X2PIC Privacy Policy

When you click the X2PIC toolbar icon and pick a post:

• The extension captures the visible portion of the current x.com / twitter.com tab and stitches together a PNG image of the posts you chose.
• The resulting image is shown to you in a dialog on the same page.
• You may Download the image to your disk, Copy it to your clipboard, or copy or save the post text as Markdown. All of this happens locally on your device.
• If you click Save photos, the extension downloads the post's original photos directly from X's image server (pbs.twimg.com) and saves them to your disk. Nothing is sent to us.

The image is held in memory only while the result dialog is open and is discarded when you close it. We never receive your captures.

• It does not upload, send, or transmit any capture, post content, account information, or browsing data to us or to any third party. The only URLs it requests from anyone other than our license service are the addresses of a post's original photos, which it downloads from X's image server when you click Save photos.
• It does not include any analytics, telemetry, advertising, tracking pixels, or fingerprinting.
• It does not set cookies or use any remote storage of its own.
• It does not read or store the content of any web page beyond the capture you explicitly make.

Your editor preferences — output style, active annotation tool and sizes, and watermark on/off and text — are saved in the extension's chrome.storage.sync area so X2PIC opens the way you left it. If you are signed in to Chrome with sync turned on, Chrome copies them to your other signed-in devices as part of your Chrome profile; otherwise they stay on this device. They contain no personal data, are never sent to us, and are deleted when you remove the extension.

If you activate Pro, the extension stores in chrome.storage.local, on this device only and never synced: the license record (your license key, the activation ID Creem assigns to this device, the product you bought, the license status and expiry, and when the license was last checked) and, separately, the random device ID described below.

Only if you buy Pro and activate it, the extension sends your license key and a device identifier to our license service — a small Cloudflare Worker we operate — which forwards them to Creem to activate the license, re-check it about once a day and when Chrome starts, and deactivate a device when you ask. When you activate, the device identifier is a random ID the extension generates once (not linked to your identity or your browser profile); for later checks and for deactivation, it is the activation ID that Creem assigned to this device.

Nothing else is sent: no captures, images, URLs, post content, browsing data, or other personal information.

As with any web request, your IP address is visible to the license service (hosted on Cloudflare) and to Creem. The license service uses it only for short-lived rate limiting against abuse and does not store it.

The extension does not request <all_urls> or any host permissions. The license service is reached with standard web requests that it explicitly allows (CORS), so no special site access is needed.

X2PIC Pro is sold through Creem, our merchant of record. At checkout you enter your details (such as your name, email address, billing address and payment information) directly on Creem's pages, and Creem processes them as described in its Privacy Notice. We never see or store your card or payment credentials.

Creem shares with us the order information we need to deliver Pro and support you, such as your email address, the plan you bought, and the status of your order, subscription and license. We use it only to provide Pro, handle refunds and cancellations, answer your messages, and meet legal obligations such as tax and accounting.

The Website (x2pic.buzz) uses Google Analytics 4, a service provided by Google, to understand how many people visit and which pages are useful. Google Analytics sets first-party cookies (such as _ga and _ga_<ID>) and collects information such as the pages you view, the referring site, your approximate location (derived from your IP address), your device, browser and operating system, and how you interact with the page. We look at this information in aggregate to improve the Website.

Google processes this data under its own privacy policy — see also how Google uses information from sites that use its services.

To opt out, you can install the Google Analytics Opt-out Browser Add-on, block or delete cookies in your browser settings, or use a content blocker. The Website works the same without these cookies.

The Website also loads the Inter font from Google Fonts and is hosted on Vercel; both receive standard request data such as your IP address and browser type in order to deliver the page. The Website has no user accounts and no forms. The Chrome extension contains no Google Analytics or any other analytics.

If you email us, we receive your email address and whatever you choose to include, and we use it only to reply and to handle your request (for example, a refund).

• Captures: only in memory while the result dialog is open. We never receive them.
• Preferences, license record and device ID: in your browser until you remove the extension. Deactivating the device deletes the license record; the random device ID stays until you remove the extension.
• License service: does not store your license key, device ID or IP address. Creem keeps license and activation records as part of your order.
• Orders and payments: kept by Creem, and by us, as long as needed to provide Pro and to meet legal, tax and accounting obligations.
• Emails: as long as needed to handle your request and any follow-up.
• Website analytics: for no longer than the retention period set in our Google Analytics property (at most 14 months).

Depending on where you live, you may have the right to access, correct, delete or export your personal data, or to object to or restrict how it is used. To make a request, email timojo.sun@gmail.com. For data held by Creem, you can also contact Creem as described in its Privacy Notice. You also have the right to complain to your local data-protection authority.

We do not sell or rent your personal data.

X2PIC is not directed at children under 13, and we do not knowingly collect personal data from them.

If this policy changes, we will update this page and the "Last updated" date above. Changes that affect what the extension handles will also ship with a new release of the extension.

Questions about this policy or your data? Email timojo.sun@gmail.com. X2PIC is operated by X2PIC Web App Service, Shanghai, China.