Privacy Policy

This policy covers the Tweet Media Archive browser extension, its optional command-line license connection, the account and support services used by the extension, and this website.

The extension can save user-selected images, videos, and audio from supported X/Twitter, Instagram, Threads, TikTok, Reddit, LinkedIn, Facebook, and 4chan links, direct media URLs, and media detected on other webpages. It also supports profile archives and supported bookmark or saved collections. The website resolves supported public media links. This does not provide general document or archive-file downloading.

For connection instructions, see the Google Drive setup guide, Dropbox setup guide, or Instagram and Google Drive guide.

Depending on the website or extension features you use, Tweet Media Archive may process:

• Save requests: pasted, right-clicked, selected, page, frame, post, profile, bookmark, collection, and media URLs; available media choices; filenames; file types; sizes; and destination paths.
• Local media candidates: media and manifest URLs, media labels or nearby page text, document title, dimensions, duration, content type, content length, and limited media-related response text or configuration needed to identify streams.
• Settings and activity: Browser or Cloud method, selected provider, folder and filename options, supported-site toggles, upload count, active transfer state, transfer checkpoints, errors, history, archive index, collection discovery progress, and license-pairing state.
• Connected-account information: optional Dropbox, Google Drive, X/Twitter, Instagram, or Threads authorization data, account identifiers, local social-account labels, and timestamps needed for the connection you request.
• Optional website account: your Convex Auth user identifier, email address, available profile name, login session, Dropbox or Google Drive connection state, five-link trial usage, and paid-entitlement state.
• Website folder choices: folder paths you add or select for cloud uploads and, for Google Drive, identifiers for folders the website created so it can reuse them without listing your Drive.
• ExtensionPay link: if you link an existing extension purchase, the encrypted ExtensionPay account-link key, payment-account email returned by ExtensionPay, paid status, and last verification time.
• Website cloud-save history: for logged-in users, the provider, filename, media type, content type, size, destination path, and save time. This history does not store the source post URL, provider token, or media bytes.
• Extension Cloud jobs: a separate extension account reference, original source URL, selected media descriptions, filenames, destination, request and job identifiers, progress, errors, and provider receipts used to continue and reconcile requested saves. Encrypted source payloads and provider credentials have shorter retention than settled job metadata, as explained below.
• Paid-access information: payment or subscription state, account email, and license-session records provided through ExtensionPay and related payment services.
• Support information: information you choose to include in an optional bug report.
• Hosting and security metadata: routine request information processed by hosting providers to deliver and protect the service, such as timestamp, IP address, user agent, requested path and query parameters, request or trace identifiers, region, response status, duration, and error details. Device-download request URLs contain only a short-lived opaque random capability identifier, not the resolved media URL, filename, or referrer.

To make the right-click picker and generic media saving work, content scripts can run on HTTP and HTTPS pages. In the browser, the extension observes media elements, resource timing, media-related response headers, and bounded portions of media manifests or configuration returned through page network requests. It uses those signals to assemble possible media choices.

This detection is local to your browser. Candidate records are size- and count-limited, kept in temporary browser session storage for no more than 15 minutes, and pruned when they expire, when a tab closes, or when navigation makes them stale. Passive detection does not automatically download or re-fetch every observed stream.

When you explicitly save media in the browser, the extension may request the selected URL and its media components. For a same-site request, it may temporarily apply the current site's cookies, referrer, or origin headers so the requested file can be reached. Temporary request rules are removed after the save attempt. General page contents and candidate records are not sent to us as browsing analytics or telemetry. Extension Cloud uploads do not forward those cookies or page-supplied headers.

Extension Browser saves

With the extension's Browser method, the selected image, video, audio, or media playlist is resolved and downloaded in your browser. Separate audio and video tracks may be combined with the extension's local media engine before saving. HLS previews in the media picker use a bundled copy of hls.js and run in the browser. Media is then saved to Dropbox, Google Drive, or your browser's local Downloads system. The source website or media host receives the requests needed to resolve and download your selection.

