Ownfeed Privacy Policy

Last updated: October 19, 2026

Ownfeed is a personal agent that helps a user filter and understand content on X, and correct how it handles similar content. This document describes the public cloud version of Ownfeed.

Data Ownfeed processes

Ownfeed may process:

Ownfeed does not collect an X password. The extension may request Chrome's optional Cookie permission only after the user presses Start initialization. It reads only X's auth_token and ct0, immediately releases the permission, then uses those in-memory values inside that browser for one bounded read-only Likes/Bookmarks import. Cookie values, tokens and request headers are never sent to Ownfeed Cloud, Workspace, the model provider, logs or data exports. Only validated, normalized post content is sent to the user's isolated cloud Agent.

Starting with version 0.8.126, the public extension and cloud service no longer provide independent content discovery, extension-owned background X search, the session-search trial or inserted recommendation cards. Previously stored recommendation or search-result records may remain readable for compatibility, export and deletion under the retention controls below. Keeping historical data readable does not resume automatic searching or collection of new search results. Older clients may still show retired controls; the cloud's compatibility responses do not start discovery or deliver new recommendations.

How the data is used

Current browsing context accompanies posts to Ownfeed Cloud and the model provider handling that decision, so Shield can distinguish X's For you feed from active searches, profile visits and discussions. The browser maintains the current tab's scene rather than an additional navigation-history database. It does not read unsubmitted search input, direct messages or drafts. Context may be retained with decision jobs, caches and explicit feedback; ordinary exposure records and product analytics do not include search queries. Searching or visiting a profile does not itself trigger long-term preference learning. Additional capture of these model inputs in AI diagnostics remains subject to your existing diagnostics consent, disable and deletion controls.

For early filtering, the extension can passively read a bounded copy of the home timeline or thread data X already returned while that page is visible. It does not make additional X requests or read Cookie values or authentication headers for this purpose. Only normalized post content and necessary thread context enter the existing Shield service and model provider. Merely receiving a response does not record a post as viewed, saved or liked, and does not create a preference-learning event. Early filtering does not capture direct messages or search responses. If capture or matching fails, the existing rendered-page path remains available.

The data is used only to provide and improve Ownfeed's user-facing features: real-time filtering and correction, reading assistance and explanations of existing X posts, conversation, user-requested history analysis, a correctable Workspace, feedback learning, persistence, export and deletion. Ownfeed does not sell user data or use it for personalized advertising.

Social-media text is treated as untrusted content. It cannot directly instruct the Agent or change the user's Workspace. A semantic change must pass Ownfeed's evidence, scope, revision and receipt boundaries.

Service providers

Ownfeed uses Auth0 to provide X sign-in, Cloudflare Workers and Durable Objects to run and store each user's isolated Agent state, OpenRouter for conversation, feedback learning and Workspace maintenance, and Cerebras for low-latency Shield decisions, Feed reading assistance and the user-requested Likes/Bookmarks initialization draft. For Shield and Feed assistance, Cerebras receives only the current relevant preferences, normalized candidate posts and needed thread context. For initialization, it receives the validated normalized posts the user explicitly chose to import, the current relevant Workspace context and opaque evidence IDs needed to build a reviewable draft. Cerebras does not receive X credentials, authentication headers or the full conversation history. Its published policy states that inference inputs and outputs are not retained or used for training; necessary account and usage metadata is retained to operate the service. These processors receive only the data needed to provide the requested feature. OpenRouter requests explicitly require providers that deny data collection and support zero data retention; Ownfeed does not enable OpenRouter prompt logging. When you send a Chat message while an X page is open, the conversation sent through OpenRouter also includes up to eight posts already shown on that page, normalized the same way as Shield input; they are used for that reply only and are not stored. When you ask Chat to search X, Ownfeed sends only the search words and filters to X's official API using Ownfeed's own developer credential, not your X account. When you ask Chat to search the web, Ownfeed sends only the search words through OpenRouter, with the same zero data retention routing, to its search provider Exa. For either search, Ownfeed does not send your preferences, conversation history, Workspace content or X credentials.

