Privacy Policy

This policy covers the Tweet Media Archive browser extension, its optional command-line license connection, the account and support services used by the extension, and this website.

The extension can save user-selected images, videos, and audio from supported X/Twitter, Instagram, Threads, TikTok, Reddit, LinkedIn, Facebook, and 4chan links, direct media URLs, and media detected on other webpages. It also supports profile archives and supported bookmark or saved collections. The website resolves supported public media links. This does not provide general document or archive-file downloading.

For connection instructions, see the Google Drive setup guide, Dropbox setup guide, or Instagram and Google Drive guide.

Depending on the website or extension features you use, Tweet Media Archive may process:

• Save requests: pasted, right-clicked, selected, page, frame, post, profile, bookmark, collection, and media URLs; available media choices; filenames; file types; sizes; and destination paths.
• Local media candidates: media and manifest URLs, media labels or nearby page text, document title, dimensions, duration, content type, content length, and limited media-related response text or configuration needed to identify streams.
• Settings and activity: Browser or Cloud method, selected provider, folder and filename options, supported-site toggles, upload count, active transfer state, transfer checkpoints, errors, history, archive index, collection discovery progress, and license-pairing state.
• Connected-account information: optional Dropbox, Google Drive, X/Twitter, Instagram, or Threads authorization data, account identifiers, local social-account labels, and timestamps needed for the connection you request.
• Optional website account: your Convex Auth user identifier, email address, available profile name, login session, Dropbox or Google Drive connection state, paid-entitlement state, and daily free-download reservations and balances for signed-in website accounts.
• Website folder choices: folder paths you add or select for cloud uploads and, for Google Drive, identifiers for folders the website created so it can reuse them without listing your Drive.
• ExtensionPay link: if you link an existing extension purchase, the encrypted ExtensionPay account-link key, payment-account email returned by ExtensionPay, paid status, and last verification time.
• Website cloud-save history: for logged-in users, the provider, filename, media type, content type, size, destination path, and save time. This history does not store the source post URL, provider token, or media bytes.
• Extension Cloud jobs: a separate extension account reference, original source URL, selected media descriptions, filenames, destination, request and job identifiers, progress, errors, and provider receipts used to continue and reconcile requested saves. Encrypted source payloads and provider credentials have shorter retention than settled job metadata, as explained below.
• Paid-access information: payment or subscription state, account email, and license-session records provided through ExtensionPay and related payment services.
• Support information: information you choose to include in an optional bug report.
• Hosting and security metadata: routine request information processed by hosting providers to deliver and protect the service, such as timestamp, IP address, user agent, requested path and query parameters, request or trace identifiers, region, response status, duration, and error details. Device-download request URLs contain only a short-lived opaque random capability identifier, not the resolved media URL, filename, or referrer.

To make the right-click picker and generic media saving work, content scripts can run on HTTP and HTTPS pages. In the browser, the extension observes media elements, resource timing, media-related response headers, and bounded portions of media manifests or configuration returned through page network requests. It uses those signals to assemble possible media choices.

This detection is local to your browser. Candidate records are size- and count-limited, kept in temporary browser session storage for no more than 15 minutes, and pruned when they expire, when a tab closes, or when navigation makes them stale. Passive detection does not automatically download or re-fetch every observed stream.

When you explicitly save media in the browser, the extension may request the selected URL and its media components. For a same-site request, it may temporarily apply the current site's cookies, referrer, or origin headers so the requested file can be reached. Temporary request rules are removed after the save attempt. General page contents and candidate records are not sent to us as browsing analytics or telemetry. Extension Cloud uploads do not forward those cookies or page-supplied headers.

Optional website support requests

When you choose “Request support for this link,” we save the public page URL in a private support inbox in Convex for up to 30 days. We remove credentials, fragments, and query parameters other than short video or page identifiers. No account or email is required, and the request record has no account identifier or IP address. Separate spam controls use a keyed network identifier that changes daily; those records are removed after two days. Submitting a request does not use a download attempt or guarantee that support will be added.

Extension Browser saves

With the extension's Browser method, the selected image, video, audio, or media playlist is resolved and downloaded in your browser. Separate audio and video tracks may be combined with the extension's local media engine before saving. HLS previews in the media picker use a bundled copy of hls.js and run in the browser. Media is then saved to Dropbox, Google Drive, or your browser's local Downloads system. The source website or media host receives the requests needed to resolve and download your selection.

Extension Cloud uploads

Paid users can choose Cloud for remote Dropbox or Google Drive saves from the popup, right-click picker, page selection, supported Save buttons, profiles, and saved collections. The extension sends the selected media URLs and metadata, original source URL, filenames, chosen folder, and any selected separate audio to Convex. Cloudflare receives the selected media details needed to retrieve, process, and upload those files to your chosen provider. It receives no social-session cookies, page-supplied headers, or media bytes from the page. Only media it can retrieve without those browser credentials can use this method. Local destinations and pasted file bytes use Browser; unsupported live, encrypted, or custom-transformed media also require Browser.