Extension Cloud uploads

Paid users can choose Cloud for remote Dropbox or Google Drive saves from the popup, right-click picker, page selection, supported Save buttons, profiles, and saved collections. The extension sends the selected media URLs and metadata, original source URL, filenames, chosen folder, and any selected separate audio to Convex. Cloudflare receives the selected media details needed to retrieve, process, and upload those files to your chosen provider. It receives no social-session cookies, page-supplied headers, or media bytes from the page. Only media it can retrieve without those browser credentials can use this method. Local destinations and pasted file bytes use Browser; unsupported live, encrypted, or custom-transformed media also require Browser.

Cloud uses the storage account already connected inside the extension and does not require a website login. Your installation's ExtensionPay credential is sent to Convex to verify paid access. Convex stores that credential and the provider authority needed for requested transfers encrypted. Each accepted job keeps its own encrypted provider-connection snapshot, so changing accounts or the Browser/Cloud preference does not redirect work already accepted. Dropbox refresh grants and Google broker sessions remain in Convex; the assigned Cloudflare uploader receives the access token needed for the upload.

Accepted Cloud transfers continue after the popup or browser closes. Profile and collection discovery, optional local copies, and reconciliation into local history still need the browser. You can cancel an active transfer, but Cloud transfers cannot be paused; a file already committed by the provider can still be recorded as saved. Disconnecting storage requests cancellation and deletion of the stored Cloud connection. If offline, that server request may not arrive; revoking the app in the provider's settings also stops its access. Saved files remain in your storage.

Private extension Cloud recovery records include the original source URL, filenames, destination, status, and provider receipts. Managed job metadata is kept until at least 30 days after job creation; active work is protected from cleanup for as long as it remains active. Encrypted media payloads, upload checkpoints, and each job's provider credentials are cleared when the job settles. Temporary lookup selections, when used, expire after approximately 15 minutes. These periods do not erase local download history or files in your provider.

Website Local processing

The public downloader uses Cloudflare Turnstile to help prevent automated abuse. When you submit a download, the widget processes browser and network signals under Cloudflare's Privacy Policy. Our server validates its single-use token with Cloudflare before finding media. That validation request contains the token and client IP address, not the pasted post URL, filename, or storage credentials.

The website's Local label refers to its standard processing path and browser ZIP creation; website resolution and individual download streaming still use hosted services.

When you use the homepage URL downloader, the public post URL is sent to the website's Cloudflare-hosted resolver. Server-to-server requests for supported X, Instagram, Threads, TikTok, Reddit, LinkedIn, Facebook, and 4chan links may pass through narrow Cloudflare Workers to resolve the canonical post and public media metadata. Those metadata Workers do not receive your social-media login, browser cookies, or provider access tokens. Completed resolver results are not cached in the website resolver or the metadata Worker's process or Cloudflare edge cache. Identical Instagram requests that overlap in time may share only the same in-progress upstream work, which is discarded when it finishes. In Local processing mode, these metadata Workers do not proxy media files. For a device download, the selected media passes through a short-lived, no-store streaming endpoint to your browser. The browser-visible link contains an opaque random capability identifier. Convex temporarily stores a one-way hash of that identifier, use and byte counters, and an encrypted mapping containing the resolved media URL, filename, referrer, media type, preview choice, and expiry. Capabilities have limited uses and concurrency, expire after about 15 minutes, and are removed by scheduled cleanup. Do not share a live result or download link.

In Local processing mode, multi-file ZIPs are assembled in your browser. Homepage results exist only in your current page and are not added to a shared or cross-user download history. The application does not retain the pasted post URL, result list, ZIP, or streamed media as account history; only the temporary encrypted capability mapping described above is stored to deliver the requested preview or download. Routine Convex or Cloudflare operational logs may separately contain request metadata or opaque request identifiers for the provider's configured retention period; those logs are used for delivery, security, abuse prevention, and troubleshooting rather than to build download histories or advertising profiles.

