Privacy policyKnow where your data goes.

Reply Assistant reads the selected social post when you open its panel. It sends the selected text, quoted text, loaded conversation messages and author handles, your optional notes, language preferences and model instructions to your chosen AI provider when you request a translation or reply, or when you open or refresh a conversation with Auto translate enabled. Auto translate is off by default and can be enabled or disabled on the extension settings page. Loading available models sends your API key to the configured models endpoint from the settings page, without any post text; this does not automatically save your settings or key.

Connection testing sends a short test message, not a social post. Generated replies are never posted automatically.

On HTTP/HTTPS webpages, you can select a paragraph and choose “Reply to selected text” from the context menu. Only the selected text is transferred to a floating panel on the current webpage, using the same window as the X assistant, without reading the whole page or author identity. The current tab URL is checked to choose the X or on-demand entry point and verify that the clicked page has not changed; it is not saved or sent to the model. Selected paragraphs use the same global Auto translate preference as X conversations. When enabled, opening or refreshing a selection reuses cached translations and requests missing translations from your configured provider. When disabled, translation requires a click. Reply generation always requires an explicit click; your notes are included when you generate replies.

Selections above 18,000 characters are truncated with a notice.

You can explicitly create reusable product facts, real experiences and perspectives in Settings → Reply materials. Card titles, bodies, custom category labels, optional usage notes, revision timestamps, cumulative usage counts and last-use timestamps are stored locally (up to 200 cards). A library can have up to six categories used by saved cards, reusable when creating or editing a card. Labels allow up to six Chinese or twelve English characters; mixed labels count Chinese characters as two and other characters as one, up to twelve. Removing or moving the last card in a category frees its slot.

The reply panel can display this library to let you choose up to three cards for the current reply. Only the selected titles, bodies, custom category labels and notes are sent to your configured provider when you explicitly generate a reply. Cards are not sent for translation or automatic translation. Top 3 recommendations are based on usage counts, with recent use breaking ties; cards are never selected automatically. Each selected card counts once after a successful generation with reply candidates, not per candidate, selection, preview, copy or publication.

Up to 1,000 recent successful request IDs are retained locally to avoid duplicate counting. Usage statistics are not sent to the provider or developer. Edit or delete cards from the Reply materials menu; editing preserves usage counts, and deletion removes that card and its count. Cards remain until individually deleted or the extension is uninstalled; deleting model settings and keys does not delete cards.

Requests go directly from the extension to the HTTPS API endpoint you configure, authenticated with your own API key. That provider processes the request under its own policies and may charge API fees. If you use a gateway, that gateway may route your text to downstream model providers. Review their terms before sending sensitive or non-public material. We do not operate a model relay server or receive your posts or plaintext API keys.

The interface supports English and Simplified Chinese, with a browser-language option, independently of reading and reply languages. The extension stores this interface preference only on this device, outside ordinary cloud sync and local backups. The website stores a first-party language-preference cookie for up to one year; it can be cleared in the browser and is not used for identification or tracking.

Your language and model settings, plus the floating window size, position and column layout and auto-translation preferences, are stored locally in this browser profile. Keys are stored in memory for the browser session by default. If you choose “Remember key on this device”, the key is stored locally on this device. Ordinary sync excludes model keys; an optional client-encrypted vault is described separately. Local key storage is not an encrypted vault. Keys are not provided to the page content script. The extension does not maintain a reading-history log or persist reply candidates.

Message translations are automatically cached in trusted extension session storage to avoid repeated translation: up to 100 messages or 2 MB, usable for 24 hours, with least-recently-used eviction. Expired entries are removed on the next cache operation; all session entries clear at browser-session end. Entries contain translations, SHA-256 input fingerprints and cache timestamps, without raw source text, authors, post IDs, URLs or keys. Matching translations can be shown when another comment includes the same main post. Clear them in Settings → Advanced settings → Clear translation cache, or by deleting model settings.

Retranslate bypasses completed cache entries. Cached original messages can still be sent as context when translating missing messages or generating replies; a fully cached translation request makes no provider call. Content you explicitly save as a reusable card is retained locally as described above. Selected paragraphs are passed directly to the panel in memory and are not stored as transfer drafts.

For each on-demand panel, trusted session storage holds only its tab ID, document ID and random selection ID to authorize requests from that document. This record is replaced for a new selection, removed when the tab closes and cleared at browser-session end. Panel contents, including candidate edits, remain in memory while the panel exists; repeated opening of the unchanged current post preserves them. Local publication statistics automatically count identifiable comments (including replies) and quote posts on X. It observes trusted send actions and the presence of a new post link in the rendered publication notification. It reads composer structure, not draft text, to identify the type.

