Privacy Policy
Xrayed · a Risk Averse Tech product · last updated November 2026. Xrayed is an independent tool and is not affiliated with, endorsed, or sponsored by X Corp.
The short version
We don't store the contents of your account. Your posts, your stats and your access token are read, used to build your card, and thrown away. What we do keep is deliberately thin: a usage record (your handle, when you scanned, how many times) so we can enforce the scan limit and track what the X API is costing us, plus the image of any card you choose to share.
What we access
When you sign in with X, we receive a read-only token for your account. During a scan we read: your profile, your recent posts (including their private analytics such as impressions), your mentions, and your follower/following lists. This data is processed in memory to build your report and is not saved server-side.
Where things live
- Your X access token: encrypted inside a cookie in your own browser. We never store it on a server.
- Your scan result: your own browser's local storage, so your card is still there when you come back. Sign out, or use “forget my card”, to erase it.
- Generated archetype art: created via the Create a Meme API from your public profile picture.
- Shared cards: when you tap Post, the finished card image (only the picture, no scan data or tokens) is stored on Vercel Blob under a random link so X can display it. Anyone with the link can view it. To have a shared card removed, message us.
- Your usage record: your X handle and user id, when you first and last scanned, how many scans and shares you've made, and what those scans cost us at X's per-use API rates. That is the whole record — no post text, no follower lists, no tokens. It exists so the scan limit can't be reset by signing out and back in, and so a day's API bill can be accounted for. It is visible only to us, and is deleted automatically 180 days after your last scan.
We use Vercel Web Analytics to count page views. It uses no cookies and doesn't identify individual visitors.
Third-party processors
Scan judgments are computed by TypeSafe (Jev) from a sample of your posts and stats; archetype art is generated by Create a Meme from your public profile image. Neither receives your access token. Hosting is provided by Vercel.
Revoking access
Sign out any time (deletes the cookie), and revoke Xrayed in your X settings under Connected apps. To have your usage record and any cards you shared erased, message @RiskAverseTech and we'll delete them.
Questions: @RiskAverseTech