Website Cloud processing and background saves

When you are logged in and choose Cloud processing in My Cloud Downloads, the website sends your requested public URL to a Cloudflare Container. It finds and streams public media, temporarily prepares separate video and audio tracks when needed, and builds selected ZIPs. Container working files are removed when the transfer ends. Cloud device downloads also use the temporary storage described below. Application request logging is disabled. For a Cloud device download, the website checks your account and serves the download through a download link on tweetmediaarchive.com valid for up to 30 minutes, subject to the file’s five-hour expiry or early deletion. The link allows browser retries and range requests for that same file. Its session temporarily stores an opaque reference to your temporary file until expiry cleanup, without your name, email, account token, or storage credentials. Link expiry does not stop a transfer already running. Cloudflare processes the requested URL, media bytes, and routine network metadata under its platform policies. Social-media login cookies are not sent to these services. Website account tokens are sent to the website API and Convex for authentication, and are not forwarded to the separate extraction and upload service. The website verifies your account and linked paid purchase with Convex and uses a Secure, HttpOnly session cookie lasting up to 15 minutes for Cloud previews and device-download authorization. Cloud capability mappings contain your account ID, so those links require the same signed-in account. Logging out clears the cookie. Cloud transfers have no application file-size or total transfer-time ceiling; source availability and available processing resources still apply.

Temporary Cloud device downloads: When you start a device download prepared through Cloud, we first store the completed file or selected ZIP in a private Cloudflare R2 bucket, encrypted at rest by Cloudflare. It is available only through account-authorized, short-lived download links for five hours from successful preparation. Repeat downloads do not extend that period. We retain an opaque account reference, a random file identifier, filename, media type, size, and expiry so you can find your own temporary files again. Completed files do not retain their source ticket. We do not share stored files between accounts, publish them through a public bucket, or upload files fetched locally by your browser or extension to this storage. Access stops at expiry or when you choose Delete now. Scheduled deletion removes the object and its temporary metadata; failed deletions are retried, with a bucket lifecycle rule as a later cleanup backstop. A service outage can delay physical deletion, but cannot extend download authorization. A download already started may finish. Incomplete uploads are removed on cleanup. Once accepted, preparation continues independently of the page or browser download; pending files appear in Temporary downloads. A server restart can require preparation to restart from the source. Files saved to your device, Dropbox, or Google Drive are not deleted by this temporary-storage cleanup.

If you log in on the cloud dashboard and choose Dropbox or Google Drive, the selected media is sent to that connected account and folder. Local processing uses the website uploader; Cloud processing uploads directly from Cloudflare to your storage provider. Convex remembers your folder paths and app-created Google Drive folder IDs. Your private cross-device cloud-save history contains the provider, filename, type, size, destination path, and save time. It does not store the source post URL or media bytes and is not visible to other signed-in users. Temporary media is removed after the transfer ends. Private and sign-in-only posts still require the extension.

When a paid user starts a Cloud save to Dropbox or Google Drive, Convex keeps an encrypted temporary media description and upload checkpoints so the save can continue after the page closes or the uploader restarts. Checkpoints contain the provider upload-session reference, confirmed byte position, and integrity data. The private job record contains the filename, provider, folder, status, progress, cancellation state, and timestamps. Cloudflare stores an opaque job assignment and receives a storage access token in memory for the upload; long-lived refresh tokens remain encrypted in Convex. Provider tokens are not included in the job payload or public status response. Closing the page or signing out does not cancel an accepted save; you can cancel it from Background saves. Accepted saves have no total waiting or execution time cutoff. Active records are kept until the job finishes or is canceled, then encrypted media descriptions and checkpoints are removed. Finished job status and filenames are eligible for cleanup after about 24 hours; completed saves also use the existing private history. Paid access and the storage connection are checked before a job starts. Dropbox metadata permission allows the uploader to verify completed files after an interruption.

The signed-in dashboard also keeps private progress records for Local device downloads and Local uploads: filename, transfer type, byte counts, status, timestamps, and hashes binding an opaque monitor to that transfer. These records do not contain media bytes, source URLs, or provider credentials and are scheduled for deletion after 24 hours. Local device progress measures bytes sent to the browser; the browser manages the final saved file. Cloud device transfers go directly from Cloudflare to your browser, which manages their download progress.