Cloud uses the storage account already connected inside the extension and does not require a website login. Your installation's ExtensionPay credential is sent to Convex to verify paid access. Convex stores that credential and the provider authority needed for requested transfers encrypted. Each accepted job keeps its own encrypted provider-connection snapshot, so changing accounts or the Browser/Cloud preference does not redirect work already accepted. Dropbox refresh grants and Google broker sessions remain in Convex; the assigned Cloudflare uploader receives the access token needed for the upload.

Accepted Cloud transfers continue after the popup or browser closes. Profile and collection discovery, optional local copies, and reconciliation into local history still need the browser. You can cancel an active transfer, but Cloud transfers cannot be paused; a file already committed by the provider can still be recorded as saved. Disconnecting storage requests cancellation and deletion of the stored Cloud connection. If offline, that server request may not arrive; revoking the app in the provider's settings also stops its access. Saved files remain in your storage.

Private extension Cloud recovery records include the original source URL, filenames, destination, status, and provider receipts. Managed job metadata is kept until at least 30 days after job creation; active work is protected from cleanup for as long as it remains active. Encrypted media payloads, upload checkpoints, and each job's provider credentials are cleared when the job settles. Temporary lookup selections, when used, expire after approximately 15 minutes. These periods do not erase local download history or files in your provider.

Website Local processing

The public downloader uses Cloudflare Turnstile to help prevent automated abuse. When you submit a download, the widget processes browser and network signals under Cloudflare's Privacy Policy. Our server validates its single-use token with Cloudflare before finding media. That validation request contains the token and client IP address, not the pasted post URL, filename, or storage credentials.

Other-website public downloads: Public single-video downloads have no lifetime count cap. Request-rate, concurrency, source and transfer-byte limits still apply. We derive a keyed digest from the trusted client IP address; IPv4-mapped addresses share the same identity, and IPv6 addresses are grouped by their /64 network prefix. Convex retains this digest and admitted lookup count for historical accounting while this public workflow is offered, including failed or cancelled lookups. This record contains no raw IP address, account ID, pasted URL, filename, or media. Expiring encrypted download capabilities remain bound to the originating network. Public access does not grant signed-in paid downloads or provider saves.

The website's Local label refers to its standard processing path and browser ZIP creation; website resolution and individual download streaming still use hosted services.

When you use the homepage URL downloader, the public post URL is sent to the website's Cloudflare-hosted resolver. Server-to-server requests for supported X, Instagram, Threads, TikTok, Reddit, LinkedIn, Facebook, and 4chan links may pass through narrow Cloudflare Workers to resolve the canonical post and public media metadata. Those metadata Workers do not receive your social-media login, browser cookies, or provider access tokens. Completed resolver results are not cached in the website resolver or the metadata Worker's process or Cloudflare edge cache. Identical Instagram requests that overlap in time may share only the same in-progress upstream work, which is discarded when it finishes. In Local processing mode, these metadata Workers do not proxy media files. For a device download, the selected media passes through a short-lived, no-store streaming endpoint to your browser. The browser-visible link contains an opaque random capability identifier. Convex temporarily stores a one-way hash of that identifier, use and byte counters, and an encrypted mapping containing the resolved media URL, filename, referrer, media type, preview choice, and expiry. Capabilities have limited uses and concurrency, expire after about 15 minutes, and are removed by scheduled cleanup. Do not share a live result or download link.

In Local processing mode, multi-file ZIPs are assembled in your browser. Homepage results exist only in your current page and are not added to a shared or cross-user download history. The application does not retain the pasted post URL, result list, ZIP, or streamed media as account history; only the temporary encrypted capability mapping described above is stored to deliver the requested preview or download. Routine Convex or Cloudflare operational logs may separately contain request metadata or opaque request identifiers for the provider's configured retention period; those logs are used for delivery, security, abuse prevention, and troubleshooting rather than to build download histories or advertising profiles.

Website Cloud processing and background saves

When you are logged in and choose Cloud processing in My Cloud Downloads, the website sends your requested public URL to a Cloudflare Container. It finds and streams public media, temporarily prepares separate video and audio tracks when needed, and builds selected ZIPs. Container working files are removed when the transfer ends. Cloud device downloads also use the temporary storage described below. Operational logging for these services is described below. For a Cloud device download, the website checks your account and serves the download through a download link on tweetmediaarchive.com valid for up to 30 minutes, subject to early deletion and, for temporary files, the five-hour expiry. The link allows browser retries and range requests for that same file. Its session temporarily stores an opaque reference to your temporary file until expiry cleanup, without your name, email, account token, or storage credentials. Link expiry does not stop a transfer already running. Cloudflare processes the requested URL, media bytes, and routine network metadata under its platform policies. Social-media login cookies are not sent to these services. Website account tokens are sent to the website API and Convex for authentication, and are not forwarded to the separate extraction and upload service. The website verifies your account and linked paid purchase with Convex and uses a Secure, HttpOnly session cookie lasting up to 15 minutes for Cloud previews and device-download authorization. Cloud capability mappings contain your account ID, so those links require the same signed-in account. Logging out clears the cookie. Paid Cloud transfers have no application file-size or total transfer-time ceiling; source availability and available processing resources still apply.