Ownfeed personnel do not read a user's posts, conversations or Workspace except when the user explicitly asks for support involving specific data, explicitly enables AI diagnostics for troubleshooting and AI improvement, when required for security or law, or when data has been aggregated and anonymized for internal operations. Access to AI diagnostics is limited to authorized personnel for those purposes.

Your sharing choice at sign-in

The sign-in screen shows a short notice immediately after the privacy-policy link, covering usage statistics and the conversations, posts and preference text processed by AI. Its single “Agree and log in with X” action explicitly authorizes both product analytics and AI diagnostics for the authenticated account after sign-in succeeds. A failed or cancelled authentication grants nothing. There is no separate first-sign-in action to skip sharing. After signing in, you can turn either collection off independently in Settings → Data & privacy → Manage data use and continue using Ownfeed.

The expandable details explain the PostHog (US) destination, troubleshooting and AI-improvement purposes, readable AI content and tool inputs/results, credential exclusions, the different scopes and retention below, and how to turn each option off independently in Settings → Data & privacy. There is no checkbox. Showing the screen, restoring a session or upgrading does not grant consent or re-enable a previously disabled choice. A later click on the explicit agreement is a new authorization, even if one or both options were previously disabled.

Optional product analytics

Product analytics is enabled through the explicit sharing/sign-in action above. After signing in, you can turn it off or explicitly enable it again with its own control in Settings → Data & privacy. Enabling only the product-analytics control never enables AI diagnostics. Both can be turned off independently without losing access to Ownfeed, and updates preserve existing enabled and disabled choices.

Product-analytics consent applies only to the currently signed-in account and browser. Sign-out, a new sign-in or clearing product data resets it. The explicit sharing/sign-in action enables it after successful authentication; otherwise, enabling it again requires an explicit choice in Settings → Data & privacy. A restored session alone does not grant consent.

When enabled, Ownfeed's server sends a small allowlist of events to PostHog's US service: enabling analytics, opening the panel, first-use preferences/setup becoming ready, a completed automatic Shield collapse, confirmed save or feedback delivery, and the HTTP outcomes of initialization, initialization confirmation, conversation, Workspace decisions and Undo requests. It also records foreground presentation of Note, Ask and highlights, explicit interactions with those controls and their displayed receipt outcomes, terminal chat responses presented in the panel, and terminal feedback-review records presented in History. It also records fixed-category outcomes of explicit preference changes and Undo, actual foreground restoration of collapsed content, and observed terminal processing states for the same account's explicitly delivered feedback. These results contain no preference text, post text, revision IDs or raw errors. An updated understanding is not evidence of improved filtering accuracy; a mechanical Undo may still require semantic repair. Local pending-feedback observations are bounded to 30 minutes and are cleared on opt-out or account change. Retired discovery and recommendation interfaces no longer generate new product analytics; historical analytics remain subject to the controls below. Events contain a separate pseudonymous account identifier, a random account-bound activity-session ID, an event ID and timestamp, client and cloud versions, analytics schema version, environment, consent version, event name and HTTP result, plus a fixed category for feature, automatic/manual mode, surface, action, feedback kind or result where applicable. A delivered feedback event is not evidence of changed understanding, and a presented completed response is not evidence of answer quality. Opening a historical result records its current presentation, not a past completion. Thirty minutes without Ownfeed Cloud activity while analytics remains enabled, or an account switch, starts a new activity session. Events that occurred before consent are not sent later. This is pseudonymous data, not a claim of anonymous data. PostHog also adds SDK and ingestion metadata.

With the same optional product-analytics choice enabled, a coarse foreground-use event can also be sent when Ownfeed is ready and not paused, the X tab is visible and focused, and a rendered post or its collapsed bar is actually visible for 800 milliseconds. It is attempted at most once per account and fixed half-hour window across tabs in that browser. Background tabs, passive response-prefetch copies and state polling without visible content do not qualify. This event contains no additional fields: it is not a per-post reading record, reading-time measurement, successful-filtering result or proof of satisfaction. It is not backfilled for older clients or time before consent. Delivery remains best-effort.