Optional diagnostics and sharing

If you explicitly request account-specific Cloud troubleshooting, we may enable private diagnostics for your account. These records are associated with your website account and contain a random operation or job reference, processing stage, source-platform category, destination provider, timing, byte counts, software version, and sanitized error codes. They do not contain media, filenames, source URLs, cookies, or access tokens. Only authorized service administrators can read them. Diagnostics are eligible for scheduled deletion after seven days and can be disabled on request.

If you use the share action in history or gallery, the selected saved file or link is passed to your browser or operating-system share sheet and then only to the app or device you select.

The extension uses Chrome local, sync, and session storage and IndexedDB for different purposes:

• Settings: provider, folder, naming, supported-site, and other preferences. Settings in Chrome sync storage may be synchronized by Chrome across profiles signed into the same Google account.
• History and archive memory: source and input URLs, filenames, provider, remote link or path, optional local path, file size, save time, transfer checkpoints, and source labels used to show history or avoid duplicate profile, bookmark, and collection saves. Remembered posts and collection progress are scoped to the social account you selected.
• Active work: pending jobs, progress, transfer journals, discovered collection entries, pagination cursors, per-post save results, picker requests, and short-lived media candidates needed to recover or complete a requested operation. Collection discovery and transfer checkpoints support continuing interrupted work.
• Secrets: supported authorization values and optional social-session cookies are encrypted using AES-GCM before browser storage. The non-exportable encryption key is kept in IndexedDB.

History, settings, and archive memory are kept locally until cleared or removed, subject to the extension's storage limits. Removing a social account deletes its encrypted session but does not delete its download history or account-scoped archive entries. Temporary media candidates expire within 15 minutes. Some browser-managed sync copies may remain subject to Chrome's own retention behavior.

If you log in on the website, Convex Auth stores necessary access and refresh session tokens in your browser's local storage so the dashboard can remain signed in and synchronize the same account across devices. These values are for account access, not advertising or analytics. Logging out removes them from that browser. Short-lived, one-use provider connection and upload records are stored by Convex to complete the action you requested.

The signed-in dashboard remembers only your Local or Cloud processing choice in a separate browser local-storage setting. It does not store a pasted URL or result list with that preference.

Website folder choices and app-created folder IDs remain with the connected provider record so the same choices work across devices without browsing cloud contents. Disconnecting that provider deletes its stored grant, folder choices, and folder-ID mappings from Convex. Cloud files and folders already created in Dropbox or Google Drive are not deleted. Opaque device-download links expire after about 15 minutes; an expired random identifier may remain in your own browser history or routine hosting logs, but it no longer authorizes a transfer and does not reveal the source URL or filename.

The website keeps up to the latest 200 private cloud-save history records. Clearing history hides completed items and removes finished Local progress records. Saved-file receipts remain within that 200-record limit; older receipts are removed as new saves are recorded. Cloud job records follow the cleanup periods above. Keeping these records helps reconcile late acknowledgements and retries. Clearing history does not cancel active jobs or delete provider files. Completed upload tickets are eligible for cleanup after about 24 hours; unfinished tickets generally after seven days, with active background work protected until it settles. Scheduled cleanup may run after an eligibility time.

Website login and Convex Auth

Website login is provided by Convex Auth using Google OAuth with basic profile and verified-email access. Google Drive storage permission is requested separately only if you connect Google Drive. A verified Google email is used to attach the login to the matching existing website account so its entitlement, provider connections, and private history remain available. If you connect Dropbox or Google Drive from the website, the authorization grant is associated with your Convex user and encrypted with AES-GCM in Convex. Provider tokens are not returned to webpage JavaScript or another user. For each requested upload, a short-lived one-use ticket binds the media, account, provider, and folder; the website server exchanges that ticket for the selected account's usable provider token and streams the file. Disconnecting deletes the website's stored grant. You may also revoke the app from the provider's own account settings.

