This Privacy Policy explains how Tom Turcotte ("I", "me", or "my"), operating XGrowthEngine at www.xgrowthengine.com from Sault Ste. Marie, Ontario, Canada, collects, uses, discloses, and protects your personal information through the X Growth Engine: Feed History Chrome extension.

This policy applies only to the Chrome extension. Our main web service at www.xgrowthengine.com has its own separate Privacy Policy. This document complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and aligns with its 10 fair information principles. If you are in the EU, GDPR may apply; in California, CCPA/CPRA; in the US, COPPA for children's data.

The extension works completely offline and locally by default. You can optionally connect your X Growth Engine web account (by pasting an API key) to unlock cloud sync and advanced features. By installing or using the extension, you consent to these practices. Contact me at tom@xgrowthengine.com for questions.

1. Information We Collect

Public X Post Data (read-only): Post text, author username/name, timestamps, media URLs (images/videos), and basic engagement signals (e.g., whether you liked or replied to a post).
Local Usage Statistics: Number of posts seen, unique creators, daily insights, and your own feed activity summary.
Settings & Optional Account Data: User preferences, API key (if you choose to connect your paid/contributor account).
Anonymous Analytics: Minimal usage events (e.g., popup opened, export clicked, voluntary features toggled) collected via PostHog.

We do not collect browser history, page titles outside X, emails, IP addresses (beyond standard web requests), passwords, private messages, or any non-public content. All data stays on your device unless you explicitly opt in to cloud features.

2. How We Collect Information

Content Scripts run only on https://x.com/ and https://twitter.com/ to passively detect and record publicly visible posts in your timeline.
Browser Storage (chrome.storage.local with unlimitedStorage permission) saves post snapshots locally.
Optional Network Requests: Only when you enable Voluntary Contributor mode or connect your paid account. These go first to the X Growth Engine backend (never directly to X/Twitter APIs).
PostHog Analytics: Anonymous events are sent automatically when you use the extension (same PostHog project as the main web app).

3. Purposes for Collection and Use

To provide the core features: passively recording your X feed, creating a local searchable history, and generating daily insights.
To enable optional cloud sync, unlimited history, and contributor features (only if you choose them).
To improve the extension through anonymous analytics (PostHog). We collect only what is necessary and limit use to these purposes.

4. Legal Basis

Under PIPEDA, we rely on meaningful consent (you install the extension and can disable features at any time). For GDPR, bases include contract necessity (providing the service you requested) and legitimate interests (product improvement via anonymous analytics).

5. Sharing and Disclosure

PostHog: Anonymous analytics only (our subprocessor).
Your X Growth Engine Backend: Only if you voluntarily enable Contributor mode or connect your paid account. Data is never sold or shared with third parties for advertising.
We may disclose data if required by law.

No data leaves your browser without first going through our servers (and only when you explicitly choose to sync).

6. Data Retention

Free tier: Up to 1,000 posts (oldest posts are automatically pruned).
Contributor tier: Up to 10,000 posts.
Paid tier: Much higher limits with cloud backup. You can manually clear all local data at any time from the extension Settings tab. When you uninstall the extension, Chrome automatically clears all stored data.

7. Security Measures

All data is stored locally in chrome.storage.local. Optional network requests use HTTPS. We use backend-generated, revocable contributor keys and rate limiting on sync endpoints. While local storage is not encrypted (standard practice for most history extensions), data never leaves your device unless you choose to sync.

8. Your Rights

You can:

Clear all local data instantly from the Settings tab.
Disconnect your account or disable sync at any time.
Uninstall the extension (Chrome clears data automatically).
Request access, correction, or deletion of any synced data by contacting me. Responses to PIPEDA requests are provided within 30 days.

9. Cookies and Tracking

The extension does not use traditional cookies. It uses browser storage (chrome.storage) and PostHog for anonymous analytics only. You can disable PostHog tracking in future settings if available.

10. International Transfers

Any optional synced data is transferred to our servers and PostHog (which may be located in the United States or Germany). Transfers outside Canada are protected by the EU-U.S. Data Privacy Framework (DPF), Standard Contractual Clauses, and equivalent safeguards under PIPEDA.

11. Children's Privacy

The extension is intended for users who are old enough to have an X account (generally 13+). We follow the same age-of-consent restrictions as the main X Growth Engine web app. Users under the age of consent in their jurisdiction must not install or use the extension. If discovered, we will terminate any associated account and delete data.

12. Changes

The latest version of this policy is always available at https://www.xgrowthengine.com/extension-privacy (or the URL you publish in the Chrome Web Store). Significant changes will be emailed to connected accounts with 7 days' notice.