These events contain no X post content or URLs, searches, chat text, Workspace content, names, handles, email addresses, X identifiers, Cookies, access tokens or raw error messages. Ownfeed does not enable automatic page or click tracking, session recording, person-profile processing or automatic exception capture. The extension does not connect directly to PostHog; the server does not forward the user's IP address or request headers to PostHog and disables IP-based geolocation for these events.

Turning off analytics stops future events; a request already sent while consent was enabled may finish. Clearing Ownfeed product data deletes the account's product state but does not automatically erase previously sent PostHog events. For access or deletion of earlier analytics, contact privacy@ownfeed.ai. While signed in, the extension can derive and display the same pseudonymous lookup reference used on matching PostHog events; this happens locally and does not send a new event. No automatic analytics-retention deadline is promised in this version; events remain under the configured PostHog retention settings until expiry or a processed deletion request.

Optional AI diagnostics

AI diagnostics is controlled separately from content-free product analytics. Selecting the explicit sharing/sign-in action and successfully authenticating, or selecting “Agree and enable AI diagnostics” in Settings → Data & privacy, permits Ownfeed's server to send new AI model loops to PostHog (US), including conversation inputs and responses, posts and Workspace preference context included in model calls, and tool arguments and results. Records also include the model, provider request ID, tokens, reported cost, timing, stop reason, task and release identifiers, and the same account lookup reference used by product analytics. Ordinary content remains readable and can contain names, handles or other personal information already present in the model context. Credential filtering and size limits are applied; Cookies, authentication headers, IP addresses and recordings are not intentionally collected. Authorized personnel may use these diagnostics to investigate failures and improve Ownfeed's AI features, not for advertising or unrelated purposes.

Consent applies to the signed-in account's chat and background AI tasks across browsers. Sign-out, restored sessions and updates do not grant or revoke this account-level choice. The explicit sharing/sign-in action is a new agreement that can enable it after successful authentication. Turning AI diagnostics off in settings or clearing product data stops new collection. A request already sent may finish. A model loop that started before consent is not backfilled, although later model calls may naturally include earlier conversation or Workspace context. Product-analytics consent by itself never enables AI content collection.

Standard AI content fields follow PostHog's current 30-day AI-content retention. Model, token, cost, timing and other small metadata follow the project's event retention settings. Turning collection off or clearing product data does not erase earlier PostHog records; access or deletion requests use privacy@ownfeed.ai and the account lookup reference in Data help. OpenRouter Broadcast and OpenRouter prompt logging are not enabled by this feature. The model-provider retention protections described above do not apply to the optional PostHog diagnostic copy.

Retention and user control

Workspace evidence, explicit feedback, saved items and current Agent state are retained while the user uses Ownfeed so the Agent can remain consistent across browser restarts. Ownfeed periodically bounds the oldest passive browsing observations, Shield decision history, unreferenced content and unreferenced confirmed X-action history; this maintenance does not remove explicit feedback, saved content, active rules, Workspace evidence or in-progress work. The extension provides controls to:

Cloudflare Worker invocation logs are retained according to the active Cloudflare plan and never for more than seven days. The current Auth0 plan retains authentication security logs for one day. Ownfeed does not export either log stream to another analytics provider. These operational records are used only for security and failure diagnosis.

Security

Personal or sensitive data is transmitted over HTTPS. Authentication uses Authorization Code with PKCE; the extension has no client secret. Public API requests require a verified, expiring OIDC token and are isolated by an opaque per-user Durable Object key.

Contact

Privacy and data requests: privacy@ownfeed.ai

Limited Use

Ownfeed's use and transfer of information received from browser permissions adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. Such data is used only to provide or improve Ownfeed's single user-facing purpose and is not transferred for advertising, creditworthiness or unrelated purposes.