Skip to content

Privacy policy

Last updated

This page explains what xscraper stores about you when you use xscraper.online and the API at api.xscraper.online, why, for how long, and how to have it deleted. We keep as little as the service needs.

1. Who we are

xscraper runs this website and the API. For anything about your data, write to support@xscraper.online.

2. What we store

  • Your account: your email address, your name if you add one, and whether you confirmed your email. Your password is stored only as an argon2 hash, never as text. If you sign in with Google, we store your Google account ID and the email and name Google sends us.
  • Your token balance and when you received the sign-up bonus.
  • The IP address you signed up from. We use it to limit how many free bonuses one network can collect.
  • Sign-in sessions: the IP address and browser name (user agent) of each session, and when it was created and last used. We store a hash of the session cookie, not the cookie itself.
  • API keys: a hash of the key, its name, and when it was created, last used and when it expires. The full key is shown to you once and is never stored.
  • A record of each API call: the endpoint, the time, the status, how long it took, the tokens charged, the last 4 characters of the key, and the error message if it failed. This is what your usage page shows.
  • Technical logs: server logs and records of the requests our own X accounts make. They can contain the parameters of your calls, such as a username or a search term. We use them to find and fix faults.

We do not collect payment details: tokens cannot be bought at the moment.

3. What we do not do

  • No advertising, and no analytics or tracking scripts on this website.
  • No selling or renting of your data.
  • No marketing emails. We only send emails the service needs: confirming your email, resetting your password, and notices about your password or API keys.

4. Why we use it

  • To run the service you signed up for: your account, sign-in, API keys, token balance and usage history.
  • To keep the service safe and fair: rate limits, sign-in protection, limits on free bonuses, and finding abuse. This is our legitimate interest in running a secure service.
  • To fix faults: technical logs, kept only for a short time.
  • When the law requires it.

5. Cookies and browser storage

We only use what the site needs to work, so there is no cookie banner. Nothing here is used for advertising or tracking.

NameWhat it doesHow long
xs_sessionKeeps you signed in (cookie).30 days after your last visit, or until you sign out
xs_oauthProtects the Google sign-in step (cookie).10 minutes
Sidebar settingRemembers whether you collapsed the dashboard sidebar (local storage).Until you clear it
Console keyRemembers the API key you pasted into the docs console, in that tab only (session storage).Until you close the tab

6. Who else sees it

  • Our hosting provider, whose servers run the website, the API and the database.
  • Resend, which delivers our emails. It receives your email address and the message.
  • Google, only if you choose to sign in with Google. Google's own privacy policy applies to that step.
  • Authorities, when the law requires us to share it.

When you call the API, we request public data from X with our own X accounts. Your personal data is not sent to X. Some of these providers may process data outside your country. Where the law requires it, we rely on the safeguards they offer, such as standard contractual clauses.

7. How long we keep it

  • Your account, API keys and sign-up IP address: until you delete your account.
  • Sign-in sessions: 30 days after last use, or until you sign out.
  • Email confirmation and password reset links: until used, and at most 24 hours and 30 minutes.
  • Records of API calls: 180 days.
  • Technical logs and our X account request records: 30 days.
  • Sign-up bonus: when a mailbox receives the bonus, we keep a one-way hash of the address (not the address itself), so the same mailbox cannot claim it again after deleting its account. The IP address stored with it is deleted after 24 hours.

8. Deleting your account

In the dashboard, open Settings and choose Delete account. Your account, API keys, sessions and remaining tokens are deleted at once. Records of past API calls stay for up to 180 days under an internal number, no longer connected to your email, and technical logs expire after 30 days.

9. Your rights

You can ask us for a copy of your data, to correct it, to delete it, to limit how we use it, or to object to how we use it, and you can ask for your data in a format you can take elsewhere. Write to support@xscraper.online from the email on your account. We answer within one month. You can also complain to the data protection authority in your country.

10. Security

All traffic uses HTTPS. Passwords, session cookies and API keys are stored only as hashes. Secrets are removed from logs before they are written. Only the people who run the service can reach the database. No system is perfectly safe: if we learn of a breach that affects you, we will tell you.

11. Children

The service is not meant for anyone under 16. Please do not create an account if you are younger.

12. Changes to this policy

When this policy changes, we update the date at the top. If a change affects how we use your data, we email account holders before it takes effect. The terms of service cover how you may use the service.