Permanent Local library: When you choose Local for a Cloud-prepared download or explicitly upload files through the website library, each file is stored in a private Cloudflare R2 bucket and kept until you delete it. Every signed-in user can access their own library through account-authorized, short-lived links, with playback and previews for supported media. We retain an opaque account reference, random file identifier, filename, media type, size, creation time, preparation state, and any folder names and file organization you create. Renaming changes the stored filename. Completed files do not retain their source ticket. Files are not automatically shared between accounts or served from a public bucket, and ordinary files fetched directly by your browser or extension are not automatically uploaded to this library. Uploading requires you to select or drop files into the website library. Delete revokes new access immediately and queues removal of the object and metadata, with retries if storage is unavailable; a download already in progress may finish. Unfinished preparations and uploads expire after five hours, and abandoned multipart uploads are cleaned up. Compatible MP4 previews may play from private, committed file chunks while preparation continues; the file is marked saved only after all bytes arrive. Failed or deleted preparations revoke further access and queue partial chunks for cleanup. Preview links are kept temporarily in page memory, separated by account, and are cleared when the library closes or the account changes. Accepted preparation can continue after the page closes. Deleting a library item does not remove copies already saved to your device, Dropbox, or Google Drive. Connector-key temporary downloads use the separate expiry described below.

Private library links: Files in your TMA library require the owning account or an explicitly connected account. Copying a file link does not give another account access. Library link sharing is not available. Deleting a file blocks new access through its links, but cannot recall copies already downloaded; an active download may finish.

Storage encryption and operator access: Cloudflare R2 encrypts stored files and thumbnails at rest, and connections use HTTPS. This is operator-managed storage, not end-to-end encryption. Our Cloud services process readable media to provide downloads and previews. Infrastructure administrators with sufficient privileges can technically access stored content and metadata. Account authorization prevents other ordinary users from accessing your library; it does not make content inaccessible to the service operator.

If you log in on the cloud dashboard and choose Dropbox or Google Drive, the selected media is sent to that connected account and folder. Local processing uses the website uploader; Cloud processing uploads directly from Cloudflare to your storage provider. Convex remembers your folder paths and app-created Google Drive folder IDs. Your private cross-device cloud-save history contains the provider, filename, type, size, destination path, and save time. It does not store the source post URL or media bytes and is not visible to other signed-in users. Temporary media is removed after the transfer ends. Private and sign-in-only posts still require the extension.

When a paid user starts a Cloud save to Dropbox or Google Drive, Convex keeps an encrypted temporary media description and upload checkpoints so the save can continue after the page closes or the uploader restarts. Checkpoints contain the provider upload-session reference, confirmed byte position, and integrity data. The private job record contains the filename, provider, folder, status, progress, cancellation state, and timestamps. Cloudflare stores an opaque job assignment and receives a storage access token in memory for the upload; long-lived refresh tokens remain encrypted in Convex. Provider tokens are not included in the job payload or public status response. Closing the page or signing out does not cancel an accepted save; you can cancel it from Background saves. Accepted saves have no total waiting or execution time cutoff. Active records are kept until the job finishes or is canceled, then encrypted media descriptions and checkpoints are removed. Finished job status and filenames are eligible for cleanup after about 24 hours; completed saves also use the existing private history. Paid access and the storage connection are checked before a job starts. Dropbox metadata permission allows the uploader to verify completed files after an interruption.

Optional TinyFish remote browser

If you are signed in and a normal Cloud download fails, the library or Background saves may show Continue with TinyFish. It is a backup download that uses credits: a successful save uses 100 credits and failed attempts are free. A lifetime purchase includes 3,158 credits once and a monthly subscription includes 2,105 credits each month (unused monthly credits do not carry over). Free accounts get 3 backup saves in total; this allowance does not reset. Extra credits can be bought through Stripe. It is offered only for websites other than X, Instagram, Threads, TikTok, Reddit, LinkedIn, Facebook and 4chan, and not to signed-out visitors. The browser extension can offer it for Cloud downloads when we enable it. Authenticated paid connector saves can also offer it after approval for that exact file or save. Nothing is sent to TinyFish until you click that button for a specific save. Until you decide, the save keeps its encrypted media description so it can continue: unfinished library saves expire after five hours, and Dropbox or Google Drive saves after about 24 hours. We check your plan or remaining free saves again when you click. If the video could only be found for TinyFish, a free account's device download is first placed in your private TMA library, where it counts toward your library storage, so the button can appear there.

