Prune is a browser extension that helps you review and clean up your X (Twitter) following,
followers, and bookmarks. This policy explains what data Prune touches, what it stores, and —
just as importantly — what it never does.
Prune runs entirely inside your own browser, using your own logged-in X session. There is no
Prune server. Nothing you scan is ever sent anywhere outside your device. Prune never sees or
stores your X password.
What Prune reads
To show you your following list, followers, and bookmarks, and to check how active an account is, Prune reads:
Your following/followers lists (name, handle, bio, avatar, follower counts, whether they follow you back)
Your bookmarked posts (author, text, dates)
Public post timestamps, used only to determine an account's last-post date
All of this is read the same way your own browser already reads it when you use x.com normally
— through your existing, logged-in session. Prune does not use a separate account, API key, or
credential of its own.
What Prune never does
Never stores your X password or login credentials. Prune authenticates using your browser's existing session cookies (a CSRF token and your account ID) — the same non-secret values your browser already sends to x.com. Your actual login token is httpOnly and is never readable by Prune or any extension.
Never sends your account data to a server. There is no Prune backend. Scanning, filtering, and activity analysis all happen locally, in your browser.
Never takes an action without you choosing it. Viewing and scanning never change your account. Unfollowing, following, or deleting only happens when you explicitly select accounts/items and confirm.
Never bypasses X's security. If X presents a CAPTCHA or verification challenge, Prune stops immediately rather than attempting to solve or work around it.
Never shares data with third parties. There is no analytics platform, advertising SDK, or data broker integrated into Prune.
What Prune stores, and where
Prune stores a small amount of data locally on your device, using Chrome's built-in extension
storage (chrome.storage.local) — never on a remote server:
Data
Purpose
Retention
Your scanned following/followers/bookmarks lists
So revisiting a tab doesn't require re-scanning
Until you re-scan or clear extension data
Each account's last-checked activity date
So the same account isn't re-checked repeatedly
7 days, then refreshed
All of this stays on your device and is removed automatically if you uninstall the extension.
Permissions Prune requests, and why
Chrome requires extensions to declare upfront what they can access. Here's what Prune requests and why each one is needed — nothing more than the minimum for the features above:
Host access for x.com / twitter.com — to read your session and talk to X on your behalf, using your own login.
Cookies — to read the two non-secret session values (CSRF token, account ID) needed to make requests as you. Your login credential itself is never read.
Scripting and tabs — some X endpoints only accept requests made from an actual x.com page; this lets Prune run those specific requests inside a real x.com tab rather than the background, without accessing unrelated tabs or browsing history.
Storage — to save the local cache described above.
Accounts and payment
Prune currently has no user accounts, sign-in, or payment system. Everything is free and works without creating any account.
Changes to this policy
If Prune's data practices change (for example, if an optional account/sync feature is added in the future), this policy will be updated and the "Last updated" date above will change accordingly.