs during normal use
• Does not store browsing history or page URLs; the local dataset contains post data and the X timeline operation that supplied it
• Does not modify your X.com account (no posting, following or liking)
• Does not inject ads or promotional content
• Does not load any remote code — everything runs from the extension package

Anonymous uninstall feedback

When you uninstall XPorter, Chrome opens a short feedback page. To understand why people leave and what to fix, XPorter attaches an anonymous, non-personal usage summary to that page. It contains only aggregate product stats:

• Extension version, your operating system (e.g. Windows / macOS / Linux), and how long it was installed (install date and the time elapsed until uninstall)
• Interface language and theme (light/dark)
• How many times you opened the extension and roughly how much time you actively spent in it
• How many exports you ran, how many succeeded or failed, and a short error code for the last failure
• How much time had passed since your last export
• Counts per export type (posts, followers, following, verified followers) and per format (CSV / JSON / XLSX)
• The approximate total number of items exported and a few non-identifying settings (e.g. include retweets/replies, quantity limit)
• How long the feedback page itself was open

The data is stored in a private spreadsheet via Google Apps Script / Google Sheets (Google acts as the data processor). It is used only to improve XPorter and is never sold or shared. This is the only data XPorter ever transmits anywhere other than X.com. The anonymous summary is recorded when the feedback page loads; any written comment is sent only if you choose to submit one.

Permissions explained

cookies

Reads authentication tokens (CSRF token) from your X.com session to make authenticated API requests.

activeTab

Detects when you're on an X.com profile and identifies the username being viewed.

downloads

Saves the exported CSV, JSON or XLSX file to your Downloads folder when you click download.

storage & unlimitedStorage

Stores preferences, resumable export batches, recent export history, anonymous usage counters, and the deduplicated seen-post dataset locally in Chrome. unlimitedStorage prevents larger local datasets and exports from being truncated by Chrome's normal storage quota.

Host access to x.com

Required to make API calls to X.com to retrieve the data you asked to export.

Data storage

• Export rows are saved in batches to Chrome's storage.local so interrupted exports can be resumed without losing already saved rows
• Downloaded CSV, JSON, or XLSX files are saved to your local Downloads folder
• The current export and data snapshots for up to five recent history entries may remain locally until they expire, you start or clear an export, clear history, or uninstall the extension
• The seen-post dataset keeps one row per post ID, retains the 50,000 most recently seen unique posts, and remains until you clear it in Settings or uninstall the extension
• Settings are stored in Chrome's storage.local and cleared when you uninstall
• A small anonymous usage counter (including opens, active time, export counts, install date, and last error code) is kept in storage.local to build the uninstall summary, and removed when you uninstall

Third-party services

XPorter integrates with no analytics platforms, ad networks or trackers. Apart from X.com (used to fetch the data you export), the only external communication is the anonymous uninstall feedback above, stored via Google (Apps Script / Google Sheets). XPorter loads no remote code.

Data security

All communication with X.com uses HTTPS. Authentication tokens are handled in memory and are never written to disk or sent to any server other than X.com.

Children's privacy

XPorter is not directed at children under 13 and does not knowingly collect information from minors.

Changes to this policy

Updates will be reflected on this page with a new effective date. Significant changes will be noted in the extension's changelog.

Contact

Questions about this policy or the extension? Message me on Telegram (fastest reply), or email art.lemelson@gmail.com (I check it rarely, so I may be slow). You can also find me on GitHub.

Effective date: June 28, 2026