For free accounts, each approved TinyFish save is recorded against the same opaque digest of your verified Google account identifier used for free downloads, with the save's file or job reference and the time. These records are kept so that clearing browser data or recreating the same login does not restore the allowance. Credits and free uses are held when you approve a backup download and returned automatically if it does not save the file. We keep a record of each hold (the account, file or job reference, amounts and outcome) and of purchased credits. If several TinyFish saves are running at once, a new save waits up to 30 minutes for a free TinyFish session; that waiting time is not part of the 90-minute attempt limit.

When you continue, our Cloud service opens a new, anonymous browser session with TinyFish, a remote-browser provider. That browser loads the public page you requested, starts its video player, and fetches the page, player, and media files through TinyFish's network, using a TinyFish proxy location in the United States or United Kingdom. If the browser cannot identify the main video, we may send the same public page URL and a fixed player-discovery task to TinyFish’s AI Web Agent. That step can inspect the public page and its player without your account credentials or storage access. TMA checks any suggested player before using it. If AI discovery is declined or fails, the website shows a short failure reason. TinyFish therefore receives the public page URL, the requests that page and its player make, and the media bytes passing through its browser, along with routine network metadata. We do not send TinyFish your name, email address, account identifier, TMA account tokens, storage-provider credentials, or social-media login cookies. TinyFish does not get access to your library, Dropbox, or Google Drive; our Cloud service checks the received file and saves it to your chosen destination as usual. Each attempt is limited to 90 minutes, the session is closed when the save finishes, fails, or is canceled, and an inactive session expires after about two minutes. Your library and Background saves show when TinyFish was used and, if it failed, a short fixed reason such as "the video never started playing". TinyFish processes this information under its privacy policy. If you choose “Continue with TinyFish + Firecrawl”, a failed player-discovery or download attempt may also use a new Firecrawl remote browser. Firecrawl receives the same public page address, player requests and media bytes, without your account tokens, library access, provider credentials or social login cookies. The same selected-video checks apply. Firecrawl sessions have a one-hour maximum lifetime and expire after two minutes of inactivity; we close the session on completion, failure or cancellation. Missing videos, DRM, selected-video mismatches and provider policy refusals do not trigger another provider. Older TinyFish-only approvals do not authorize Firecrawl. Firecrawl processes data under its privacy policy.

The signed-in dashboard also keeps private progress records for Local device downloads and Local uploads: filename, transfer type, byte counts, status, timestamps, and hashes binding an opaque monitor to that transfer. These records do not contain media bytes, source URLs, or provider credentials and are scheduled for deletion after 24 hours. Local device progress measures bytes sent to the browser; the browser manages the final saved file. Cloud device transfers go directly from Cloudflare to your browser, which manages their download progress.

Routine Cloud diagnostics and usage counts

To debug reliability, our website API and Cloud extraction and transfer containers emit filtered operational events: a fixed operation category, processing stage, outcome, HTTP status, elapsed time, sanitized failure code, and a freshly generated operation reference. A filter discards raw process output and error text before forwarding these events to Cloudflare. These events do not include customer account identifiers, emails, IP addresses supplied by our application, URLs, filenames, media content, request bodies, cookies, or credentials. Cloudflare also attaches platform metadata, such as timestamps, container or service identifiers, and location codes (data center, country, and region). Successful events are sampled and event volume is capped. Cloudflare retains these diagnostic logs for up to seven days on our paid plan.

Worker operational logs: Routine Worker logs and traces are disabled on the website, download-link, and media-processing services because request paths can contain download credentials. Filtered container diagnostics remain enabled as described above. Supporting metadata-resolver Workers may retain operational logs containing request methods, paths, status, timing, service identifiers, network or location metadata, and console or exception messages. Their recorded request URLs have query strings removed; this does not sanitize paths or arbitrary error text. Previously collected Worker logs and supporting resolver logs are private to authorized administrators and Cloudflare and expire under Cloudflare's retention policy, up to seven days on our paid plan. Disabling application logs does not prevent Cloudflare from processing network information to deliver and protect the service. These records are separate from optional browser analytics and are not used to build advertising profiles.

We keep private daily Cloud usage counters in Convex only for the service owner’s account to diagnose and test Cloud features. Other accounts do not contribute to these counters. They count media lookup requests, uploads accepted, confirmed provider saves, and accepted device-download preparations separately for the website and extension. A device preparation is not confirmation that a file was saved in your browser. The owner’s account is represented by a keyed, pseudonymous identifier that changes every UTC day and differs between products. These usage records contain counters and the date, without names, emails, source links, filenames, media, provider credentials, or a stored account identifier. They are pseudonymous, not anonymous: an authorized operator with access to both the secret key and account data could reproduce an identifier. Records expire within seven days and are removed by scheduled cleanup; expired records are excluded from reports. Only authorized service administrators can read these reports. This measures Cloud feature use, not general browsing activity.