ExtensionPay entitlement

A logged-in website account can try five pasted cloud-save links. One post counts as one link even when it contains a carousel. To unlock unlimited website cloud saves, you can open Tweet Media Archive's ExtensionPay plan page and use Already paid? Log in with an existing extension purchase. Convex stores the resulting ExtensionPay account-link key encrypted and periodically asks ExtensionPay whether that account is still paid. The key is not used for Dropbox, Google Drive, or analytics. Unlinking removes it from the website account and does not cancel the underlying subscription.

Dropbox

Dropbox shows its own authorization page. The extension encrypts its Dropbox credentials in local browser storage, and the website keeps its separate encrypted grant in Convex. The website requests files.content.write and files.metadata.read to upload selected files, create destination folders, and verify completed uploads after interruptions. Extension Cloud admission may make a limited root-folder metadata request to confirm this permission; returned names are discarded. Connection checks may also use a provider account identifier. These permissions are used for your connection and requested saves, not to build an inventory of unrelated Dropbox content. The extension also lets you provide your own Dropbox app key.

Google Drive

The website uses Google's drive.file scope. It uploads to your Drive root or creates nested folder paths you type, remembers app-created folder IDs, and may check metadata for its folders or uploaded files to reuse a destination or verify a save. It does not browse unrelated Drive content. Extension Cloud connection checks may read your Drive account identifier. The extension's default Google connection separately uses a Convex-hosted OAuth broker. That broker receives the authorization code, keeps the long-lived Google refresh token server-side, and gives the extension a broker session and short-lived Drive access tokens. Broker sessions expire after 30 days of inactivity or 180 days in total. Disconnecting asks the relevant connection service to delete the connection.

If you provide a custom Google OAuth client, the extension bypasses the included broker and stores the returned authorization values encrypted in your browser profile.

Optional social sessions

You may save multiple X/Twitter, Instagram, or Threads sessions, with one active account per platform, for media that account can already view. Login happens on the social website; the extension does not ask for or store your password. Save current account captures allowlisted session cookies, a local label, an account identifier when available, and timestamps. Session values are encrypted locally and used only for supported browser media and collection requests. Firefox containers and cookie stores stay separate. Changing the active account changes future discovery and saves; removing a session does not clear its history or remembered archive entries. These social cookies are not sent to Convex or Cloudflare for Cloud uploads.

ExtensionPay provides paid-plan and restore-purchase status to the extension. Stripe processes checkout and payment details. Tweet Media Archive does not receive or store complete card details.

Payment support records may include a Stripe event, customer or subscription identifier, recipient email, delivery status, and a Resend message identifier or delivery error so purchase-related messages can be sent and troubleshot. ExtensionPay may provide email, paid status, plan, and subscription state used to apply free-use limits and paid access.

If you pair the companion command-line tool, the Convex-hosted license broker processes a short pairing code or token and stores a hashed session token, payment-account email, encrypted ExtensionPay API key, timestamps, revocation state, and hashed rate-limit data. Pairing records are short-lived. An active CLI session remains until it is disconnected, revoked, or no longer valid.

Bug reports are sent only when you choose to submit one. A report can include a report ID, a random anonymous installation token, extension version, and the summary, details, reproduction steps, and expected result you enter.

Transfer logs may be offered as editable report text. The extension sanitizes known secrets and sensitive URL parameters before submission, and you can review or remove the text first. Reports are sent to the Convex-hosted support endpoint. The anonymous token is hashed for rate limiting. Reports are eligible for scheduled deletion after 30 days, and associated rate-limit records after two days. You can also request deletion.

Browser-based website analytics is currently disabled. The Cloudflare website does not load the Vercel Web Analytics script or send page-view and downloader-usage events to it. Automatic injection of Cloudflare's browser analytics script is also disabled.

Operational hosting logs and metadata are separate from browser analytics. Cloudflare and Convex process the network metadata needed to deliver and protect the service under their platform policies. Application request logging is disabled for the website Worker and API container; private responses are marked no-store. Optional account diagnostics are described above.

