XGrab (“the extension”) is a free browser extension that saves photos, videos and GIFs from X (Twitter) to your computer.
What we collect
Nothing. The extension does not send any personal data to the developer or to third parties. We never receive any information about you, your X account or what you download.
- We do not use analytics or tracking of any kind, and there is no install ping.
- We do not use cookies.
- We do not have user accounts.
- We do not operate any server that your data passes through.
How it works
The extension runs on x.com and twitter.com. It reads the posts X
already sends to your browser to find the media files, and saves those
files from X’s media servers (pbs.twimg.com and video.twimg.com) to
your computer.
Your X session headers
To list all media of a profile, XGrab repeats X’s own media list request
with your current session. To do that, it reads the headers of that
request when the X page sends it, and keeps a copy in the extension’s
local storage (chrome.storage.local) on your computer. The copy holds
the request address and these headers:
authorizationandx-csrf-token, the tokens of your signed in X sessionx-twitter-auth-type,x-twitter-active-userandx-twitter-client-language
Please be aware that these tokens give access to your X session. XGrab treats them accordingly:
- They are only sent to X (
x.comortwitter.com), as part of the media list requests that the extension makes on your behalf when you click Download All. - They are never sent to us or anyone else.
- The latest copy replaces the previous one. It stays in your browser until the next copy replaces it or you remove the extension.
Network requests
The extension only makes requests to X:
- Media list pages from
x.comortwitter.com, sent with your own session as described above, when you click Download All. - Media files from
pbs.twimg.comandvideo.twimg.com, when you download.
There are no other network requests.
Where your data lives
Everything stays on your computer:
- the session headers described above
- the download queue, so a running batch can continue after a restart
- the folder you picked, kept in the extension’s IndexedDB storage
- post IDs, usernames and media links, in memory while the page is open
Removing the extension deletes all of it.
Permissions
- Access to
x.com,twitter.com,pbs.twimg.comandvideo.twimg.com: to add download buttons, read media links and fetch the files. - Downloads: to save files to your downloads folder and avoid saving a file twice.
- Storage: to keep the download progress and the request details described above.
- Web requests: to read the headers of X’s media list request, as described above. The extension never blocks or changes a request.
Data sharing
We do not sell, share, or transfer any user data to third parties.
Children’s privacy
The extension does not knowingly collect any data from anyone, including children under 13.
Changes to this policy
If we update this policy we will change the “Last updated” date at the top of this page. Material changes will also be noted in the extension’s release notes on the Chrome Web Store.
Contact
For questions about this policy, contact [email protected].