Optional diagnostics and sharing

Account-specific Cloud troubleshooting diagnostics are enabled only for the service owner’s account. These records contain a random operation or job reference, processing stage, source-platform category, destination provider, timing, byte counts, software version, and sanitized error codes. Failed operations from that account may also retain a sanitized original public page URL for troubleshooting; successful and active diagnostic records omit it. These records do not contain media, filenames, cookies, or access tokens, and are not collected for other accounts. Only authorized service administrators can read them. Diagnostics are eligible for scheduled deletion after seven days and can be disabled on request.

If you use the share action in history or gallery, the selected saved file or link is passed to your browser or operating-system share sheet and then only to the app or device you select.

For new website saves, Activity can keep a small image or a silent video preview of up to four seconds. The browser keeps a per-account cache limited to 100 previews and 40 MiB. An account-authorized copy is also stored in a private Cloudflare R2 bucket so the preview can appear on another signed-in device; it is not read back from Dropbox or Google Drive. Browser and server copies expire after seven days, and the server schedules deletion even if the account does not return. Logging out removes the browser copy. Clearing Activity history revokes server access immediately and queues its stored preview bytes for deletion. Storage outages can delay physical deletion without restoring access. These previews do not change your saved files.

The extension uses Chrome local, sync, and session storage and IndexedDB for different purposes:

• Settings: provider, folder, naming, supported-site, and other preferences. Settings in Chrome sync storage may be synchronized by Chrome across profiles signed into the same Google account.
• History and archive memory: source and input URLs, filenames, provider, remote link or path, optional local path, file size, save time, transfer checkpoints, and source labels used to show history or avoid duplicate profile, bookmark, and collection saves. Remembered posts and collection progress are scoped to the social account you selected.
• Active work: pending jobs, progress, transfer journals, discovered collection entries, pagination cursors, per-post save results, picker requests, and short-lived media candidates needed to recover or complete a requested operation. Collection discovery and transfer checkpoints support continuing interrupted work.
• Secrets: supported authorization values and optional social-session cookies are encrypted using AES-GCM before browser storage. The non-exportable encryption key is kept in IndexedDB.

History, settings, and archive memory are kept locally until cleared or removed, subject to the extension's storage limits. Removing a social account deletes its encrypted session but does not delete its download history or account-scoped archive entries. Temporary media candidates expire within 15 minutes. Some browser-managed sync copies may remain subject to Chrome's own retention behavior.

If you log in on the website, Convex Auth stores necessary access and refresh session tokens in your browser's local storage so the dashboard can remain signed in and synchronize the same account across devices. These values are for account access, not advertising or analytics. Logging out removes them from that browser. Short-lived, one-use provider connection and upload records are stored by Convex to complete the action you requested.

The signed-in dashboard remembers only your Local or Cloud processing choice in a separate browser local-storage setting. It does not store a pasted URL or result list with that preference.

Website folder choices and app-created folder IDs remain with the connected provider record so the same choices work across devices without browsing cloud contents. Disconnecting that provider deletes its stored grant, folder choices, and folder-ID mappings from Convex. Cloud files and folders already created in Dropbox or Google Drive are not deleted. Homepage device-download capabilities expire after about 15 minutes. Stored-file links last up to 30 minutes and personal library files also require account authorization. An expired opaque identifier may remain in your browser history or previously collected hosting logs, but it no longer authorizes a new transfer and does not reveal the source URL or filename.

The website keeps up to the latest 200 private cloud-save history records. Clearing history hides completed items and removes finished Local progress records. Saved-file receipts remain within that 200-record limit; older receipts are removed as new saves are recorded. Cloud job records follow the cleanup periods above. Keeping these records helps reconcile late acknowledgements and retries. Clearing history does not cancel active jobs or delete provider files. Completed upload tickets are eligible for cleanup after about 24 hours; unfinished tickets generally after seven days, with active background work protected until it settles. Scheduled cleanup may run after an eligibility time.

Website login and Convex Auth

Website login is provided by Convex Auth using Google OAuth with basic profile and verified-email access. Google Drive storage permission is requested separately only if you connect Google Drive. A verified Google email is used to attach the login to the matching existing website account so its entitlement, provider connections, and private history remain available. If you connect Dropbox or Google Drive from the website, the authorization grant is associated with your Convex user and encrypted with AES-GCM in Convex. Provider tokens are not returned to webpage JavaScript or another user. For each requested upload, a short-lived one-use ticket binds the media, account, provider, and folder; the website server exchanges that ticket for the selected account's usable provider token and streams the file. Disconnecting deletes the website's stored grant. You may also revoke the app from the provider's own account settings.

