小小东 · xPoster 隐私政策

中文

xPoster 是本地优先的浏览器扩展：草稿、记录和封面都保存在你的浏览器里，xPoster 没有自己的服务器。写入 X 需要登录小小东会员站（vip.xiaoxiaodong.ai）账号。

它会读取什么

你粘贴或导入到侧边栏的 Markdown 文本。
当你使用可选封面生成功能时，xPoster 会在本地根据草稿整理一段可见且可编辑的封面方向，并读取你选择的可选封面风格。
当前 X/Twitter 标签页 URL 和页面状态。
只有在你选择本地文件夹后，才读取本地图片文件。
只有在 Chrome 授权图片网站后，才读取网页图片文件。

它会保存什么

草稿文本会保存在 Chrome 扩展本地存储中，方便你重新打开侧边栏时恢复。
如果你在设置中填写了图像 API key 列表、API Base URL、启用条目、key 测试状态和封面提示词配置，它们会保存在本地扩展存储中。
如果你选择了本地图片文件夹，会保存对应的文件夹授权句柄。
检查和导入记录会显示在侧边栏中。
你的提示词（「提示词」页）：名称、内容、用途、标签、置顶、使用次数，以及你给图片提示词加的示例图（示例图只存在这个浏览器里）。
生成的封面候选图默认只保留在当前侧边栏会话中。
账号会话：会员站签发的可撤销访问令牌及其到期时间、账号标识（用户 ID、邮箱、昵称、头像地址），以及最近一次会员状态（套餐和到期时间）。xPoster 不保存密码，也不保存任何支付信息。
会员站签发的会员凭证（带数字签名），断网时会员最多还能用 3 天。

账号、会员和支付

登录有两种方式：在会员站自己的页面登录（Google 或邮箱；xPoster 只收到授权码，再换成访问令牌）；或在侧边栏输入邮箱和密码，邮箱和密码只通过 HTTPS 发送到 vip.xiaoxiaodong.ai 做一次登录或注册。
登录后，xPoster 会向会员站查询账号标识和会员状态（xPoster 会员、7 天体验或小小东 VIP；套餐和到期时间），以及免费版每天能写入几篇。
开通或续费会员时，xPoster 只向会员站提交所选套餐、支付方式和页面显示的金额，由会员站创建订单。微信支付二维码在侧边栏本地生成；支付宝和银行卡付款会在新标签页打开支付机构（支付宝、Waffo）的收银台，付款信息只在那里填写。之后 xPoster 向会员站查询订单状态。
你输入的兑换码会发送到会员站，用于增加会员天数。
在小小东会员站的图片上选「⋯ › 加到 xPoster」时，那个页面把风格的名称、提示词、风格链接和一张小示例图交给同一个浏览器里的 xPoster，存成你的一条图片提示词。这一步不向任何地方发送数据；用它生成封面和其他提示词一样，走你自己的图像 API。只有 vip.xiaoxiaodong.ai 上的页面能把提示词交给 xPoster。
备份到 Google Drive 默认关闭，在「设置 › 备份」里连接后才开始。授权在 Google 自己的页面上完成，只允许读写你 Drive 里的隐藏应用目录（看不到你的其他文件）。会员站为你的账号加密保存这份 Google 授权；用同一账号登录的其他小小东插件共用这一个连接，断开时会一起断开。备份里有你的设置（不含任何 API 密钥和登录凭证）、提示词（不含示例图）和草稿，经会员站存进你的 Drive，每天一份、留最近 7 天。会员可以备份；连上的账号都能查看和恢复自己的备份。恢复前，这台电脑原来的内容会先存一份在本机，可以撤销。
提示词同步默认关闭，在「设置 › 提示词」里打开。打开后，你自己的提示词（名称、内容、用途、标签、置顶、使用次数、变量上次填的值）、你对内置提示词的改动（置顶、隐藏、使用次数）和最近 30 天删除过哪些提示词，会保存在你的会员站账号里，登录同一账号的每台电脑上都一样。示例图不上传。会员可以保存；登录的账号都能读回自己的那份。关掉同步就不再上传；需要删除已保存的那份，请联系我们。
免费版每天写入几篇由会员站计数：每次写入前，xPoster 发送你的时区偏移和稿子标题的单向摘要（同一篇当天重写不再计数）。标题原文和草稿其余内容都不会发送。
订单、支付和账号由小小东会员站和支付机构处理，适用它们各自的隐私政策（会员站隐私政策）。
图片、记录、封面和图像 API key 从不发送给会员站。提示词只在你打开提示词同步后发送；草稿只在你连接了 Google Drive 备份后，随备份经会员站转存到你自己的 Drive，会员站不留存备份内容。

它不会做什么

不发送分析统计。
不把草稿、图片或记录存到任何 xPoster 或会员站服务器（Google Drive 备份经会员站转存，存在你自己的 Drive 里）。
除非你点击可选的封面生成按钮，否则不会把本地整理的封面方向、所选可选风格和固定图片生成指令发送给已配置的图像 API；草稿其余内容不会发送。
不出售用户数据，也不用于广告。
不点击 X 的发布按钮。

权限说明

storage：在这个浏览器里保存草稿、本地设置和账号会话。
identity：打开会员站的登录窗口，并接收登录结果。
sidePanel：显示发布控制台。
tabs：找到并检查当前 X Article 标签页。
scripting：在已经打开的 X/Twitter 页面补载导入器，无需刷新草稿。
可选域名权限：只有在你授权后，才会读取已允许的图片网站，或请求 OpenAI、Gemini、自定义 OpenAI 兼容 API 域名。
https://x.com/* 和 https://twitter.com/*：在 X/Twitter 页面上运行导入器。
已发布版本中的可选域名权限仅用于 Markdown 引用的图片网站，以及你明确授权用于封面生成的图像 API 域名。

联系作者

可以通过作者 X 主页联系：@xiaoxiaodong01。

English

xPoster is a local-first browser extension. Your drafts, records and covers stay in this browser; xPoster has no server of its own. To write to X you sign in with a 小小东 member-site account (vip.xiaoxiaodong.ai).

