Privacy & key safety

Last updated: August 2026

The short version

Xstr stores only what it needs to mirror your posts: your X access tokens and, depending on the signing mode you choose, your Nostr key. Secrets are encrypted with AES-256-GCM before they are stored and are never shown again in the app. There are no analytics, no trackers, and no ads. The only thing the hosted service ever sends to a third party is a secret-scrubbed crash report when the server errors (see Crash reporting below); self-hosted installs send nothing at all.

What is stored

• X account: your username, user ID, and the OAuth access tokens X gives us — encrypted before storage. Your X password never touches Xstr.
• Nostr signer: depends on the mode you pick (see below).
• Sync state: which posts were mirrored, relay results, and settings — so nothing is posted twice.

The three signing modes, honestly

• Browser extension (most private): your key stays inside your extension (Alby, nos2x). Xstr only ever sees your public key, and you approve every post yourself.
• Remote signer / Nostr Connect: your key stays in your signer app (nsec.app, Amber). Xstr stores only an encrypted connection credential and asks your signer to sign each post.
• Private key (easiest): you paste your key once and it is encrypted before storage. To publish in the background, the server briefly decrypts it in memory while signing. If you prefer that the key never reach the server at all, use one of the two modes above — that's exactly what they're for.

What is never collected

• No analytics or tracking scripts, no fingerprinting, no ad pixels.
• No selling or sharing of data with anyone.
• No reading of your DMs — Xstr only reads the public posts on your own profile that you asked it to mirror.

Crash reporting

The hosted instance at xtonostr.com reports unexpected server errors to Sentry so bugs can be found and fixed. Crash reports contain the error and a stack trace, scrubbed of secrets (keys and tokens are stripped before anything is sent). They do not include your posts, and no IP addresses, cookies, or request bodies are attached. Self-hosted installs never do this — crash reporting is off unless you set a SENTRY_DSN yourself.

Cookies

Xstr sets a single, strictly-necessary session cookie so the app knows it's you between requests. It carries no advertising or tracking data, isn't shared with anyone, and there are no third-party or analytics cookies — so there's nothing to consent to beyond keeping you signed in. Clear it any time by signing out or using Reset everything.

Your rights (GDPR & similar)

The hosted service at xtonostr.com is owned and operated by Econommi, Ltd., a Delaware corporation, which is the data controller for the data described on this page. Xstr is built on data minimisation: it stores only what it needs to mirror your posts, and secrets are encrypted at rest. You can access your data (it's shown in the app and exportable), delete all of it in one click, and withdraw access by disconnecting X (which revokes the token) or removing your Nostr signer. Because you connect your own accounts and self-hosting is supported, you stay in control of where your data lives. Questions or a data request? Email xtonostr@gmail.com or send feedback from inside the app.

Deleting your data

You are always one click away from a clean slate: Reset everything (the circular-arrows button in the app) disconnects X, deletes your stored signer and tokens, and clears all sync state. Disconnecting X also revokes the app's access token with X.

Independence

Xstr is an independent tool. It is not affiliated with, endorsed by, or sponsored by X Corp or Twitter. "X" refers to the third-party service you choose to connect.