# Privacy Policy

xbird is built so that we never hold your data in the first place. This page explains exactly what touches what.

## Twitter credentials

- Your `auth_token` and `ct0` cookies are **auto-detected locally** from your browser or supplied by you explicitly.
- They are stored **only on your machine** (local config), encrypted where applicable.
- For the hosted REST API, credentials are **encrypted client-side** (AES-256-GCM with your own key) into a stateless token; the server decrypts per-request, executes, and discards. We operate no credential database.

## Request data

- The API server is stateless: it keeps no logs of your requests' content, no account registry, and no analytics on tool calls.
- Payment verification processes only the signed x402 payment header — an amount and wallet signature, not personal data.

## Payments

- The default wallet is generated locally at `~/.config/xbird/wallet.json` and never uploaded.
- x402 payments settle on-chain (USDC on Base); public blockchain transactions are inherently pseudonymous but visible to anyone.

## Website

- This site uses Vercel Analytics, which collects anonymous, aggregated visit metrics without cookies or fingerprinting.
- No advertising trackers, no cross-site profiling.

## Data deletion

Because we store nothing server-side, deleting your data means deleting local files: remove `~/.config/xbird/` (config, wallet, tokens). Nothing to request from us — there is nothing held on your behalf.

## Changes

Material changes to this policy will be published here and noted in the repository changelog.

Questions? See the [contact page](https://xbird.dev/contact).

Effective date: 2026-08-22