Cookie and Communications Notice

1. Essential authentication and session storage

The Xsender web app uses Supabase authentication. Depending on whether “remember this device” is selected, access and refresh session data is stored in browser local storage or session storage. This storage is essential to sign in, maintain a session, detect sign-out, and secure authenticated requests.

Essential storage is not used for advertising. Blocking or clearing it may sign you out or prevent the dashboard from working.

The app also keeps a few working items in your browser’s local or session storage, such as your progress in the guided setup and your reply-notification settings. They are used only to run the app, not for analytics or advertising.

Some sign-in, sign-up, and account-security forms load Cloudflare Turnstile, a check that tells people from automated sign-ups. It runs in a frame from Cloudflare, which reads browser and device signals for that check under its own terms. The in-app payment form loads Stripe.js from Stripe, which may set Stripe’s own cookies to prevent fraud. To match Xsender’s lettering, that form also loads a font from Google Fonts, so your browser contacts Google when the form opens. Profile pictures of X accounts load straight from X’s image server, so your browser contacts X when they appear.

2. Cloud connections, Xsender Connect, and the retired extension

Xsender stores the signed-in X session of each connected account encrypted on its cloud server to run that account. Passwords and verification codes pass transiently through the remote login service and are not intentionally recorded or stored. When you remove a cloud connection or delete your Xsender account, the saved X session is deleted from the cloud server, usually within the hour, and from encrypted backups within 30 days.

The sign-in window runs in a browser on Xsender’s cloud server, not in yours. When a window closes without connecting an account, Xsender may keep X’s own cookies and the browser storage of X’s pages from it, never X’s sign-in cookies, so that your next sign-in window on the same internet address looks to X like the same device. This is held in the server’s memory only, used only within 24 hours, and dropped when X refuses a sign-in, when an account connects, or when the server restarts. The Privacy Policy explains this and the other sign-in protections.

Xsender Connect, the optional connect-only Chrome extension, uses Chrome’s cookies permission to read seven named x.com cookies on your own computer, and no cookies from any other site. Six of them keep the X account in use signed in and identify your browser. The seventh is X’s list of the accounts signed in to that Chrome, which it reads only to count them on its consent screen and never sends. Only after you click “Connect this account” on that screen does it send Xsender the six cookies of the one account in use. It uses Chrome session storage only to hold your Xsender sign-in token, and the workspace the request is for, while that request waits for your answer. It deletes them when the connection finishes or is cancelled, or when the consent screen is closed, and Chrome also deletes them when the browser closes. It sends no telemetry.

Xsender has retired its original Chrome extension, which sent messages from your Chrome. Xsender’s servers no longer give it work or accept new connections from it, and Xsender can no longer read or use anything it stored. While it stays installed, the data it kept in Chrome local and session storage, such as connection state, issued credentials, task records, and any saved X Chat passcode, remains in your Chrome profile. Removing the extension from Chrome deletes it.

3. Product telemetry

Until it was retired, the Chrome extension could send normalized telemetry through Xsender’s backend proxy, when enabled. Events could contain categories, status and timing buckets, coarse counters, extension version, browser family, and a rotating pseudonymous identifier. They did not contain message text, recipient handles or identifiers, lead-list content, CSRF credentials, or raw HTTP bodies.

PostHog may receive normalized events from the backend as a product-analytics provider. This is separate from advertising cookies. Xsender does not use targeted advertising.

Normalized events are sent to Xsender’s PostHog EU Cloud project, where client IP data is discarded.

4. Anonymous visit counting, optional website analytics, and session recording

On public website pages, such as the home page, pricing, and guides, Xsender counts visits anonymously for visitors who have not enabled Analytics. This counting sets no cookies and writes nothing to browser storage. It records page visits, time on page, section and scroll reach, button and link clicks, page loading speed, the referring site, approved campaign parameters, and device and browser type. Counts go to PostHog EU Cloud through r.xsenderapp.com, where the IP address and user agent are used only to compute a visitor identifier that changes every day and are then discarded. The guided setup after sign-up is counted the same way: which steps people reach, which buttons they press, how long each step takes, and short outcome codes, never what they type. Anonymous counts are never linked to an account, never include recordings or heatmaps, and do not run anywhere else in the signed-in app.

Xsender does not initialize consented PostHog website analytics or create PostHog persistence until a valid optional consent enables Analytics. Analytics and Session recording are separate choices, both default off, and session recording cannot run without analytics. Once Analytics is enabled, consented analytics replaces anonymous counting for that visitor.

When analytics is enabled, Xsender may measure acquisition-page visits, clicks, navigation, section and scroll reach, pricing interactions, signup and checkout steps, heatmaps, frontend exceptions, Core Web Vitals, traffic attribution, device and browser characteristics, viewport, and coarse geography. Browser events go to PostHog EU Cloud through the first-party managed proxy at r.xsenderapp.com. Canonical consent-gated checkout and subscription events may be sent directly by Xsender’s backend to PostHog EU ingestion. The PostHog project discards client IP data.

When session recording is also enabled, PostHog may retain masked visual playback for 30 days. Every input is masked. Authentication, billing, policy-acceptance, and free-text surfaces are explicitly blocked. Request and response headers and bodies, console logs, canvas content, passwords, OAuth or recovery codes, authentication tokens, Stripe session identifiers, card and payment data, X handles, campaign data, and message content are not recorded.

The versioned privacy-choice record contains the analytics choice, recording choice, consent version, and update time. It is essential preference storage, works separately from PostHog storage, and synchronizes the choice across tabs where browser storage is available. Global Privacy Control defaults optional collection to rejected.

After successful signup or login, a consented analytics profile uses the immutable Supabase user ID and account email to connect signup, checkout, and paid conversion steps. Current consent is also stored for that account so authenticated checkout and verified Stripe webhook conversion events are suppressed when analytics is absent or revoked.

5. Marketing and service communications

Xsender may send relevant B2B marketing where permitted. Marketing messages should include a practical opt-out. An unsubscribe applies to marketing, not to required service, account, billing, legal, abuse-prevention, or security messages.

6. Your choices

• Use the sign-in option without persistent device storage where available.
• Clear Xsender site storage through browser settings; this normally signs you out.
• Remove the retired Xsender extension from Chrome to delete the data it stored.
• Remove Xsender Connect from Chrome at any time. Removing it does not disconnect an account it connected; remove that account from Accounts in Xsender.
• Use “Privacy choices” on any acquisition page to accept all, reject optional collection, enable analytics without recording, or withdraw an earlier choice.
• Withdraw analytics to stop recording immediately, stop future consented capture, reset the analytics identity, and clear PostHog browser persistence. Anonymous visit counting, which uses no cookies or storage, continues.
• Opt out of marketing using the message link or by emailing [email protected].
• Contact Xsender with a privacy request or question about telemetry.

7. Changes to this notice

We will update this notice if storage, telemetry, advertising, or communications practices materially change. The effective date and version will be updated at the top.

Contact

Use the contact below for support, privacy requests, legal notices, intellectual-property complaints, and abuse reports.

Related policies