Xeet — Privacy Policy

Last updated: 1 October 2026

Xeet is a browser extension that lets you trade tokens directly from X (Twitter). This policy explains exactly what the extension does and does not do with your information.

The short version: Xeet has no accounts and no server of its own. Nothing is sent to us, because there is nothing of ours to send it to. Your settings and swap history live on your own device. What leaves your browser goes directly from your browser to the market-data and routing services listed in section 3.

Xeet never has access to your wallet's private key or seed phrase. There is one exception to "no keys at all", and it is opt-in and described in full in section 2a: if you switch on one-click trading, the extension generates a separate trading key on your device, one per chain it supports for this.

1. We never have access to your keys or your funds

Xeet is non-custodial. It cannot hold, move, or spend your assets.

• Xeet never asks for, receives, stores, or transmits your wallet's private key, seed phrase, or recovery phrase. There is no code path in the extension capable of doing so, and no field anywhere that accepts one.
• Every transaction is built by a third-party router (Jupiter on Solana, LI.FI on EVM chains) and must be signed by you in your own wallet. Your wallet's confirmation screen is the only thing that authorises a transaction.
• Xeet cannot initiate a transfer, move funds, or trade on your behalf.

2a. One-click trading, if you turn it on

One-click trading is off by default. Turning it on has one consequence worth understanding completely, so here it is in full, starting with the part you would be angry to discover later.

• There is one account per chain, and they are not equally safe. One-click works on Robinhood Chain and on Solana, with a separate key for each.
• On Robinhood Chain, Xeet can read that account's key. Ethereum's signing curve (secp256k1) is not one your browser can hold a key for unreadably — Chrome's Web Crypto implements Ed25519 and P-256 and refuses secp256k1 outright. So that key is thirty-two bytes in this extension's local database. It never leaves your device and is never transmitted, but it is readable by this extension, which means a malicious future version of it could take whatever that account holds. That is the honest statement, and it is why everything below exists.
• On Solana it cannot. That key is generated inside the browser's own key store as an unexportable Ed25519 key: Xeet can ask it to sign and cannot read it back out, and neither can a web page or a later version of this extension. A key you import is put through the same door — the bytes you paste are used once and what is kept cannot be exported. The caps and the separate-account advice still apply, because anything sitting on that account can still be traded by one tap.
• It is a separate account you fund on purpose. Xeet creates it on your device. The wallet you connected never signs for it and is never involved in a one-click trade, so what this account can lose is what you put on it — provided you let Xeet generate it rather than importing the key to something larger.
• No seed phrase, ever. If you import a key instead, it is one account's private key. Xeet has no field that accepts a recovery phrase and will refuse one that is pasted.
• Every trade is capped, per trade and per day, and the check runs in the extension's own worker where a web page cannot reach it. Selling is not capped — a position too large to sell in one tap would be a trap, not a safeguard.
• You can send it home at any time. Settings → One-click trading → Send it home moves the balance to the wallet you connected, less the gas for that one transfer. The destination is the connected wallet; there is no field to type an address into.
• A Solana account from an earlier version keeps working. It is the same account, in the same place; nothing was deleted, and it can trade again.

2. What is stored on your device

Xeet stores the following locally, using your browser's extension storage. It stays on your device.

Settings use Chrome's synced extension storage, so they follow your Chrome profile across your own signed-in browsers. That syncing is performed by your browser, not by us.

You can erase all of it at any time by removing the extension, which deletes its storage.

3. What leaves your browser, and to whom

Xeet has no backend. There is no Xeet server, no analytics endpoint, no account system, and no telemetry of any kind. Every request below goes from your browser straight to a third party; we never receive a copy, because there is nowhere for a copy to go.

Market and token data — token addresses, tickers, and chain identifiers are sent so prices, charts, and token details can be returned:

• Dexscreener (api.dexscreener.com, and cdn.dexscreener.com for token logos) — prices, liquidity, volume, pairs, images
• Jupiter (lite-api.jup.ag) — Solana token search, prices, balances, routing
• LI.FI (li.quest) — EVM prices and routing
• GeckoTerminal (api.geckoterminal.com) — the price chart

Blockchain reads — your public wallet address is sent to read balances, token decimals, allowances, and to confirm a transaction:

• Public RPC nodes: *.publicnode.com, api.mainnet.abs.xyz, rpc.mainnet.chain.robinhood.com

Building a trade — when you request a quote, your public wallet address is sent to the router (Jupiter or LI.FI) because a signable transaction must be addressed to you. No key material is involved.

Safety screening — when a token is screened, its contract address (not your address) is sent to GoPlus (api.gopluslabs.io).

Each of these services has its own privacy policy and its own logging practices, which are outside our control.

4. What we do not do

• No analytics, of any kind. No SDK, no tracking pixels, no advertising identifiers, no install or usage counting. The extension makes no request to any server operated by us, because none exists.
• No accounts. There is no sign-up, no email, no password.
• No selling or sharing of data. We hold none to sell.
• No advertising.
• No browsing history collection. Xeet only runs on x.com and twitter.com, and only reads post text to detect token addresses and tickers so it can show a card. It does not read, store, or transmit your posts, messages, timeline, or account.

5. Where Xeet runs

Xeet's content script is restricted to x.com and twitter.com. It does not run on any other website.

6. Children

Xeet is not directed to children and is not intended for anyone under 18.

7. Changes

If this policy changes materially, the updated version will be published here with a new "Last updated" date, and the extension listing will reflect it.

8. Contact

Questions about this policy: hello@xeet.click

Or on X: