XPilot Privacy Policy

What XPilot stores, and where

Everything XPilot keeps is stored on your device, in Chrome’s local extension storage, chrome.storage.local. It never leaves your computer unless you have Chrome sync your extension data yourself, and XPilot never reads it back for any purpose other than showing it to you.

• Settings — the master switch, which features are on, and each feature’s options.
• Ideas — the notes you write in the Ideas panel, and posts you save to it with the lightbulb. A saved post keeps the public post’s author name, handle, avatar URL, text, media URLs, date and link, so the panel can show it as a card. Deleting an idea deletes it.
• Time on X — how long you spent on x.com each day, as one record per day with an hourly breakdown. Only durations are kept: never what you looked at, posted, or who you interacted with.

Removing the extension removes all of it. There are no accounts and nothing to sign in to.

What XPilot reads on x.com

XPilot runs only on https://x.com/*. To do its job it reads, inside the page:

• X’s own responses to the page. To remove ads before they are drawn, and to show follower counts on posts, XPilot reads the GraphQL responses X’s own web app has already requested, as they arrive in the page. Ads are taken out of those responses before X draws them; follower counts and follow state are read from them. XPilot makes no requests of its own, adds nothing to X’s requests, and does not send any of this data anywhere.
• The page itself. Posts on screen, to add the lightbulb, the follower counts and (if you turn them on) the Follow buttons; which X page you are on and whether the tab is visible, for Time on X.

XPilot never acts on your account on its own. The only account action it can take is the optional Inline Follow button, which is off by default and follows one account only when you click it, by pressing X’s own Follow button.

Permissions used

• storage — the local storage described above.
• idle — Time on X asks Chrome whether you are at the computer (any input, or the screen locked) so it stops counting when you walk away. Chrome reports only “active”, “idle” or “locked”, never what you are doing.
• Content scripts on https://x.com/* — the extension’s UI, ad removal and reading of X’s responses, as above. No other site is accessed.
• Background service worker — relays the idle state to x.com tabs. It makes no network requests.

Third parties

None. XPilot does not load remote code, fonts, images or scripts of its own, and does not include analytics, crash reporting or advertising SDKs. Avatar and media images shown in saved cards are loaded from X, exactly as the X page already loads them.

Changes

If this policy changes, the new version will be published at the same address and the “Last updated” date will move.

Contact

Questions about privacy: open an issue on the XPilot repository, or email the developer at the address on the Chrome Web Store listing.