Privacy Policy
Last updated: October 8, 2026
This policy explains which data RT TOOLS WEB (the dashboard at app.rttoolsx.com and the "RT TOOLS WEB" Chrome extension) uses, why, who it is shared with and how long it is kept.
1. Who we are
RT TOOLS WEB is operated by RT Tools (rttoolsx.com). For any privacy matter, write to suporte@rttoolsx.com.
2. What the product does
RT TOOLS WEB is a dashboard where you choose tools for your own X account (check reposts, send direct messages, extract lists, repost your own media, undo reposts and likes, analyze engagement). The extension connects that dashboard to the X session already open in your browser and runs, only when you tell it to, the actions you started in the dashboard.
3. Data that stays ONLY in your browser
The extension reads and uses this data locally and never sends it to our servers: your X session cookies (including auth_token and ct0); your XChat PIN; your XChat private keys and conversation keys; the full text of the direct messages you receive. The PIN is kept only while unlocking, in the browser session. XChat keys stay in an encrypted local vault.
4. Data we receive and store
Dashboard account: e-mail, password (stored only as a hash), two-step verification secret, language and preferences. License: the license linked to your account, plan and status. Connected X account: the numeric ID and @handle of the account, so each task runs on the right account. Tool data: lists you create or import (@handles and profile IDs), tasks, checkpoints, results (for example @handles, profile IDs, post IDs and the outcome of each action), drafts, the text of the messages you write yourself to send, reports and public engagement metrics. Extension installation: a random installation identifier, the extension ID and version, and the link to your dashboard account. Technical logs: event and error codes without message content; the hosting provider may log the IP address of requests.
5. How we use it
Only to provide the service you subscribed to: authenticate you, check the license, store and run the tasks you created, show results and reports, protect the account and the integrity of the extension, send account e-mails (confirmation, password recovery, license) and provide support. We do not use the data for advertising, do not build marketing profiles and do not sell data.
6. Engagement Analysis with AI
When you ask for the analysis of an engagement report, the server sends to an AI provider only public data of the analyzed profile (name, @handle, bio, follower and following counts, join date) and up to 30 public posts with media (text up to 280 characters, date and public metrics). Your e-mail, license, cookies, tokens, direct messages or credentials are never sent. Providers used, one at a time with automatic failover: Groq, Google Gemini, OpenRouter and Cerebras. The tool only reads: it sends no messages and performs no action on X.
7. Who we share it with
Only with the processors the service needs: Railway (hosting and database), Stripe (payments; card data goes straight to Stripe and never passes through us), Resend (account e-mails) and the AI providers of section 6, only when you ask for an analysis. We may also disclose data when the law requires it. These providers may process data outside Brazil.
8. Chrome Web Store data policy
The use of information received by the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We do not transfer data for purposes unrelated to the extension's purpose, do not use it for advertising and do not allow humans to read your data, except with your consent for support, for security, or to comply with the law.
9. Retention
A dashboard session expires within 3 days. Lists, drafts and automations can be deleted by you in the dashboard at any time. The other account data (tasks, results, reports) is kept while the account exists and is deleted when you ask for the account to be deleted. Payment and license records may be kept for the period required by law. The extension's local data is removed when you uninstall the extension or clear the browser data.
10. Security
HTTPS connections, passwords stored only as hashes, two-step verification, per-account data isolation, an encrypted local vault for XChat keys and integrity verification of the extension against a signed manifest. No system is entirely immune to failure; if a relevant incident happens, we will notify you as the law requires.
11. Your rights
You can ask for access, correction, portability or deletion of your data, and for information about sharing, by writing to suporte@rttoolsx.com from your account e-mail. We honor the rights of the Brazilian General Data Protection Law (LGPD) and answer within a reasonable time.
12. Dashboard cookies
The dashboard uses only essential cookies: the session cookie and the language cookie. We use no advertising or tracking cookies.
13. Minors
RT TOOLS WEB is not intended for people under 18.
14. Changes
We may update this policy to reflect changes to the product or the law. The date of the last update is at the top of this page.