The necessary Convex Auth browser storage described above is used only for account and cloud-save features. The extension does not send its local media-candidate data or saved history as website analytics.

We do not sell user data or share it with advertising networks or data brokers. Information reaches another service only as needed for the feature you choose:

• Source websites and media hosts receive requests for the specific page or file being resolved or saved.
• Google receives the standard OAuth request needed for website sign-in. Google Drive separately receives authorization data, folders, filenames, and files only if you connect it as a destination.
• Dropbox receives authorization data, folders, filenames, and files only if you connect it as a destination.
• Convex provides optional website login, encrypted storage connections, private cross-device cloud-save history, website and extension Cloud job coordination and recovery records, short-lived encrypted device-download capability mappings and abuse counters, the extension's Google OAuth broker, the CLI license broker, optional account diagnostics and bug reports, and payment-support records described above.
• Resend delivers purchase-related and support email.
• ExtensionPay and Stripe provide purchase, subscription, and payment processing. ExtensionPay also verifies paid access for linked website accounts and extension Cloud uploads.
• Chrome and Google browser services may process sync storage, downloads, extension APIs, and consent flows under your browser and account settings.
• Vercel manages the website domain registration. A previous website deployment may be retained temporarily for service recovery.
• Cloudflare hosts this website, its API, public-post resolvers, streaming download endpoint, and Cloud processing services. The website API processes account tokens and the provider credentials needed for your requested save; separate metadata resolvers do not receive those credentials. Cloudflare processes requested URLs, media bytes, and routine network metadata under its platform policies. Application request logging is disabled for the website Worker and API container. The narrow metadata Workers do not proxy media files; separate Cloud processing containers prepare and transfer requested media as described above.
• Your share destination receives a file or link only after you choose it in the browser or operating-system share sheet.

• Choose Dropbox, Google Drive, or local Downloads and change that choice at any time.
• Choose Browser or Cloud in the extension, or Local or Cloud on the website. Changing a preference does not move or cancel jobs already accepted.
• Disconnect Dropbox or Google Drive to delete that website connection and its remembered folder paths and folder-ID mappings from Convex. Files and folders already created in the provider remain until you delete them there.
• Disconnect an extension storage account from extension settings to remove that connection and request cancellation of its Cloud jobs when online. You can also revoke access at the provider.
• Select or remove saved X/Twitter, Instagram, or Threads sessions in extension settings. Clear their local history and archive memory separately if desired.
• Log out of the website to remove its Convex Auth session values from that browser. Disconnect either website cloud provider to delete that encrypted website grant from Convex.
• Unlink ExtensionPay from the website account without cancelling the purchase; billing changes remain available through ExtensionPay.
• Cancel active background saves through their transfer controls. Closing the browser, signing out, or clearing history does not cancel an accepted Cloud upload.
• Clear your website cloud-save history without deleting files from Dropbox or Google Drive. Hidden receipts remain within the 200-record history limit, and Cloud job records follow their separate cleanup periods.
• Use your own Dropbox app key or Google OAuth client if you prefer.
• Turn supported-site features and archive memory on or off.
• Clear upload history and the local archive index.
• Review and edit an optional bug report before sending it.
• Request that optional account diagnostics be disabled or ask for deletion of information held by our services using the contact below.
• Disconnect a paired CLI license to revoke that session.
• Remove the extension to delete extension-local browser data. Browser sync, cloud files, provider records, or support reports may need to be deleted separately from the service that holds them.

Tweet Media Archive's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The extension also follows the Chrome Web Store User Data Policy.

Google user data is used only to provide or improve the requested sign-in, account connection, and Google Drive saving features. It is not used for advertising, sold, or transferred for unrelated purposes.

We may update this policy when extension behavior, providers, browser permissions, or legal requirements change. Material revisions will update the effective date at the top of this page.

For a privacy question, deletion request, or concern about information you submitted to a Tweet Media Archive service, contact @danialbka on X. Please do not send passwords, authentication codes, access tokens, or account cookies.