Privacy

XTop does not collect anything. There is no server, no account and no analytics. This page says so in the detail the Chrome Web Store asks for, and names the one case where something does leave your computer, because you asked it to.

The browser extension

XTop Browser Access is the browser half of the desktop app. On its own it does nothing at all.

It collects no data. It has nowhere to send any: there is no backend, no endpoint and no key in it.

Sites are approved one at a time. It asks for no site access when you install it. You open it on a tab, press Allow this site, and Chrome's own permission prompt decides. It then has access to that site and nothing else. The popup lists everything you approved and takes any of it back with one click.

What it reads, when you ask: on an approved site, the page's visible text, its interactive elements, a screenshot of the visible tab, the messages the page printed to the console, and the method, URL, status and timing of the fetch and XMLHttpRequest calls the page made. Not request bodies, not response bodies, not cookies, not your history, not anything on a site you did not approve.

Where it goes: over a native-messaging channel — an operating-system pipe, not a network connection — to XTop running on the same computer. No network port is opened, and no other program or web page can reach that channel: Chrome authenticates it by extension id.

What it can change: nothing, until you say so. Reading an approved page is free. The first time X wants to click, type or navigate on a site, XTop asks you again on the desktop, naming the site and the action, and remembers that answer per site until you remove it in Settings → Browser access.

There is no tool that runs JavaScript of its own in your pages.

The desktop app

Your projects, chats, notes, meetings and recordings are files in XTop's own folder on your disk. See where data lives.

XTop asks for no API key and talks to no AI service of its own.

The one thing that leaves your computer

When you ask X a question, XTop runs the AI command-line tool you installed and signed into — Claude Code, Codex, Gemini CLI or OpenCode — and gives it your question along with the files and page content it needs to answer. That tool then sends it to its own provider under your own subscription, exactly as it would if you had typed the same question into your terminal yourself.

Which tool runs is your choice, shown at the top of the chat. Nothing is sent when you are not asking a question.

Three other features reach the network, each only when used, and none of them through us:

• Prayer times — the Aladhan API, with the city you set.
• Meeting summaries — only if you configure a provider and its key yourself; transcription runs locally by default.
• Update checks — one request to GitHub's public releases API at startup, to compare version numbers.

Questions

Open an issue at https://github.com/kareem-elgamal/XTop.