oddlyapps / manipulator / privacy
Last updated: May 16, 2026

Privacy policy

Manipulator is a Chrome extension that scores tweets on x.com / twitter.com for engagement-bait patterns. The extension runs entirely in your browser. No data leaves your device apart from network requests x.com itself would already make, plus a one-time ML-model download.

What stays local (never sent anywhere)

  • In chrome.storage.local — per-handle scoring history. A running count and average score for each X handle you've scrolled past, built purely from on-device computation. Used to recognize accounts that have posted many manipulative tweets and adjust future scores.
  • In chrome.storage.local — "about this account" cache (7-day expiry). The public profile data X shows on the /about sub-page: country, date joined, verification, posting client. Cached per handle so it isn't re-fetched on every reload.
  • In sessionStorage — a rate-limit backoff timestamp, so the extension doesn't hammer X's API if it returns a 429.
  • In browser IndexedDB (via Hugging Face Transformers.js) — the on-device ML model weights (~70 MB), downloaded once on first use and cached afterward.

What is never collected or transmitted

  • Tweet text content
  • Tweet authors' handles or display names
  • Profile data (country, dates, verification status, posting client)
  • Tweet URLs or IDs
  • Your own X account, email, name, IP address, or any personally identifiable information
  • Your scoring history or which tweets you have viewed

These categories are read in your browser solely to compute the score badge, then discarded. They are not transmitted to any remote service.

Network requests Manipulator makes

  • x.com / twitter.com — a same-origin GraphQL request to the AboutAccountQuery endpoint to fetch the public "about this account" profile for tweet authors. Uses your existing X session cookies, identical to what x.com does when you open a profile page. No data about you is sent to X beyond your normal browsing session.
  • huggingface.co, *.huggingface.co, cdn-lfs.huggingface.co — used once per install to download the ML model weights and tokenizer (data files only — no executable code). Cached in your browser's IndexedDB thereafter.

The extension makes no other network requests. There is no developer-controlled server, no analytics endpoint, no telemetry, no advertising or tracking pixels, and no third-party SDK.

No analytics, no tracking

Manipulator does not include any analytics or telemetry. There is no opt-in tier that enables data collection. The developer has no way to learn anything about your use of the extension — including how often you use it, what tweets you see, or whether you have it installed.

Permissions

  • storage — to persist the local scoring history and About-data cache described above.
  • offscreen — to host a hidden HTML document where the on-device ML model runs. Required because Manifest V3 service workers cannot run the inference library.
  • Host permissions on x.com, twitter.com — to inject the score badge into the timeline and call X's "about this account" API using your existing session.
  • Host permissions on huggingface.co (and subdomains) — to download the ML model weights on first install.

Children

Manipulator is not directed at children under 13 and does not knowingly collect any data from them. (In fact, it doesn't knowingly collect data from anyone.)

Open source

You can audit every claim in this policy by reading the extension's source code. The codebase is small enough to inspect in an afternoon — every fetch, every chrome.storage call, every DOM access is in the open.

Changes to this policy

If this policy changes, the updated version replaces this page and is bundled in the next extension release. Material changes (e.g. adding any new network destination) would be called out in the Chrome Web Store listing change notes.

Contact

Open an issue on the source repository, or email info@oddlyapps.com.