What It Reads

Markdown text you paste or load in the side panel.
The visible cover direction prepared locally from your draft (and editable by you), plus any optional cover style you selected, only when you use the optional cover generator.
The active X/Twitter tab URL and page state.
Local image files only after you choose a local folder.
Remote image files only after Chrome grants host permission for that image website.

What It Stores

Draft text in Chrome extension local storage, so reopening the side panel can restore your draft.
Your image API keys, API base URLs, active-key choice, key test status, and cover prompt profiles, if you fill them in Settings.
Local image folder handles, if you choose a folder.
Import/check evidence records shown inside the side panel.
Your prompts (Prompts tab): their names, words, uses, tags and pins, how often you used them, and the example pictures you add to image prompts (example pictures stay in this browser only).
Generated cover candidates are kept only in the current side panel session by default.
Your account session: a revocable access token issued by the member site and its expiry, your account id, email, display name and avatar address, and the last membership status (plan and end date). xPoster never stores your password or any payment details.
The member site's signed membership token, which lets a member keep working offline for up to 3 days.

Account, Membership and Payment

Sign-in happens either on the member site's own page (Google or email; xPoster only receives an authorization code and exchanges it for an access token), or in the side panel with email and password, which are sent once over HTTPS to vip.xiaoxiaodong.ai to sign in or create the account.
After sign-in, xPoster asks the member site for your account id and membership status (xPoster membership, the 7-day trial, or 小小东 VIP; plan and end date), and how many articles the free tier may write per day.
To buy or renew a membership, xPoster sends the member site only the chosen plan, payment method and the displayed amount; the member site creates the order. WeChat Pay QR codes are drawn locally in the side panel; Alipay and card payments open the payment provider's checkout (Alipay, Waffo) in a new tab, and payment details are entered only there. xPoster then asks the member site for the order status.
Redemption codes you type are sent to the member site to add membership days.
When you choose ⋯ › Add to xPoster on an image in the 小小东 member site, that page hands the style's name, its prompt, a link to it and a small example picture to xPoster in the same browser, which keeps them as one of your image prompts. Nothing is sent anywhere for this; covers made with it use your own image API, as any other prompt. Only pages on vip.xiaoxiaodong.ai can hand prompts to xPoster.
Backup to Google Drive is off until you connect it (Settings › Backup). You authorize on Google's own page, for the hidden app folder of your Drive only (xPoster cannot see your other files). The member site keeps the Google authorization, encrypted, for your account; the other 小小东 extensions you sign in to with the same account share that one connection, and disconnecting stops it for all of them. A backup holds your settings (never API keys or tokens), your prompts (not their example pictures) and your drafts; xPoster sends it through the member site to your Drive, which keeps one per day for the last 7 days. Members can back up; anyone connected can list and restore their own backups. Before a restore, what was on this computer is kept here so the restore can be undone.
Prompt sync is off until you turn it on (Settings › Prompts). When it is on, your own prompts (names, words, uses, tags, pins, use counts, the values you last filled in for their variables), your changes to the built-in prompts (pinned, hidden, use counts) and the record of prompts you deleted in the last 30 days are saved in your member-site account, so they are the same on every computer you sign in on. Example pictures are not uploaded. Members can save; any signed-in account can read its own copy back. Turning sync off stops it; to remove the saved copy, contact us.
For the free tier, the member site counts how many articles you wrote today: before each write xPoster sends it your time zone offset and a one-way digest of the draft's title (so rewriting the same article costs nothing). The title itself, and the rest of the draft, are never sent.
Orders, payments and accounts are handled by the 小小东 member site and the payment providers under their own privacy policies (member site privacy policy).
Images, records, covers and image API keys are never sent to the member site. Prompts are sent only when you turn on prompt sync; drafts only when you connect Google Drive backup, passed through the member site into your own Drive with the backup, and the member site does not keep the backup's contents.

What It Does Not Do

It does not send analytics.
It does not store drafts, images or records on any xPoster or member-site server (a Google Drive backup passes through the member site into your own Drive).
It does not send the locally prepared cover direction, selected optional style, or fixed image-generation instructions to a configured image API unless you click the optional cover generation button. It does not send the rest of the draft.
It does not sell user data or use it for advertising.
It does not click X's Publish button.

Permissions

storage: save drafts, local settings and the account session in this browser.
identity: open the member site's sign-in window and receive the sign-in result.
sidePanel: show the publishing console.
tabs: find and check the active X Article tab.
scripting: reconnect the importer on an already-open X/Twitter page without refreshing the draft.
Optional host permissions: read approved image hosts and call OpenAI, Gemini, or custom OpenAI-compatible API hosts only after you grant access for that host.
https://x.com/* and https://twitter.com/*: run the importer on X/Twitter pages.
Optional host permissions in published builds are limited to image hosts referenced by your Markdown and image API hosts you explicitly authorize for cover generation.

Contact

Contact the author on X: @xiaoxiaodong01.