Xeet — Privacy Policy
Last updated: 7 September 2026
Xeet is a browser extension that lets you trade tokens directly from X (Twitter). This policy explains exactly what the extension does and does not do with your information.
The short version: Xeet has no accounts and no server of its own. Nothing is sent to us, because there is nothing of ours to send it to. Your settings and swap history live on your own device. What leaves your browser goes directly from your browser to the market-data and routing services listed in section 3.
Xeet never has access to your wallet's private key or seed phrase. There is one exception to "no keys at all", and it is opt-in and described in full in section 2a: if you switch on one-click trading, the extension generates a separate trading key on your device.
1. We never have access to your keys or your funds
Xeet is non-custodial. It cannot hold, move, or spend your assets.
- Xeet never asks for, receives, stores, or transmits your wallet's private key, seed phrase, or recovery phrase. There is no code path in the extension capable of doing so, and no field anywhere that accepts one.
- Every transaction is built by a third-party router (Jupiter on Solana, LI.FI on EVM chains) and must be signed by you in your own wallet. Your wallet's confirmation screen is the only thing that authorises a transaction.
- Xeet cannot initiate a transfer, move funds, or trade on your behalf.
2a. One-click trading, if you turn it on
One-click trading is off by default. Turning it on has one consequence worth understanding completely, so here it is in full, starting with the part you would be angry to discover later.
- Xeet can read this account's key. One-click runs on Robinhood Chain, and Ethereum's signing curve (secp256k1) is not one your browser can hold a key for unreadably — Chrome's Web Crypto implements Ed25519 and P-256 and refuses secp256k1 outright. So the key is thirty-two bytes in this extension's local database. It never leaves your device and is never transmitted, but it is readable by this extension, which means a malicious future version of it could take whatever that account holds. That is the honest statement, and it is why everything below exists.
- It is a separate account you fund on purpose. Xeet creates it on your device. The wallet you connected never signs for it and is never involved in a one-click trade, so what this account can lose is what you put on it — provided you let Xeet generate it rather than importing the key to something larger.
- No seed phrase, ever. If you import a key instead, it is one account's private key. Xeet has no field that accepts a recovery phrase and will refuse one that is pasted.
- Every trade is capped, per trade and per day, and the check runs in the extension's own worker where a web page cannot reach it. Selling is not capped — a position too large to sell in one tap would be a trap, not a safeguard.
- You can send it home at any time. Settings → One-click trading → Send it home moves the balance to the wallet you connected, less the gas for that one transfer. The destination is the connected wallet; there is no field to type an address into.
- If you used the earlier Solana version, that account is not deleted. It can no longer trade, but it stays visible and can still be emptied to a Solana wallet, so nothing you funded it with is stranded.
2. What is stored on your device
Xeet stores the following locally, using your browser's extension storage. It stays on your device.
| Stored | What it is |
|---|---|
| Connected wallet | The public address and wallet name (e.g. "Phantom") of the wallet you connected. A public address only — never keys. |
| Swap history | Your Xeet trades: tokens, amounts, transaction hashes, chain, timestamp, status. |
| Settings | Slippage tolerance, quick-buy amounts, quick-sell percentages, hover delay, what to detect, on/off state. |
| One-click trading account | Only if you enable it: a Robinhood Chain signing key — generated on your device, or one you imported — its address, and your caps. On this chain the key is stored in readable form; see section 2a for what that means. Never transmitted. |
Settings use Chrome's synced extension storage, so they follow your Chrome profile across your own signed-in browsers. That syncing is performed by your browser, not by us.
You can erase all of it at any time by removing the extension, which deletes its storage.
3. What leaves your browser, and to whom
Xeet has no backend. There is no Xeet server, no analytics endpoint, no account system, and no telemetry of any kind. Every request below goes from your browser straight to a third party; we never receive a copy, because there is nowhere for a copy to go.
Market and token data — token addresses, tickers, and chain identifiers are sent so prices, charts, and token details can be returned:
- Dexscreener (
api.dexscreener.com, andcdn.dexscreener.comfor token logos) — prices, liquidity, volume, pairs, images - Jupiter (
lite-api.jup.ag) — Solana token search, prices, balances, routing - LI.FI (
li.quest) — EVM prices and routing - GeckoTerminal (
api.geckoterminal.com) — the price chart
Blockchain reads — your public wallet address is sent to read balances, token decimals, allowances, and to confirm a transaction:
- Public RPC nodes:
*.publicnode.com,api.mainnet.abs.xyz,rpc.mainnet.chain.robinhood.com
Building a trade — when you request a quote, your public wallet address is sent to the router (Jupiter or LI.FI) because a signable transaction must be addressed to you. No key material is involved.
Safety screening — when a token is screened, its contract address (not your address) is sent to GoPlus (api.gopluslabs.io).
Each of these services has its own privacy policy and its own logging practices, which are outside our control.
4. What we do not do
- No analytics, of any kind. No SDK, no tracking pixels, no advertising identifiers, no install or usage counting. The extension makes no request to any server operated by us, because none exists.
- No accounts. There is no sign-up, no email, no password.
- No selling or sharing of data. We hold none to sell.
- No advertising.
- No browsing history collection. Xeet only runs on
x.comandtwitter.com, and only reads post text to detect token addresses and tickers so it can show a card. It does not read, store, or transmit your posts, messages, timeline, or account.
5. Where Xeet runs
Xeet's content script is restricted to x.com and twitter.com. It does not run on any other website.
6. Children
Xeet is not directed to children and is not intended for anyone under 18.
7. Changes
If this policy changes materially, the updated version will be published here with a new "Last updated" date, and the extension listing will reflect it.
8. Contact
Questions about this policy: hello@onhover.local