Signed-in website accounts receive 30 free cloud output-file downloads per UTC calendar day, resetting at 00:00 UTC. We retain an opaque digest of the verified Google account identifier, the allowance, and compact download outcome records to prevent clearing browser data or recreating the same login from restarting the daily allowance. One file uses one download, including each file inside a ZIP; a merged video with audio uses one. Device delivery is counted when our server finishes sending the full response, which cannot confirm that your browser saved it to disk. Confirmed failed transfers release their reservation. An uncertain outcome holds a reservation until a receipt or support review resolves it. Released failure records age out after one day; daily balances and successful or unresolved records remain to preserve accounting and retries across day boundaries. Reservations belong to the day they begin; accepted retries do not consume another daily unit. Paid access and valid active ExtensionPay trials keep their existing unlimited access. The public homepage downloader and extension allowances have separate policies.

ExtensionPay entitlement

Signed-in website Cloud downloads and provider saves require an available free download, linked paid access, or a valid active ExtensionPay trial. Public homepage downloads have no lifetime count cap and retain network-based abuse controls; they do not grant account or provider-save access. To link a purchase, you can open Tweet Media Archive's ExtensionPay plan page and use Already paid? Log in with an existing extension purchase. Convex stores the resulting ExtensionPay account-link key encrypted and periodically asks ExtensionPay whether that account is still paid. The key is not used for Dropbox, Google Drive, or analytics. Unlinking removes it from the website account and does not cancel the underlying subscription.

Dropbox

Dropbox shows its own authorization page. The extension encrypts its Dropbox credentials in local browser storage, and the website keeps its separate encrypted grant in Convex. The website requests files.content.write and files.metadata.read to upload selected files, create destination folders, and verify completed uploads after interruptions. Extension Cloud admission may make a limited root-folder metadata request to confirm this permission; returned names are discarded. Connection checks may also use a provider account identifier. These permissions are used for your connection and requested saves, not to build an inventory of unrelated Dropbox content. The extension also lets you provide your own Dropbox app key.

Google Drive

The website uses Google's drive.file scope. It uploads to your Drive root or creates nested folder paths you type, remembers app-created folder IDs, and may check metadata for its folders or uploaded files to reuse a destination or verify a save. It does not browse unrelated Drive content. Extension Cloud connection checks may read your Drive account identifier. The extension's default Google connection separately uses a Convex-hosted OAuth broker. That broker receives the authorization code, keeps the long-lived Google refresh token server-side, and gives the extension a broker session and short-lived Drive access tokens. Broker sessions expire after 30 days of inactivity or 180 days in total. Disconnecting asks the relevant connection service to delete the connection.

If you provide a custom Google OAuth client, the extension bypasses the included broker and stores the returned authorization values encrypted in your browser profile.

Optional social sessions

You may save multiple X/Twitter, Instagram, or Threads sessions, with one active account per platform, for media that account can already view. Login happens on the social website; the extension does not ask for or store your password. Save current account captures allowlisted session cookies, a local label, an account identifier when available, and timestamps. Session values are encrypted locally and used only for supported browser media and collection requests. Firefox containers and cookie stores stay separate. Changing the active account changes future discovery and saves; removing a session does not clear its history or remembered archive entries. These social cookies are not sent to Convex or Cloudflare for Cloud uploads.

ExtensionPay provides paid-plan and restore-purchase status to the extension. Stripe processes checkout and payment details. Tweet Media Archive does not receive or store complete card details.

Payment support records may include a Stripe event, customer or subscription identifier, recipient email, delivery status, and a Resend message identifier or delivery error so purchase-related messages can be sent and troubleshot. ExtensionPay may provide email, paid status, plan, and subscription state used to apply free-use limits and paid access.

If you pair the companion command-line tool, the Convex-hosted license broker processes a short pairing code or token and stores a hashed session token, payment-account email, encrypted ExtensionPay API key, timestamps, revocation state, and hashed rate-limit data. Pairing records are short-lived. An active CLI session remains until it is disconnected, revoked, or no longer valid.

Bug reports are sent only when you choose to submit one. A report can include a report ID, a random anonymous installation token, extension version, and the summary, details, reproduction steps, and expected result you enter.

Transfer logs may be offered as editable report text. The extension sanitizes known secrets and sensitive URL parameters before submission, and you can review or remove the text first. Reports are sent to the Convex-hosted support endpoint. The anonymous token is hashed for rate limiting. Reports are eligible for scheduled deletion after 30 days, and associated rate-limit records after two days. You can also request deletion.

