Privacy Policy

Overview

X-Pat is a browser extension that displays the declared location of X / Twitter profiles as a flag emoji and can highlight accounts by location or keyword. We are committed to your privacy. By default, everything the extension does happens locally in your browser. The one exception — an optional, off-by-a-single- toggle community cache — is described below.

Data We Do Not Collect

The extension does not collect, store, or transmit:

• Your browsing history or activity on X / Twitter
• Your X / Twitter account credentials, cookies, or session tokens
• Profile bios, display names, or other profile content of users you view
• Any personally identifiable information (PII)

Location and other lookup results are cached locally in your browser (IndexedDB) and your settings are stored in the browser’s extension storage. This stays on your device.

How Location Is Fetched

When you hover or swipe a profile, the extension requests that profile’s publicly declared location directly from X / Twitter’s own API, using the X session already present in your browser — exactly as the X website does when you view a profile. This request goes to X directly; it is not routed through, or seen by, us.

Optional: Shared Community Location Cache

The extension includes an optional feature — controlled by the "Use shared community location cache" toggle in its options — that lets users share already-public location flags with one another, so everyone avoids repeating the same lookups. When it is enabled, the extension exchanges data with a server operated by us (a Cloudflare Worker) for that sole purpose.

What is sent:

• the public handle you looked up (for example, jack);
• its location flag data: the location string (e.g. JP), the source (e.g. Japan Android App), and a "location may be inaccurate / VPN" indicator;
• an anonymous, randomly generated installation ID (a UUID created on first run) used only to agree on a consensus value across independent contributors and to resist abuse.

What is never sent: your X account, username, email, cookies or session tokens; profile bios or display names; your browsing history; or any personal identifier beyond the ordinary network metadata of an HTTPS request.

Contributions are stored on the community server only to build the shared cache, keyed by the public handle and the random installation ID — never by your identity. They are not sold, rented, or used for advertising.

To keep the cache useful, the extension also looks up accounts that appear in your feed in the background, rather than only the ones you hover — the same public handles X has already sent your browser, at a deliberately slow pace. The toggle governs both: switch it off and background lookups stop with it, the extension makes no requests to the community server, and a location is only fetched when you hover or swipe a profile yourself.

Analytics on This Website

This website (the page you are reading) uses Google Analytics to collect anonymous, aggregated visit statistics so we can understand traffic and improve the site. This applies to the website only — the browser extension itself contains no analytics, telemetry, or tracking of any kind.

Google Analytics data is governed by Google’s Privacy Policy. You can opt out via the Google Analytics Opt-out Browser Add-on.

Permissions

The extension requests only the permissions necessary to read location information from X / Twitter and to store your settings and local cache. These permissions are used exclusively for their stated purpose and grant us no access to your personal accounts or data.

Data Sharing and Selling

We do not sell your data and do not share it with third parties for advertising or any unrelated purpose. The only network destinations are X itself (for the location lookups your browser already makes) and, if you opt in, the community cache server described above.

Changes to This Policy

If we update this privacy policy, we will post the revised version here with a new "last updated" date. Continued use of the extension after any changes constitutes acceptance of the revised policy.

Contact

Questions or requests: asmyshlyaev177+x-ext@gmail.com.