Missing evidence, unclear types, overlapping sends and timeouts are skipped, with no manual entries or confirmations. Counts may miss posts and are not account-wide totals. Recording runs whenever the extension is installed; there is no separate switch. We retain up to 366 recorded dates of daily totals and 1,000 salted SHA-256 hashes of published post IDs for deduplication, plus a random salt and preference revision. Raw new post IDs are processed transiently in the extension background and are not persisted; no new post text, author names, drafts or source URLs are stored. Counts are never sent to the developer or model provider.

Clearing current totals retains the recent deduplication hashes to avoid counting delayed duplicates. Older assistant usage and publication statistics remain separate for optional export or deletion and are not converted into new publication totals. The extension no longer records new assistant usage counts. Storage failures may cause missed counts without interrupting the website or assistant.

Settings provides an explicit local JSON export and import for saved model, language and generation preferences and user-created materials (up to 3 MB). Version 2 also includes strategy text and the default choice; version 1 remains readable. Importing never grants Pro access. Backup files are unencrypted and may contain private materials; keep them safe. They exclude API keys, consent, key-storage and Auto translate preferences, device permissions, statistics, usage counters and translation cache. Import previews the scope and does not contact a model or upload the file. Settings fill the form and require you to review the endpoint and local key, confirm the disclosure again and save.

Materials are saved on confirmation: Merge skips identical content and keeps same-ID conflicts as copies; Replace removes local cards absent from the file and their counters. Matching IDs retain local usage counts; new cards start at zero. Imports exceeding library limits or based on an edited preview are rejected. These files are outside extension storage; deleting settings or uninstalling does not delete downloaded backups.

The development build adds an optional Account & sync page. Free local features do not require login. When you explicitly connect an account, the production extension contacts the official product platform at https://reply.hboot.fun (only development builds allow a different test address) after domain permission. The platform uses unified-auth for identity and product sessions. It stores the verified product user mapping, a random browser-installation ID, a device name you provide, session association, last-activity and revocation status.

Login attempts use temporary proofs and encrypted server-side session results; requests expire within five minutes, and claimed results are retained for at most two further minutes within that lifetime. Maintenance removes expired records. Brief encrypted refresh results support safe retries for one minute and are removed by maintenance; request bodies and credentials are not logged by the application. User and device records remain until removed through support. Ordinary infrastructure access logs may contain request metadata; unified-auth processes login information under its own policy.

Web sessions use HttpOnly cookies. Extension session credentials are kept only in trusted extension contexts, never webpage scripts, URL parameters, content scripts, ordinary backups, or model requests. Stay signed in may persist the product refresh credential locally; it is separate from Remember model key. Without that choice, credentials clear at browser-session end. Signing out clears the local account credentials while preserving model settings, model keys and materials.

If upstream revocation cannot be confirmed, the extension reports this; the platform account center can revoke a browser installation’s product access, but cannot erase data already stored locally. Contact support to request removal of product account/device records; signing out, revoking a device and deleting model settings are different actions. Account merge and product-account deletion are not yet self-service features. Signing in alone does not upload work data. Development ordinary cloud sync requires active Pro access and a separate preview, scope selection and explicit enable action in the extension. Selected model and language preferences, materials and strategies are stored on the product platform; ordinary data is not end-to-end encrypted. Posts, conversations, translations, candidates, statistics, cache, plaintext model keys, consent and device permissions are excluded. Custom drafting strategies can be saved locally and are sent to the selected model provider only when you explicitly generate. Creating, editing and using custom strategies requires active Pro; ordinary cloud sync includes them only with separate consent. The key vault is a development feature pending independent acceptance. Billing manages product availability, payment collection and refund permission.

Sync baselines, queued documents and conflict copies are stored in local IndexedDB used by the trusted extension background for restart recovery. Cloud recoverable history retains up to ten versions for thirty days. Current cloud data can be exported or cleared from the extension or account center; exports are unencrypted. Clearing removes recoverable history, advances the sync epoch and pauses every device while preserving local data. Minimal account/epoch deletion markers prevent old queues or infrastructure restores from reintroducing cleared data; infrastructure restoration must replay an independently stored deletion journal before reopening the service. Signing out never rebinds an old queue to a different account. Pausing sync does not delete existing cloud data.

