Privacy Policy — XVault

Last updated: September 23, 2026

Summary

XVault does not collect, transmit, or store any user data on external servers. All data processing happens entirely within your browser, on your own device. XVault is an independent project and is not affiliated with, endorsed by, or sponsored by X Corp.

What XVault Does

XVault is a Chrome extension that backs up the X (Twitter) content visible to your own logged-in account — bookmarks, tweets, replies, media, likes, followers and following — and stores it locally for export. Specifically:

It reads the data that your browser already receives from x.com while you browse, passively and read-only. It never posts, likes, follows or messages on your behalf.
It stores the captured data locally in your browser (chrome.storage.local) and, when you connect a folder, writes files directly into that folder on your device.
It exports data to files (CSV / JSONL / Markdown) only when you explicitly click the export button.

What XVault Does NOT Do

No data collection by us. XVault never transmits your personal information, usage statistics or identifiers to the developer or to any server. Everything it captures stays on your device.
No external transmission. Captured data never leaves your device. The extension makes no network requests except to x.com itself and the license validation endpoint (only when you activate a PRO license).
No tracking or analytics. XVault contains no analytics SDK, no tracking pixels, and no third-party code.
No account required. XVault does not require you to create an account or log in to any service other than x.com.
No remote code. All code is bundled within the extension package. No remote code is loaded or executed.

Data Storage

All captured data stays on your device, in these locations:

chrome.storage.local: Raw data archives, capture cursors/watermarks, statistics and settings. Scoped to your browser profile; deleted when you uninstall the extension.
A folder you choose (optional): If you connect a local folder via the File System Access API, backups and media are written there directly. Those files are ordinary files under your control.
Your Downloads folder (fallback): If no folder is connected, exports and media are saved to your browser's Downloads folder, with the normal save prompts.
IndexedDB: Stores only the handle to the folder you connected (so you are not asked to re-authorize it). No content data.

Data Deletion

You can delete XVault's in-browser data at any time by:

Using Settings → Clear all backups inside the extension (deletes archives and ledgers in chrome.storage.local), or
Uninstalling the extension from Chrome (deletes everything stored in chrome.storage.local).

Files already exported or written into a folder you connected remain where you saved them — delete them like any other files on your device. Clearing x.com site data does not affect XVault's own storage.

GDPR Note

XVault processes data exclusively on your own device (local processing). No personal data is transferred to the extension developer or any third party, except: (a) license key validation when you choose to activate PRO, and (b) payment processing handled entirely by our payment provider (Creem) — XVault never sees your payment details.

Permissions Justification

Permission	Purpose
`storage`	Store captured data locally on your device.
`unlimitedStorage`	Backup archives can grow large; the default quota would be exceeded.
`downloads`	Save exported files and media to your Downloads folder.
`alarms`	Keep long-running backup tasks alive across browser service-worker restarts, so an interrupted backup can resume.
`offscreen`	Assemble export/media files in an offscreen document, outside the service-worker lifetime limit.
Host access: `x.com`, `twitter.com`	Read the data your own logged-in session already loads (bookmarks, tweets, replies, likes, followers, following), so it can be backed up. Read-only.
Host access: `pbs.twimg.com`, `video.twimg.com`	Download your own bookmarked/liked photos and videos in original quality into your local archive.
Host access: `api.creem.io`	Optional PRO license only: checkout, activation and validation via our payment provider (Creem). Never used for your X data.

Third-Party Services

XVault does not use any third-party analytics or tracking services. Payment (PRO license only) is processed by Creem.

Contact

For privacy-related questions, please contact: zhuchunguang.hit007@gmail.com