Privacy Policy

What XReplyGen does

XReplyGen helps you create editable reply, single-post, thread and quote-caption drafts. You review the text and press Post in X yourself; it does not automate replies, likes, follows, messages or bulk interaction. When you explicitly request a reply, the visible target post, selected visible context, your point and language/tone preferences go to your configured HTTPS BYOK provider, or to the first-party managed service when enabled and explicitly selected. Only if you select image context are up to three associated public post images included; image support depends on your provider, and text-only fallback is disclosed. Rewriting additionally sends your edited draft. Localize uses your typed text and explicit target language to produce a translation, without using voice examples or promotion background. A managed translation request may also carry saved product settings (such as name, description, URL and relationship) to the first-party service; the backend ignores them when generating the translation. Posts saves topics, pasted facts, intent, optional quote link and edited drafts locally. Generate/Refine sends the supplied writing inputs and preferences to your selected provider or enabled managed service; the quote link is only for manual X handoff, is not fetched and is not sent to the model. Copy and Open X require your choice and do not publish automatically. Clearing Posts removes its local workspace record, not provider inputs or server billing records.

Data handling

The extension does not sell personal data, scrape cookies, or collect browsing history. Your provider URL, model, API key, settings and generated draft history are stored in chrome.storage.local on your device. Your API key is sent to the HTTPS provider you choose for authorization. Built-in origins are declared in the manifest; custom origins request permission when saved. Source post text is not added to draft history. You may favorite, copy, delete or clear generated drafts. Account access, managed generation, Pro and Waffo checkout are available only when the first-party service enables and verifies the corresponding capability; new PayPal checkout is unavailable. When you choose enabled Google sign-in, Google supplies your provider account identifier, name, email/verification status and profile image. The first-party service stores the account link and authentication/session records, which may include OAuth tokens, session expiry, IP address and user agent. The extension stores a first-party extension token and verified account/entitlement information in browser-local settings and sends the token to the first-party service for authenticated requests, not to your BYOK provider. The local writing library is not automatically synchronized across accounts. Product profiles, optional promotion inputs and product-mention records remain separate from that library.

Local writing examples and optional voice profile

A separate human-authored library holds at most 50 examples, up to 500 characters each, a profile handle, writing preferences, common expressions and optional personal background. Paste and confirm your own writing, or explicitly preview only currently visible replies on your own Profile → Replies page. The visible signed-in profile, page handle and reply author must match; ambiguous identity asks you to paste instead. No scrolling, private API or background collection is used. Nothing is selected by default; you select what to import. Generated drafts never become human examples. Samples and profile fields are stored locally and are not sent through Free BYOK. In an enabled managed Pro flow, clicking Generate sends up to five deterministically selected relevant/representative examples and necessary profile fields for that draft only when the profile is enabled, server-verified Pro is active and the visible handle matches. The server independently verifies entitlement. This local match is not verified X ownership. Translation does not use voice examples or promotion background; managed requests may carry saved product settings that the backend ignores for translation.

You may delete one example, clear all examples/preferences or disable the profile. Changing the profile handle clears its former library. Mutations invalidate local request/cache state, abort the browser request and reject late output; they cannot withdraw data already received by a provider or guarantee its processing stops. The client does not place samples in generated-draft history, payment metadata or analytics. Explicit generation transmission is processing for your request, not cloud synchronization of the local example library. The managed result cache has the separate retention rule described below; request identifiers, digests, status, account/timestamps, quota and billing records are not all deleted with cached output.

Third-party processors

Free BYOK sends only inputs needed for your explicit drafting, rewriting or translation request directly to your selected HTTPS OpenAI-compatible provider. Each provider sets its own retention and training policy; XReplyGen makes no universal no-training, zero-retention or immediate-deletion promise about those services. When managed generation is enabled and you choose it, the selected post/context, your point, writing preferences and any eligible explicitly enabled profile examples/fields go to the first-party XReplyGen backend, then through our self-hosted 9router gateway and its configured model service. The server independently verifies entitlement; upstream credentials remain server-side. Translation does not use voice examples or promotion background; managed requests may also carry saved product settings to the first-party service, where they are ignored for translation. When Waffo checkout is enabled and you choose to purchase, Waffo hosts card entry and processes payment; the extension does not collect a full card number or card security code. The seller or merchant of record, price, taxes, renewal and refund terms are identified before purchase. New PayPal checkout is unavailable.