Billing manages products, prices, duration, payment collection and refund permission. When you explicitly purchase, the product sends a random purchase reference, SKU and web source marker to unified-billing and retains account/order ownership, approved SKU/price/currency/duration/refund terms, payment/refund event summaries, entitlement sources and retry jobs. Rights change only after verified signed fulfillment. We do not store card details; checkout and payment services process payment information under their own notices. Browser local storage retains an unconfirmed purchase intent for safe retries and clears it once the order is confirmed. Financial and entitlement records are separate from sync data and are not erased by clearing cloud materials; contact support about related removal or refund requests. Expiry reminders retain the user, entitlement version, expiry, current reminder window and shown/dismissed times on the product platform. Reminders for superseded entitlement versions are removed after thirty days. They appear when the account or plan page is opened; no email or system notifications are sent.

The optional development key vault uploads a client-encrypted envelope only after you set a sync password, save a recovery code and explicitly confirm. Passwords and recovery codes are not sent to the platform. It stores the required user/vault/epoch identifiers, full model-service address, entry identifiers, KDF parameters, wrapped data key and key ciphertext. Account login alone cannot decrypt it. Ordinary sync data does not become encrypted, and ordinary backups and default exports exclude the vault.

Argon2id code is packaged with the extension, and keys use AES-256-GCM; encryption code is not loaded remotely. Unlock material stays only in trusted extension session storage for up to thirty minutes, and draft/application tickets for up to five minutes. Sign-out, account changes, manual lock and expiry processing clear the corresponding material. The trusted background verifies the full service source and applies a decrypted key only through explicit Settings save; the application flow returns only the source and a ticket to Settings, never the plaintext; content scripts never receive keys. Applied plaintext keys follow your session-only or Remember key choice.

Changing the password does not revoke the existing recovery code. Rotating the data key creates a new code but cannot erase model keys already decrypted and saved on other devices. Lost unlock materials cannot be recovered; a recent sign-in allows resetting the vault. Vault reset and ordinary cloud clear delete the cloud ciphertext and retain minimal epoch records to prevent resurrection on backup restore. A separate ciphertext export excludes passwords, recovery codes, DEKs and plaintext keys. Cryptographic-envelope and cross-device acceptance is pending; this development implementation is not a claim of completed security acceptance.

Access to x.com allows the extension to add its panel and extract the selected post and, on request, loaded messages preceding it in its detail page. Conversation ancestry requires your review; unloaded and collapsed messages are not fetched. The contextMenus permission provides the selection-only reply menu on webpages. The activeTab and scripting permissions let that explicit menu action inject the packaged floating panel into the current tab; they do not grant permanent access to all websites. No webpage panel is injected automatically outside the existing X adapter. Storage saves settings, your chosen key storage preference, user-created content cards and local publication statistics. The alarms permission schedules low-frequency sync recovery only after you have explicitly enabled sync; it never generates replies or collects a timeline. Passive listeners observe send clicks or Ctrl/Cmd+Enter, composer structure and rendered publication notifications.

DOM observation runs only briefly to associate a reply dialog or await a publication notification. It does not prevent or modify website events, read draft text, fill or submit a composer, request hidden data, intercept or modify network requests/responses, replace fetch/XMLHttpRequest, or scan publication history. If statistics preferences cannot be read, statistics listeners and observers are removed. There are no manual publication entries or confirmations. Access to the model API domain is requested when you load its models or save its configuration.

In the development build, optional access to the product platform (fixed to https://reply.hboot.fun in production builds) is requested only when you save account connection settings or initiate sign-in; it does not grant permission to upload model data. The extension does not request cookies, browsing history, or permission to publish posts.

You can review the read-only post, remove or reorder earlier messages, and add notes before generating replies, cancel an in-progress request, and delete settings and keys from the settings page. On the Statistics page you can export daily aggregates and clear current totals independently of model settings, material counts and older statistics. Clearing totals invalidates unfinished observations. Recent deduplication hashes remain after clearing totals; uninstalling removes all extension storage. Older assistant usage and publication data can be exported or deleted separately.

Cancelling does not retract data already sent to the provider or guarantee reversal of charges. Close the panel to stop using it; uninstalling removes extension storage. Data already sent to a provider is governed by that provider's retention and deletion policies.

Data is used only to provide the disclosed reading, translation and reply-assistance features. It is not sold, used for advertising or collected for remote analytics. Publication statistics are kept locally for your own review. Our use of user data adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

Contact hboot0230@gmail.com for support or privacy questions. Never send an API key or private post when reporting an issue.