Skip to content
xbook

Privacy Policy

Last updated: March 27, 2026

What data we collect

When you sign up for xbook Cloud, we collect the following information through the X (Twitter) OAuth flow:

  • Email address — used for your account and newsletter delivery.
  • X username and user ID — used to identify your account and fetch bookmarks.
  • OAuth tokens — used to access the X API on your behalf. Tokens are encrypted at rest (see below).
  • Bookmarks data — the tweets you have bookmarked on X, including text, author, and metadata.

We do not collect your X password. Authentication is handled entirely through X's OAuth 2.0 PKCE flow.

How we store your data

All cloud data is stored in a Postgres database hosted on Neon. OAuth tokens are encrypted using AES-256-GCM before being written to the database. Each user's data is isolated by user ID.

If you self-host xbook, your data stays entirely on your own infrastructure in a local SQLite database. We have no access to self-hosted instances.

Third-party services

xbook Cloud relies on the following third-party services:

  • X (Twitter) API — to sync your bookmarks. Subject to X's Privacy Policy.
  • Resend — to send newsletter digest emails. Subject to Resend's Privacy Policy.
  • Neon — database hosting for cloud accounts.
  • Umami — privacy-focused, cookieless website analytics that we host ourselves. Umami does not use cookies, does not track personal data, and does not share data with third parties.

Data retention

We retain your data for as long as your account is active. When you delete your account, all associated data — including bookmarks, folders, tags, and encrypted tokens — is permanently removed from our database.

Your rights

You have the right to:

  • Access your data — via the xbook API or web dashboard.
  • Export your data — the API provides full access to all your stored bookmarks and metadata.
  • Delete your account — you can request account deletion at any time, which removes all your data.

To exercise any of these rights, open an issue on GitHub or contact us through the repository.

Cookies

xbook Cloud uses session cookies managed by Better Auth to keep you signed in. We also set a short-lived cookie during account creation (expires in 60 seconds, contains no personal data) to count sign-ups anonymously. These cookies are strictly functional — we do not use persistent tracking cookies, cross-site tracking, or advertising cookies. We use Umami for privacy-respecting, cookieless usage analytics (see Third-party services above).

Contact

If you have questions about this privacy policy or how your data is handled, please open an issue on our GitHub repository.

Changes to this policy

We may update this privacy policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Continued use of xbook after changes are posted constitutes acceptance of the updated policy.