Summary. X-Nova helps you spot fast-rising posts on X (Twitter) and draft a reply. Almost everything runs locally in your browser. We only send data to our server when you (1) activate a license or (2) tap the AI reply button — and even then, only what that feature needs. We never auto-post on your behalf, never sell your data, and show no ads.
1.Who we are
This extension ("X-Nova", "we") is operated by the X-Nova developer. This policy explains what data the extension accesses, what leaves your device, and why.
2.Data processed only on your device (never sent to us)
- Post metrics from your own X session. While you browse X/Twitter, the extension reads the data your logged-in browser already loads (a post's view count, timestamp, author handle and text) to calculate "velocity" and acceleration, draw on-timeline badges, and show a side panel. This calculation happens entirely in your browser. We do not use X's official API and do not receive this data.
- Your settings. Watched accounts and keywords, sensitivity, filter options (sensitive-media / spam / velocity), custom block words, language and toggles are stored locally via
chrome.storage.local.
- A random device ID and (after activation) a session token are stored locally to keep you signed in.
No automated actions. X-Nova never posts, replies, likes, or follows for you. The AI feature only produces a draft that you review and post yourself ("human in the loop").
3.Data sent to our server — only for these features
- License activation & account status. When you paste a license key, we send the license key and your device ID to our backend (
xnova-backend.wolfren98.workers.dev, hosted on Cloudflare) to validate the license and return your plan, status and remaining credits.
- AI reply ("catch the wave"). When you tap the AI button on a specific post, we send that post's text and author handle to our backend, which forwards it to an AI model provider to generate a short reply draft. The draft is returned to you to copy and post manually. We record usage counts for credit accounting.
- Optional remote filter rules. If you enter a "rules URL", the extension fetches that URL (a word list) to update your spam/scam filter. No personal data is sent; the request goes to the address you chose.
We do not transmit anything else — no browsing history outside X, no direct messages, no passwords, no contacts.
4.Third-party processors
- Cloudflare — hosts our backend and database.
- AI model provider (e.g. MiniMax / DeepSeek) — receives the post text you chose, solely to generate your reply draft.
- Creem — handles payment and license keys. Your payment card details are entered on Creem's checkout, not in the extension, and are not seen by us.
5.Why we can (permissions)
storage — save your settings and keep you signed in.notifications — show desktop alerts when a watched post starts accelerating.- Host access to
x.com, twitter.com, pro.x.com — read the timeline to compute velocity and add badges/alerts on the page.
- Host access to our backend domain — activate licenses and fetch AI reply drafts.
6.Retention, your rights, and security
Local data stays on your device until you clear it or remove the extension. Account and usage records on our backend are kept while your account is active and deleted on request. You can ask us to access or delete your data via the contact email above. We use HTTPS for all server communication and do not store payment card numbers.
7.Children
X-Nova is not directed to children and is intended for users who meet X/Twitter's minimum age.
8.Changes
If our data practices change, we will update this page and its effective date, and disclose material changes prominently before they take effect.
摘要。 X-Nova 帮你在 X(推特)上发现正在快速起量的推文并起草回复。绝大部分处理都在你本地浏览器完成。只有当你(1)激活授权码,或(2)点击"AI 上车"按钮时,我们才会把该功能所需的数据发到服务器——且仅限所需部分。我们绝不代你自动发帖,绝不出售你的数据,也没有任何广告。
1.我们是谁
本扩展(下称"X-Nova""我们")由 X-Nova 开发者运营。本政策说明扩展会访问哪些数据、哪些会离开你的设备,以及原因。
2.仅在你设备本地处理的数据(绝不上传给我们)
- 来自你自己 X 会话的推文指标。 你浏览 X/Twitter 时,扩展读取你已登录的浏览器本就加载的数据(某条推文的浏览量、时间、作者、正文),用于计算"流速"与加速度、在时间线上画徽章、显示侧边榜。该计算完全在你的浏览器内进行。我们不使用 X 官方 API,也不会收到这些数据。
- 你的设置。 盯的账号与关键词、灵敏度、过滤选项(敏感内容/垃圾/流速)、自定义屏蔽词、语言与各开关,均通过
chrome.storage.local 存在本地。
- 一个随机设备 ID 和(激活后的)会话令牌存在本地,用于保持登录状态。
无任何自动操作。 X-Nova 绝不代你发帖、回复、点赞或关注。AI 功能只生成一条草稿,由你本人审阅后自行发出("人在环内")。
3.会发到我们服务器的数据——仅限这些功能
- 授权激活与账户状态。 当你粘贴授权码,我们会把授权码和你的设备 ID 发到后端(
xnova-backend.wolfren98.workers.dev,托管于 Cloudflare)以校验授权,并返回你的套餐、状态和剩余积分。
- AI 上车回复。 当你在某条推文上点 AI 按钮,我们会把该推文的正文与作者用户名发到后端,再转发给 AI 模型服务商生成一条简短回复草稿。草稿返回给你,由你复制后手动发出。我们记录使用次数用于积分结算。
- 可选的远程过滤规则。 若你填写了"规则 URL",扩展会请求该地址(一个词表)以更新你的垃圾/诈骗过滤词。不发送任何个人数据;请求发往你自己填的地址。
除此之外我们不传输任何其他内容——不含 X 以外的浏览历史、不含私信、不含密码、不含通讯录。
4.第三方处理方
- Cloudflare —— 托管我们的后端与数据库。
- AI 模型服务商(如 MiniMax / DeepSeek)—— 接收你选中的推文正文,仅用于生成回复草稿。
- Creem —— 处理支付与授权码。你的银行卡信息在 Creem 收银台输入,不经过扩展,我们也看不到。
5.为什么需要这些权限
storage —— 保存你的设置、保持登录。notifications —— 当被盯的推文开始加速时弹桌面预警。- 对
x.com、twitter.com、pro.x.com 的访问 —— 读取时间线以计算流速、在页面上加徽章/预警。
- 对我们后端域名的访问 —— 激活授权、获取 AI 回复草稿。
6.数据留存、你的权利与安全
本地数据会一直留在你的设备上,直到你清除或卸载扩展。后端上的账户与使用记录在账户有效期内保留,并可应请求删除。你可通过上方联系邮箱要求访问或删除你的数据。所有服务器通信均使用 HTTPS,我们不存储银行卡号。
7.未成年人
X-Nova 不面向儿童,仅供满足 X/Twitter 最低年龄要求的用户使用。
8.政策变更
若我们的数据处理方式发生变化,我们会更新本页面及其生效日期,并在变更生效前显著披露重大变化。