Cookie and Communications Notice

1. Essential authentication and session storage

The Xsender web app uses Supabase authentication. Depending on whether “remember this device” is selected, access and refresh session data is stored in browser local storage or session storage. This storage is essential to sign in, maintain a session, detect sign-out, and secure authenticated requests.

Essential storage is not used for advertising. Blocking or clearing it may sign you out or prevent the dashboard from working.

2. Chrome worker storage and permissions

The Chrome worker uses Chrome local and session storage for scoped connection state, device credentials, task leases, execution receipts, cooldowns, retries, and duplicate-send protection. It uses the cookies permission only to read active X session details needed for the selected X account and approved tasks.

X passwords are never collected. X authentication cookies and CSRF credentials remain in the Chrome profile and are not stored by Xsender.

3. Product telemetry

When enabled, the extension sends normalized telemetry through Xsender’s backend proxy. Events may contain categories, status and timing buckets, coarse counters, extension version, browser family, and a rotating pseudonymous identifier. They must not contain message text, recipient handles or identifiers, lead-list content, CSRF credentials, or raw HTTP bodies.

PostHog may receive normalized events from the backend as a product-analytics provider. This is separate from advertising cookies. Xsender does not use targeted advertising.

Normalized events are sent to Xsender’s PostHog EU Cloud project, where client IP data is discarded.

4. Optional website analytics and session recording

Xsender does not initialize PostHog website analytics, contact the analytics proxy, or create PostHog persistence until a valid optional consent enables Analytics. Analytics and Session recording are separate choices, both default off, and session recording cannot run without analytics.

When analytics is enabled, Xsender may measure acquisition-page visits, clicks, navigation, section and scroll reach, pricing interactions, signup and checkout steps, heatmaps, frontend exceptions, Core Web Vitals, traffic attribution, device and browser characteristics, viewport, and coarse geography. Browser events go to PostHog EU Cloud through the first-party managed proxy at r.xsenderapp.com. Canonical consent-gated checkout and subscription events may be sent directly by Xsender’s backend to PostHog EU ingestion. The PostHog project discards client IP data.

When session recording is also enabled, PostHog may retain masked visual playback for 30 days. Every input is masked. Authentication, billing, policy-acceptance, and free-text surfaces are explicitly blocked. Request and response headers and bodies, console logs, canvas content, passwords, OAuth or recovery codes, authentication tokens, Stripe session identifiers, card and payment data, X handles, campaign data, and message content are not recorded.

The versioned privacy-choice record contains the analytics choice, recording choice, consent version, and update time. It is essential preference storage, works separately from PostHog storage, and synchronizes the choice across tabs where browser storage is available. Global Privacy Control defaults optional collection to rejected.

After successful signup or login, a consented analytics profile uses the immutable Supabase user ID and account email to connect signup, checkout, and paid conversion steps. Current consent is also stored for that account so authenticated checkout and verified Stripe webhook conversion events are suppressed when analytics is absent or revoked.

5. Marketing and service communications

Xsender may send relevant B2B marketing where permitted. Marketing messages should include a practical opt-out. An unsubscribe applies to marketing, not to required service, account, billing, legal, abuse-prevention, or security messages.

6. Your choices

• Use the sign-in option without persistent device storage where available.
• Clear Xsender site storage through browser settings; this normally signs you out.
• Remove the Chrome worker to clear extension access, then clear extension data if needed.
• Use “Privacy choices” on any acquisition page to accept all, reject optional collection, enable analytics without recording, or withdraw an earlier choice.
• Withdraw analytics to stop recording immediately, stop future capture, reset the analytics identity, and clear PostHog browser persistence.
• Opt out of marketing using the message link or by emailing [email protected].
• Contact Xsender with a privacy request or question about telemetry.

7. Changes to this notice

We will update this notice if storage, telemetry, advertising, or communications practices materially change. The effective date and version will be updated at the top.

Contact

Use the contact below for support, privacy requests, legal notices, intellectual-property complaints, and abuse reports.

Related policies