Política de privacidad

01 Who we are

XCrap is an independent, unfunded service operated from the European Union. It reads publicly visible pages from X (formerly Twitter) and returns them in machine-readable formats. There is no company behind it and no investor in it.

Contact for anything on this page: [email protected].

02 What we record about you

Every request to this service writes one row to a log. That row holds:

• The time of the request.
• Your IP address, which is what rate limiting is applied to.
• The HTTP method, path and query string.
• Your request headers, including the user-agent and referrer. Authorization, Cookie and API-key headers are replaced with the word "redacted" before anything is written.
• The request body, and only for POST, PUT and PATCH requests.
• The response status, how long it took, how many bytes it returned, and which upstream source answered.

That is the complete list. There is no analytics script on this site, no advertising network, no fingerprinting, no session cookie and no third-party tag of any kind. The only thing stored in your browser is your light-or-dark theme choice, in localStorage, which never leaves your device.

03 Post content and the cache

When you ask for a post, we fetch it, hand it to you, and keep a copy for five days so that the next person asking for the same post does not cause another request to X. After five days the copy is deleted automatically.

Media files are different: images and video are streamed through to you as they arrive and are never written to our disk at all, at any point.

This is deliberate. XCrap is a pipe, not an archive. There is no historical database of posts here, which means there is nothing to breach, nothing to subpoena, and nothing to sell.

Replies under a post, and the follower and following lists of an account, pass through the same way with a shorter cache: they are kept for one hour, because they change faster than posts do. A follower list names other people's public accounts. An account that has opted out is left out of every list and every set of replies, not only refused when it is asked for by name.

04 Legal basis and our role under the GDPR

Posts on X contain personal data: names, photographs, opinions. Two separate relationships matter here, and they should not be confused.

For the request logs described above, we are the controller. The legal basis is legitimate interest under Article 6(1)(f): keeping a free service available and defending it against abuse. The interest is narrow and the data is minimal.

X Corp remains the controller for the platform data itself. Nothing here transfers their obligations to us or ours to you.

05 How long things are kept

06 Who else sees this

Nobody. We do not sell, rent, trade or share request data with anyone. There is no advertising partner, no analytics provider and no data broker in this stack.

Two technical exceptions, both unavoidable and neither involving your identity:

• X receives our server's request when we fetch a post. It sees our server, not you.
• When you search, X receives the search query from an account XCrap runs for that purpose. It sees the query and that account, never anything about you.
• If our own reader fails, a request may fall through to a third-party public mirror. It receives the post id being requested, and nothing about you — no address, no header, no identifier.

07 Your rights

Under the GDPR you may request access to, correction of, or deletion of the personal data we hold about you, and you may object to our processing of it. In practice the only thing we hold about a visitor is a log row containing an IP address.

Email [email protected] with the approximate time and the IP address, and we will find and delete the matching rows. We answer within thirty days, usually the same week.

You may also complain to your national data protection authority.

08 If you are on X and do not want to be readable here

Email [email protected] from an address that can be connected to the account, or send us a link to a post from that account mentioning XCrap. We add the handle to a blocklist that is checked before any request runs. Requests for that account then return 451 and no data.

No form, no justification, and no argument about whether the data is technically public. If you ask, it is done, usually the same day.

What this cannot do: it stops XCrap. It does not remove your posts from X, from anybody else's copy of them, or from anything already downloaded through XCrap before the request.

09 Security

The service runs over HTTPS and sends a strict Content Security Policy, and it holds no user accounts, no passwords and no payment details, because it has none of those features. Donations are Monero, which involves no account and no processor.

If you find a security problem, email [email protected] before disclosing it publicly. We will not threaten you for reporting one.

10 Children

This is a developer tool and is not directed at children. We do not knowingly record data from anyone under 16.

11 Changes to this policy

When this policy changes, the date at the top changes with it. Because the policy describes what the code does, a meaningful change to it means the code changed too, and both land in the same commit.