Manual X handoff and account identity

This release uses manual X handoff. It does not request X OAuth authorization, verify ownership of an X account, automatically publish posts, or retrieve X account metrics. The separate server X integration remains disabled and is not included in the current offer. A product login for hosted generation or paid entitlement is separate from X account verification.

Local plans, calendar export and metric snapshots

Plans and snapshots stay in chrome.storage.local, separate from writing examples and generated drafts. You declare a handle to choose a local partition; this does not sign in to X, connect an account or verify ownership. Up to 10 partitions each hold at most 100 plans and 200 snapshots. Plans contain text, declared handle, UTC time, timezone, your recorded status and optional published link. Snapshots contain a matching post URL/ID, observation time, source, cumulative scope and manually entered visible counts. Blank is unknown; zero stays zero. These records are never sent to a model or server, and this workflow does not fetch X metrics or private APIs. Comparisons use only the same account, post, source and scope at different times; corrections may produce negative changes, and page views are not unique audience. Recorded scheduled/published labels are your declarations, not X receipts. This version has no timers, alarms, notifications or background publishing; due dates are calculated when you open or refresh the workspace. Open X passes planned text only when clicked, and you check the active account and publish or schedule manually. ICS export includes the exact text and a generic ten-minute reminder; your calendar handles import, alerts and synchronization. ICS/JSON exports contain private text and metrics and are not uploaded by the extension. You may edit an unrecorded plan, delete individual plans/snapshots or delete a selected partition after confirmation. Switching handles clears unsaved inputs while saved partitions remain until deleted. Local deletion cannot retract a provider input, exported file, calendar event or X post, or cancel an X schedule; manage those in the respective service. JSON export uses xreplygen-local-account/v1 and does not import arbitrary official files. Request server/account deletion at hello@xreplygen.any1tan.com under the separate retention rules below.

Billing records and data rights

XReplyGen may store the account link, provider, order or transaction identifier, product or plan, amount, currency, timestamps, verified payment status, refund or chargeback status, and subscription or entitlement lifecycle needed to deliver and reconcile paid access. Enabled Waffo checkout uses buyer email, selected plan and order/subscription identifiers; the backend stores payment callback results, event identifiers, digests and processing status to verify entitlement, reconcile delivery and prevent duplicate processing. Voice examples, post text and generation prompts are not sent as payment metadata. Visiting a success page alone does not grant Pro; the service rechecks persisted server entitlement. It does not sell personal information or use billing data for advertising. Where applicable law provides these rights, users may request access, correction, deletion, restriction, portability, or an objection by email. Some transaction and security records may need to remain after account closure for tax, accounting, fraud-prevention, legal, or dispute purposes.

Retention and deletion

Local extension data remains until the user clears it or uninstalls the extension. Account, public product-profile, entitlement, support, security, and signed payment-event records are retained only as needed to provide the service, prevent abuse, meet tax, accounting, and legal obligations, and resolve refunds or payment disputes; they are then deleted, anonymized, or archived where the law requires continued retention. Users may request account and product-profile deletion by email. Paid and account features are not intended for children under 13. Managed reply/compose cached output is no longer reusable once 24 hours have elapsed from the request record’s creation time. Expired result content is cleared by a periodic cleanup job, normally every five minutes. With healthy scheduling and no backlog, clearing may occur at about 24 hours plus one cleanup interval; delays or backlog may take longer. This is not complete deletion within 24 hours: request identifiers, input digests, status, account/timestamps, quota and payment records remain separate, and the job does not physically erase WAL files or backups. Upstream retention and training are governed by the relevant service policy, not by our cache limit. Signing out clears local account access, and uninstalling removes browser-local extension data; neither deletes the server account or records or retracts data already sent to a provider, X or a calendar. Account/data deletion requests remain subject to the purposes and rights described above.

Floating display preferences

Cosmetic preferences stay in chrome.storage.local: width, expanded height, background opacity, position, auto-open, circle/banner entry and size preset. They contain no post text, account identifiers or drafts and are not sent to a provider. Background opacity affects background layers only; text and controls remain opaque. Reset restores presentation defaults; Pause auto-open still permits explicit reopening in an eligible context. A one-time local preference migration changes the default entry to a circle while preserving dimensions, opacity, position, pause and later explicit Banner choices. The assistant observes the current visible reply composer and local post-detail route only to show or hide its UI; it has no permanent timeline overlay and excludes ordinary new-post composers. Route checks stop when the content script is cleaned up. These settings add no permissions, browser-history collection or provider requests.

Contact

For privacy questions or deletion requests, contact hello@xreplygen.any1tan.com.