Privacy & key safety

Last updated: July 2026

The short version

Xstr stores only what it needs to mirror your posts: your X access tokens and, depending on the signing mode you choose, your Nostr key. Secrets are encrypted with AES-256-GCM before they are stored and are never shown again in the app. There are no analytics, no trackers, and no ads — nothing about you is sent to third-party services.

What is stored

• X account: your username, user ID, and the OAuth access tokens X gives us — encrypted before storage. Your X password never touches Xstr.
• Nostr signer: depends on the mode you pick (see below).
• Sync state: which posts were mirrored, relay results, and settings — so nothing is posted twice.

The three signing modes, honestly

• Browser extension (most private): your key stays inside your extension (Alby, nos2x). Xstr only ever sees your public key, and you approve every post yourself.
• Remote signer / Nostr Connect: your key stays in your signer app (nsec.app, Amber). Xstr stores only an encrypted connection credential and asks your signer to sign each post.
• Private key (easiest): you paste your key once and it is encrypted before storage. To publish in the background, the server briefly decrypts it in memory while signing. If you prefer that the key never reach the server at all, use one of the two modes above — that's exactly what they're for.

What is never collected

• No analytics or tracking scripts, no fingerprinting, no ad pixels.
• No selling or sharing of data with anyone.
• No reading of your DMs — Xstr only reads the public posts on your own profile that you asked it to mirror.

Deleting your data

You are always one click away from a clean slate: Reset everything (the circular-arrows button in the app) disconnects X, deletes your stored signer and tokens, and clears all sync state. Disconnecting X also revokes the app's access token with X.

Independence

Xstr is an independent tool. It is not affiliated with, endorsed by, or sponsored by X Corp or Twitter. "X" refers to the third-party service you choose to connect.