ct
← back to ct
Privacy policy
Last updated 6 August 2026
ct is a Chrome extension that builds a feed you control on top of X. It has no accounts, no sign-up and no backend that stores anything about you.
The short version. Everything ct collects stays in your browser. There is no ct account, no server-side profile, and no analytics or tracking of any kind — no telemetry, no crash reporting, no advertising identifiers. We cannot see your feed, your settings, or which posts you read, because none of it is ever sent to us.
The only data that ever leaves your machine is data you choose to send: posts you broadcast, messages you write, and — if you switch it on — the pool of public X posts your copy of ct captured. Each of those is described below.
What ct stores, and where
All of it lives on your own machine, in the browser's extension storage
(chrome.storage.local) and in IndexedDB. None of it is transmitted to us:
- Public posts and profiles from X — the posts and user records ct extracted from X's own responses, so it can rank and search them offline.
- Your settings — theme, feed rules, which capture paths are enabled, the beacons you connect to.
- Your frens list and mutes — the accounts you chose to follow inside ct, and the peers you chose to silence.
- A signing key — an Ed25519 keypair generated locally, which is your identity on the peer network. The private half never leaves your machine.
- Your X account id and handle — read from the session cookie so ct knows which account it is acting as. Each X account you are signed in to gets its own separate key, frens list and storage; ct never merges them.
- A wallet pass, if you linked a wallet — a signed message stating that a wallet address vouches for your peer key. It contains no private key and cannot move funds.
Uninstalling the extension deletes all of it. You can also clear individual pieces from the extension's settings at any time.
What ct reads from X
ct reads the responses X sends to your browser while you use x.com, and — on a schedule you control — makes the same read-only requests X's own web app makes, using the session you are already signed in to. It extracts public posts and public profile records.
ct never reads or stores your likes, your follows, your reading history, your notifications, or your X direct messages. It never posts, likes, follows, replies or takes any other action on your X account — every request it makes to X is a read.
Permissions, and why each one is needed
| Permission | Why ct needs it |
|---|---|
| storage | Saves your settings, frens list, signing key and captured posts on your own machine. This is the only place ct keeps anything. |
| cookies | Reads two cookies on x.com only: twid, to know which X account you are currently signed in as, and ct0, the CSRF token X requires on its own read requests. Neither is stored or transmitted. |
| tabs | Opens a tab when you click a post or start wallet linking, and notices when an x.com tab finishes loading so optional capture can attach to it. ct does not read your browsing history or the contents of tabs on other sites. |
| sidePanel | ct's entire interface is a side panel. |
| offscreen | Hosts the peer-to-peer networking code, which needs WebRTC — unavailable in an extension service worker. |
| alarms | Wakes ct periodically to pull new posts. Chrome shuts idle extensions down after ~30 seconds, so a plain timer cannot survive. |
| debugger | Optional and off by default. An alternative way to capture X responses, used only if you switch it on in settings. Chrome shows a visible banner the whole time it is active. |
| Site access | x.com and twitter.com, to read posts. ct.42069.gg for wallet linking. The Robinhood Chain RPC to read a token balance. The ct beacons, to reach the peer network. |
What leaves your device
X
Read-only requests to X's own API, carrying the session you are already signed in with. This is the same traffic your browser makes when you use x.com normally, and it goes to X, not to us.
The peer network — optional
ct can join a peer-to-peer network so clients share what they captured. It can be switched off entirely, and when it is off nothing here happens. When it is on, these things are published:
- Presence — your peer id, and your X id and handle if ct knows them, so peers can recognise you. Republished periodically while you are online.
- Broadcasts — messages you deliberately write and send. These are public to the network.
- Captured posts — only if you turn on "Share captured posts." This shares public X posts that passed through your client. It carries no record of what you read, liked or followed; posts arrive from background polling as much as from browsing, so it is not a reading history.
- Direct messages — sent over an encrypted point-to-point connection to that peer only. They are not published to the network, and relays carry only ciphertext.
Broadcasts, presence and shared posts are public by design: anyone running ct can receive them. Treat them as you would a public post, not a private message.
Beacons
Browsers cannot connect to each other directly without help, so ct operates relay servers ("beacons") that introduce peers and pass traffic between those that cannot connect directly. Beacons hold no database and keep no logs of message content — traffic through them is encrypted end-to-end between peers. As with any internet server, they necessarily see the IP addresses of the clients connected to them.
Blockchain
Broadcasting requires holding a $CT balance, which ct checks by reading a public blockchain RPC. That read discloses your wallet address and IP to the RPC provider. Linking a wallet happens on ct.42069.gg/link.html, where your wallet signs a plain message — no transaction, no gas, no approval, and no access to your funds. ct never sees your private keys or seed phrase and cannot move anything.
What ct does not do
- No analytics, telemetry, crash reporting, or advertising identifiers.
- No selling or sharing of personal data with third parties. There is no third party to sell it to.
- No tracking your browsing outside x.com.
- No collecting your email, name, or payment details.
- No posting, liking, following, or messaging on your X account.
- No use of your data to train machine-learning models.
Data retention and deletion
Because ct stores everything locally, deletion is entirely in your hands: clear individual data from the extension's settings, or uninstall the extension to remove all of it at once. We hold no copy to delete, so there is nothing to request from us.
Content you already published to the peer network cannot be recalled, in the same way a sent message cannot. Peer copies expire on their own — presence within minutes, broadcasts and shared posts within hours.
Children
ct is not directed at children under 13 and does not knowingly collect their information.
Changes
If this policy changes materially, the date at the top of this page changes with it and the updated policy is posted here before the change takes effect.
Contact
Questions about this policy or about ct's handling of data: info@monemetrics.com.