We use PostHog for optional website analytics only after you select Allow analytics. Until you allow it, or if you reject it, the website sends no analytics events to PostHog. You can change your choice or withdraw permission at any time using Analytics settings on this page. We honor browser Do Not Track and Global Privacy Control signals by keeping this collection off. Downloads and account access do not depend on consent.

Consented events describe page visits, extension-install link clicks, media lookup starts and outcomes, download-button actions, and checkout opening or failure. They include a general page category, event time, random browser and session identifiers, and, where available, a bounded media count or duration. A download-button action does not establish that a file finished saving. We do not send submitted media URLs, arbitrary URL paths, query strings, fragments, referrers, page titles, filenames, form contents, error messages, names, email addresses, account identifiers, access tokens, provider credentials, or extension history. We do not enable session recordings, automatic click capture, or person profiles. The website does not load Vercel Web Analytics or automatically injected Cloudflare browser analytics scripts.

Cloudflare Web Analytics page counts

On the homepage, guides and policy pages, we use Cloudflare Web Analytics to count page views and visits. It sets no cookies, uses no local storage, and does not create a visitor identifier or fingerprint. When a page loads, Cloudflare receives the page address, the referring page, your browser and device type, approximate country derived from your network address, and page-load timings, which we see only as aggregate totals. These pages contain no submitted media URLs. The script is not loaded on the signed-in dashboard, on preview or local copies of the site, or when your browser sends a Do Not Track or Global Privacy Control signal. See Cloudflare Web Analytics and Cloudflare’s privacy policy.

Our own local storage remembers your analytics choice for up to 180 days and, after consent, a random browser identifier for up to 30 days. A random session identifier in session storage expires after 30 minutes of inactivity. Expiry is checked when the website is used. Rejecting or withdrawing removes those analytics identifiers and stops further collection; it does not erase previously received events. No analytics cookies are set by this integration. We do not reuse consent from the retired analytics system.

Events are sent directly to our PostHog Cloud EU project. PostHog necessarily receives network information, including your IP address, to deliver the request; we disable event IP capture and geolocation enrichment. Access to the project is limited to authorized administrators and PostHog under its service terms. PostHog currently guarantees one year of event retention on its free plan and may retain data longer under its service and deletion policies; browser identifier expiry is not server-side deletion. You can contact us about access or deletion requests. See PostHog’s privacy policy.

Service request counts and essential storage

When a website media lookup is requested, we count its route, HTTP outcome, and time to response in hourly aggregates retained for up to 90 days. These counts do not use visitor or account identifiers, do not retain submitted URLs, and do not prove a download completed. Necessary authentication, Cloudflare security checks, download authorization, and settings such as your chosen language and appearance continue to use cookies or browser storage where needed.

Previously collected usage analytics

Before October 8, 2026, visitors could allow fixed usage events with random browser and session identifiers stored as keyed pseudonyms on the server. The current website removes the former analytics choice, browser visitor identifier, and session identifier from browser storage when its updated module loads. Cached older clients cannot add new events through the retired endpoint. Existing records have not been deleted by this change: active event records remain subject to their existing retention of up to 30 days, and Cloudflare recovery snapshots may retain older data for up to a further 30 days. Recovery must reapply expiry before reports become available.

Access and aggregate reports

Cloudflare stores historical analytics and service counts privately. Only the service owner's verified Google account can read them through the application; platform administrators may have infrastructure access. There is no public analytics dashboard or advertising-network connection. Cloudflare and Convex still process network metadata needed to deliver and protect the service under their platform policies. The separate operational diagnostics described above keep their own scope and retention.

Aggregate business benchmarks and daily/weekly growth reports combine historical consented usage totals, service counters, Search Console, payments and outreach activity. They contain no browser/session identifiers, customer identities or submitted media URLs. Reports are retained for up to two years; the original aggregate benchmark is kept for comparison. The extension does not send local media-candidate data or saved history to this website analytics store.

We do not sell extension data or use it for advertising. Previous optional homepage advertising is described above; it is currently paused. Information reaches another service for the feature you choose:

