Privacy Policy

Summary

Xchedule is a browser extension (available for Chrome and Firefox) that pre-fills X.com's post-scheduling dialog with time slots you set up in advance. A free tier covers up to two slots; a premium tier with unlimited slots is unlocked by a one-time USDC purchase on the Base blockchain. This policy covers both the extension and the website at xchedule.xyz (checkout, key rotation, and activation). The product is designed to need almost nothing from you, and this policy reflects that.

What the extension reads on x.com

On x.com, the extension only reads and fills the post-scheduling dialog's time and date controls when you open it. It does not read the contents of your posts, your timeline, your direct messages, your followers, your account details, or any other part of the site. It makes no network requests from x.com pages.

Information stored on your device

The extension stores a small amount of configuration using the browser's built-in WebExtension storage APIs. Two storage areas are used:

• Synced settings (storage.sync): your time slots (HH:MM strings), which slot is active, whether autofill is paused, your premium flag, and — if you have activated premium — your license key. Your browser automatically replicates this data across installations you are signed into with the same account (Chrome Sync if you are signed into Chrome with a Google account; Firefox Sync if you are signed into Firefox with a Mozilla account), so a single license activation works on all your devices. The data is transmitted and stored by Google or Mozilla as part of their sync service, not by us.
• Local-only state (storage.local): the per-slot “next date” counters used to auto-advance the date after each scheduled post. This data stays on the device it was created on.

You can erase all of this at any time by uninstalling the extension or clearing its storage from your browser's extensions page (chrome://extensions in Chrome, about:addons in Firefox). Removing it from one synced browser will, after sync, remove it from the others.

Information sent to our server

Activation is the only time the extension contacts our server. When you submit a license key in the popup, the extension makes a single POST request to https://xchedule.xyz/api/activate with the key in the request body. Our server hashes the key with keccak256, verifies the hash against the on-chain registry, and submits a consume transaction on Base that marks the key used. The plaintext key exists only in request-handler memory for the duration of that one request and is never written to a database, log file, or any other store.

The server keeps short-lived in-process counters of recent request IPs and key hashes for rate limiting and abuse prevention. Standard infrastructure access logs (IP address, user agent, timestamp) may also be retained briefly by our deployment host, Railway.

Analytics on the xchedule.xyz website

The xchedule.xyz website (the marketing pages, checkout, claim, and rotate flows) loads Google Analytics 4 to measure basic site usage — which pages get traffic, where it comes from, and roughly how visitors move through the site. The extension itself does not load Google Analytics or any other third-party script.

Google Analytics sets cookies and processes the following from your browser: pages viewed, referrer URL, approximate location derived from your IP address (Google truncates IPs in GA4 before storing), device and browser type, and session duration. We do not configure any custom dimensions or e-commerce events, and we never send your wallet address, license key, post content, or any X account information to Google.

Data collected by Google Analytics is processed by Google under its own Privacy Policy. You can opt out of Google Analytics on every site you visit by installing Google's browser opt-out add-on, by enabling tracking-protection or content-blocking features in your browser, or by blocking googletagmanager.com in your network settings.

Information you publish on the blockchain when purchasing

When you purchase a premium key on xchedule.xyz/checkout or rotate one on xchedule.xyz/rotate:

• You connect a Web3 wallet (e.g. MetaMask). We can read only the wallet address you explicitly connect.
• You sign transactions that get broadcast to the Base network.

The following becomes part of the public Base blockchain and is visible on any block explorer:

• The keccak256 hash of your license key — not the plaintext key.
• Your wallet address.

Blockchain records are public and permanent. Once a transaction is confirmed, it cannot be deleted by us or by you.

What we do not collect

Beyond the basic web-traffic measurements that Google Analytics collects on the website (described above), we do not collect any of the following:

• No advertising IDs, cross-site trackers, or remarketing pixels.
• No browsing history, the contents of your posts, or any X account information.
• No name, email address, phone number, precise location, or other personal information.

There are no user accounts and nothing for you to sign up for. The only identifiers involved in Xchedule are your wallet address and your license key, and they exist solely to complete your purchase and unlock premium on your own devices — they are never used for advertising, profiling, or sold or transferred to anyone for unrelated purposes.

How we share information

Aside from the basic site-usage data that Google Analytics collects on xchedule.xyz (described above), we do not share information with third parties. The only other “sharing” that happens is the on-chain publication described in the blockchain section, which is intrinsic to using a public blockchain.

Data retention

• On your device and on browser sync (Chrome Sync / Firefox Sync):kept until you uninstall the extension or clear its storage. Removing the extension from one synced browser propagates the deletion to the others through Google's or Mozilla's sync infrastructure.
• On our server: the plaintext license key is held only in process memory for the duration of one HTTP request. Access logs and rate-limiter counters are kept briefly for abuse prevention and then rotated out.
• In Google Analytics: retained by Google according to the data-retention setting on our GA4 property (currently the default). After that window, Google automatically deletes user-level and event-level data.
• On the Base blockchain: permanent, by design.

Children's privacy

Xchedule is not directed at children under 13, and we do not knowingly collect any information from children.

Your choices and how to delete your data

• Local data:uninstall the extension, or remove its storage from your browser's extensions page (chrome://extensions in Chrome, about:addons in Firefox).
• License key rotation: if your key is exposed, visit https://xchedule.xyz/rotate and sign a rotation transaction with the wallet that originally purchased it. The old key's hash is removed from the contract.
• On-chain records: transactions on Base are public and irreversible. We cannot delete them, and neither can you.

International users and your rights

If you are in the EU, UK, Canada, California, or elsewhere outside the US, the same policy applies — we do not collect personal data from anyone, regardless of jurisdiction.

Because we do not maintain user accounts or personal-data records, rights provided by laws such as GDPR and the CCPA (access, rectification, erasure, portability, objection) are satisfied by the local-deletion path described above: uninstalling the extension or clearing its storage removes everything we hold about you on your device and on browser sync (Chrome Sync / Firefox Sync). On-chain records on Base are public and immutable and cannot be deleted by us or by anyone else.

Changes to this policy

If we change this policy, we will update the page and the effective date above. Substantive changes to what data the extension or website handles will also be noted in the next extension update.

Contact

Questions about this policy: support@xchedule.xyz.