Privacy policy

xbird is built so that we never hold your data in the first place. This page explains exactly what touches what.

Twitter credentials

  • Your auth_token and ct0 cookies are auto-detected locally from your browser, or supplied by you explicitly.
  • They are stored only on your machine (local config), encrypted where applicable.
  • For the hosted REST API, credentials are encrypted client-side (AES-256-GCM with your own key) into a stateless token; the server decrypts per-request, executes, and discards. We operate no credential database.

Request data

The API server is stateless: it keeps no logs of request content, no account registry, and no analytics on tool calls. Payment verification processes only the signed x402 payment header — an amount and wallet signature, not personal data.

Payments

The default wallet is generated locally at ~/.config/xbird/wallet.json and never uploaded. x402 payments settle on-chain (USDC on Base); blockchain transactions are pseudonymous but publicly visible.

Website analytics

This site uses Vercel Analytics — anonymous, aggregated visit metrics without cookies or fingerprinting. No advertising trackers, no cross-site profiling.

Data deletion

We store nothing server-side, so there is nothing to request from us. Deleting your data means deleting local files: remove ~/.config/xbird/ (config, wallet, tokens).

Changes

Material changes to this policy will be published on this page and noted in the repository changelog. Effective date: 2026-08-22.

Prefer plain text? This page is also available as Markdown (privacy.md).