• PostHog receives the limited website analytics described above only with your consent, in our EU project.
• Cloudflare Web Analytics receives cookieless page-load information on public pages, as described above, unless your browser sends Do Not Track or Global Privacy Control.
• ExoClick and its advertising partners previously received advertising network and device information when visitors allowed the homepage banner, as explained in Homepage advertising is paused. The website no longer loads that banner. We did not pass them pasted media URLs, download results or account information.
• Source websites and media hosts receive requests for the specific page or file being resolved or saved.
• TinyFish receives the public page URL, the page and media requests, and the media bytes for a save, only when a signed-in user clicks Continue with TinyFish after a normal Cloud download fails, as described above. It does not receive your account details or storage credentials.
• Stripe processes credit-pack payments. We receive the checkout session, the pack, amount, currency and payment status, and record the credits added to your account; we do not receive your card details.
• Firecrawl receives the source address and media for its approved fallback attempts, as described above. Apify, used until October 30, 2026, no longer receives requests.
• Google receives the standard OAuth request needed for website sign-in. Google Drive separately receives authorization data, folders, filenames, and files only if you connect it as a destination.
• Dropbox receives authorization data, folders, filenames, and files only if you connect it as a destination.
• Convex provides optional website login, encrypted storage connections, private cross-device cloud-save history, website and extension Cloud job coordination and recovery records, short-lived encrypted device-download capability mappings and abuse counters, the extension's Google OAuth broker, the CLI license broker, private daily pseudonymous Cloud usage counts, optional account diagnostics, bug reports and uninstall feedback, and payment-support records described above.
• Resend delivers purchase-related and support email.
• ExtensionPay and Stripe provide purchase, subscription, and payment processing. ExtensionPay also verifies paid access for linked website accounts and extension Cloud uploads.
• Chrome and Google browser services may process sync storage, downloads, extension APIs, and consent flows under your browser and account settings.
• Vercel manages the website domain registration. A previous website deployment may be retained temporarily for service recovery.
• Cloudflare hosts this website, its API, public-post resolvers, streaming download endpoint, and Cloud processing services. The website API processes account tokens and the provider credentials needed for your requested save; separate metadata resolvers do not receive those credentials. Cloudflare processes requested URLs, media bytes, and routine network metadata under its platform policies. Routine Worker logs are disabled for website and media-transfer routes; supporting resolver logs and previously collected records follow the operational retention described above. Containers emit the separate filtered operational diagnostics described above. The narrow metadata Workers do not proxy media files; separate Cloud processing containers prepare and transfer requested media as described above.
• Your share destination receives a file or link only after you choose it in the browser or operating-system share sheet.

• Choose Dropbox, Google Drive, or local Downloads and change that choice at any time. Delete Cloud-prepared files from your Local library when you no longer want them stored.
• Use Analytics settings to reject optional PostHog analytics or withdraw consent. This clears the current analytics identifiers and stops future collection. You can also clear site data through your browser settings; previously received events require a separate deletion request.
• Choose Browser or Cloud in the extension, or Local or Cloud on the website. Changing a preference does not move or cancel jobs already accepted.
• Disconnect Dropbox or Google Drive to delete that website connection and its remembered folder paths and folder-ID mappings from Convex. Files and folders already created in the provider remain until you delete them there.
• Disconnect an extension storage account from extension settings to remove that connection and request cancellation of its Cloud jobs when online. You can also revoke access at the provider.
• Select or remove saved X/Twitter, Instagram, or Threads sessions in extension settings. Clear their local history and archive memory separately if desired.
• Log out of the website to remove its Convex Auth session values from that browser. Disconnect either website cloud provider to delete that encrypted website grant from Convex.
• Unlink ExtensionPay from the website account without cancelling the purchase; billing changes remain available through ExtensionPay.
• Cancel active background saves through their transfer controls. Closing the browser, signing out, or clearing history does not cancel an accepted Cloud upload.
• Clear your website cloud-save history without deleting files from Dropbox or Google Drive. Hidden receipts remain within the 200-record history limit, and Cloud job records follow their separate cleanup periods.
• Use your own Dropbox app key or Google OAuth client if you prefer.
• Turn supported-site features and archive memory on or off.
• Clear upload history and the local archive index.
• Review and edit an optional bug report before sending it.
• Request that optional account diagnostics be disabled or ask for deletion of information held by our services using the contact below.
• Disconnect a paired CLI license to revoke that session.
• Remove the extension to delete extension-local browser data. Browser sync, cloud files, provider records, or support reports may need to be deleted separately from the service that holds them.

Tweet Media Archive's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The extension also follows the Chrome Web Store User Data Policy.

Google user data is used only to provide or improve the requested sign-in, account connection, and Google Drive saving features. It is not used for advertising, sold, or transferred for unrelated purposes.

We may update this policy when extension behavior, providers, browser permissions, or legal requirements change. Material revisions will update the effective date at the top of this page.

Agent connectors: If you create a connector key, we store its hash, name, prefix, owner, expiry, last-use time and rate-limit counter. Keys grant public-media download access under your paid account and use separate temporary-file storage. They do not expose storage-provider credentials or website history. Revocation blocks new API calls and requests through previously issued connector download links. Running downloads check key state every five seconds after the previous check completes and stop on revocation or a failed check; a check times out after 15 seconds. Accepted preparation may finish, but files remain inaccessible through the revoked key and expire after five hours. Revocation cannot recall bytes already delivered. Your agent provider handles downloaded content under its own privacy policy. See connector documentation.

For a privacy question, deletion request, or concern about information you submitted to a Tweet Media Archive service, contact @danialbka on X. Please do not send passwords, authentication codes, access tokens, or account cookies.