Receipts
Don't take my word for it.
Open the network tab.
Every privacy claim on this site is checkable in about two minutes, using a tool already built into your browser. This page tells you exactly what to look for, and what you will find. If any of it turns out to be false, that is a bug worth emailing us about — and worth telling other people about.
Every permission, and why
Four permissions. That is the whole list — you can confirm it on the store page before
installing, or in chrome://extensions afterwards.
storage
Saves your deletion queue, your progress and your licence status in your own browser.
A long run has to survive a browser restart. Nothing here is sent anywhere — it is the same storage a browser uses to remember you dismissed a cookie banner.
alarms
Schedules a wake-up when X's rate limit window resets.
Deletion pauses roughly every 15 minutes to stay inside X's limits. Extension background workers are shut down when idle, so a timer would die; an alarm survives.
x.com
Access to the X tab you already have open.
This is where the work happens. The extension reads your own posts and issues the delete requests from inside the page, using the session you are already signed in with.
api.lemonsqueezy.com
Licence key checks with the payment provider.
The only outbound request in the entire product. What it contains is printed in full below.
The only request that leaves your device
Deletion requests go to x.com — that is X talking to itself, through your own session. Exactly one request goes anywhere else: the licence check. Here it is in full, copied from the source, not paraphrased.
POST https://api.lemonsqueezy.com/v1/licenses/activate
license_key=<the key you typed>
instance_name=TweetXDelete
POST https://api.lemonsqueezy.com/v1/licenses/validate
license_key=<the key you typed>
instance_id=<returned by the step above>
That is the entire payload. No username, no user ID, no post IDs, no counts, no archive contents, no session cookie. The validation call repeats at most once a week, and if it fails because your internet is down, the extension keeps working — a paying customer losing access over a dropped connection would be a worse bug than a copied key.
There is a test in the codebase whose only job is to guard this boundary: if anyone ever adds a third field to that request body, the test fails and the build stops.
Check it yourself
- Open your X tab with the extension installed, then press F12 (or right-click → Inspect) and choose the Network tab.
- Start a small deletion run — set the limit to 3, so you are risking almost nothing.
- Watch the request list. Everything you see will be going to x.com. Filter by "Domain" if it helps.
- Type "lemonsqueezy" into the filter box. You will see the licence check, and you can click it to read the request body — the two lines above, nothing more.
- Load an archive file and watch the network tab stay silent. The file is read in the page; it never becomes an upload.
What this page does not claim
Being honest about the edges matters more than the claims themselves. Deletion is permanent and we cannot recover anything for you. X can change its website at any time, which is what browser-side tools depend on, so the extension needs maintenance to keep working. And nothing anyone deletes can reach the screenshots other people already took.
What we do claim is narrow and testable: your posts, your archive and your session stay on your device, and the only thing that ever reaches our side is a licence key.