Privacy Policy — X Login Assistant

1. Overview

This Privacy Policy applies to the Chrome extension "X Login Assistant" (the "Extension" or "we").

The Extension is provided by Golden Stag (website: https://www.goldenstag.io) to help registered Golden Stag users bind their currently logged-in X (x.com, formerly Twitter) account to their platform account.

Single purpose of the Extension: When you explicitly initiate an action, the Extension reads x.com login-related cookies in your local browser and passes necessary session information to authorized whitelisted platform pages to complete Twitter account binding. The Extension is not used for advertising, tracking, analytics, or any purpose unrelated to the above.

2. Information We Collect

The Extension reads the following data only when you actively trigger a related feature. It does not collect continuously in the background and does not persistently store any user data locally (it does not use local storage APIs such as chrome.storage).

2.1 Cookies read from x.com / twitter.com

2.2 Information derived by the Extension

2.3 Information the Extension explicitly does NOT collect

• The Extension does not read X account passwords, direct messages, tweets, follow lists, or other data unrelated to binding
• The Extension does not receive or read Golden Stag platform login tokens (access-token)
• The Extension does not collect name, email, phone number, precise location, browsing history (other than the cookies listed above on x.com / twitter.com domains), or device identifiers
• The Extension does not include analytics, advertising, or third-party tracking SDKs

3. How Information Is Collected

3.1 Platform-initiated binding flow (primary use)

When a user clicks "Bind with extension" (or equivalent) on the Golden Stag platform's Twitter Accounts page:

1. An authorized platform page sends a GRAB_COOKIES request to the Extension via the Chrome extension messaging API;
2. The Extension uses the chrome.cookies API to read the cookies listed in Section 2 from x.com and twitter.com;
3. The Extension returns { auth_token, ct0 } and the parsed twitter_user_id to the whitelisted page that initiated the request;
4. The platform page submits the above information over HTTPS to Golden Stag backend APIs using the user's existing platform login session to complete binding and validation.

This flow runs only when the platform page actively initiates a request; the Extension does not send data to any server on its own.

3.2 "Test current session" in the Extension popup

Users may click "Test current session" in the Extension icon popup. This feature only displays locally whether a valid x.com session is detected and the parsed user ID; it does not send cookies or user IDs to any external server.

3.3 "Open x.com login" in the Extension popup

This button only opens https://x.com/login in a new tab and does not collect any additional data.

3.4 Connectivity check (PING)

Authorized whitelisted pages may send a PING message; the Extension returns only its version number and no user data.

4. How We Use Information

We collect (read and pass) the above information for the sole purpose of:

• Verifying the validity of the user's x.com login session in the current browser;
• Deriving the numeric Twitter user ID so the platform can check before formal binding whether the account is already bound to another user;
• Helping the user complete binding of their X account to their Golden Stag platform account.

We do not use the above information for:

• Personalized or targeted advertising
• Credit assessment or lending purposes
• Selling, renting, or otherwise providing user data to data brokers
• Any other purpose unrelated to the Extension's core functionality

5. Who We Share Information With

5.1 Recipients of Extension data (whitelist)

Via externally_connectable, the Extension only responds to message requests from the following origins:

• https://www.goldenstag.io/*
• https://test.ai-rbot.com/* (testing environment)
• http://localhost/* and http://127.0.0.1/* (local development)

No website outside the above whitelisted domains can communicate with the Extension or obtain cookie data.

5.2 Platform backend

When the user completes binding, the Golden Stag platform backend (not accessed directly by the Extension) receives auth_token, ct0, and twitter_user_id uploaded by the platform page, for:

• Validating the login session via Twitter-related APIs;
• Storing normalized login cookies (login_cookies) in the platform database to maintain the binding relationship between the X account and the platform account.

Processing of user data by the platform is governed by its own privacy policy and terms of service. See: https://www.goldenstag.io (if a separate privacy policy page exists, that page prevails).

5.3 Third parties

The Extension does not share, sell, or transfer user data to ad networks, analytics companies, or other unrelated third parties.

6. Storage and Retention

7. Permissions

The Chrome permissions requested by the Extension and why they are needed:

The Extension does not request these common permissions: tabs, history, bookmarks, geolocation, notifications, webRequest (intercepting network requests), scripting (injecting scripts into pages), etc.

8. Data Transmission Security

• Messaging between the Extension and platform pages is constrained by the Chrome extension security model; only whitelisted origins can initiate requests
• Platform pages submit cookies to the backend over HTTPS
• The platform backend should apply appropriate encryption and access controls for stored login cookies (specific measures are the responsibility of the platform operator)

9. Your Choices and Rights

• Install to authorize: Installing the Extension means you agree to Chrome granting the permissions above; you may disable or uninstall the Extension anytime in chrome://extensions; after uninstallation, the Extension can no longer read any cookies
• Active trigger only: Cookie reads occur only when you click platform "one-click bind" or "test read" in the Extension; no silent background collection
• Unbind: If you do not want the platform to continue storing your X login cookies, unbind your Twitter account or delete the related account on the Golden Stag platform
• X session control: You may log out of x.com or clear browser cookies to invalidate the current session

10. Children's Privacy

The Extension and associated platform are not directed at children under 13 (or the higher age required in your jurisdiction). We do not knowingly collect personal information from children.

11. International Users

The Extension may be installed by users in different countries/regions. Processing of received data on Golden Stag platform servers may involve cross-border transfer. By using the Extension, you understand and agree to such transfer and processing.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions will be posted on this page with a revised "Last Updated" date. If changes expand the scope of data collection or use, we will provide appropriate notice in the Extension or on the platform. Continued use of the Extension after material changes constitutes acceptance of the updated policy.

13. Chrome Web Store Limited Use

Processing of user data obtained via Chrome Extension APIs adheres to the Chrome Web Store User Data Policy, including Limited Use requirements:

• Collection, use, and sharing of data are strictly limited to the Extension's single purpose: helping users bind their X account on the Golden Stag platform;
• User data will not be used for purposes unrelated to the Extension's core functionality;
• User data will not be sold to unrelated third parties;
• User data will not be used for personalized advertising or credit assessment.