# Twistory privacy

Twistory runs in your browser and has no server. It does not collect analytics, sell data, or send posts to its developer.

When you visit another person's profile or open their individual post, Twistory automatically submits a search to X for replies between that person and your signed-in account. It calls the search client already running in that X page. X manages the session and authentication internally; the extension receives only sanitized posts, a pagination cursor, and fixed error categories. X receives the queries and applies its own policies. Twistory does not read or store authentication cookies, passwords, direct messages, or your general browsing history.

If the internal search client cannot be located, Twistory uses an ordinary, temporary inactive X search tab in your Chrome profile and reads its rendered search results. Authentication challenges and rate limits do not trigger this fallback.

Conversation results are cached in page memory for five minutes per account and profile. To keep your place when you open or reload a reply, the current view is also stored in `chrome.storage.session`, separately for each tab. This view contains the signed-in and visited account handles, up to 40 loaded posts, the selected reply ID, the conversation list's scroll position and expansion state, and its save time. It is eligible for restoration for 30 minutes after its latest save. The extension removes a tab's stored view when that tab closes; Chrome clears session storage when the browser session ends. These views are not shared between tabs, saved to persistent local storage, or synced to a cloud account.

Chrome session storage also holds random ownership tokens and tab IDs during fallback searches so the extension can safely close its temporary tabs, including after a background worker restart. Search results appear incrementally in the source tab as each batch arrives.

The current version does not use persistent settings or a saved collection. If you used an earlier version, any existing settings and saved posts remain untouched in `chrome.storage.local`; they are no longer read or displayed. Uninstalling the extension removes its Chrome extension storage. Previously exported JSON backups remain separate files.

Twistory requests access only to X/Twitter websites and Chrome's storage and scripting APIs. The scripting permission lets its packaged adapters use the existing X search client and native navigation inside the original page. Opening a result navigates to that post on X; no post, like, follow, or message is submitted. The extension downloads no executable code and loads no advertising or tracking pixels.