Privacy
Signed out, the tweet score calculator runs in your browser. Sign in with X is optional. It calibrates four heads from your recent posts and stores drafts you choose to save.
What sign-in reads
On sign-in, and when you press Refresh rates, the server asks X for:
- Your numeric user id, username, and display name.
- Up to two pages of your recent posts (100 each), excluding reposts, with public metrics. Organic or non-public impression counts are requested only when that tier returns them.
- One page of accounts you follow and one page of accounts that follow you (up to 1,000 each), so the page can name a sample of mutuals.
The read set is profile, posts, and follows. Likes, bookmarks, and direct messages are not requested. Page views read a cache. A refresh is limited, and a fresh cache is kept for six hours, because those reads are billed to the developer account that owns the X app.
What is stored
- X user id, username, and display name.
- Access and refresh tokens, encrypted at rest. The browser cookie holds a sealed session id, not a token.
- Aggregate rates (reply, quote, repost, like per impression), the scales, and up to 400 mutual usernames from that one-page sample. Post text is not stored.
- Drafts you save: text, toggles, per-head scores, and the time. Up to 100 drafts.
Cookies
tf_session is httpOnly, SameSite=Lax, and Secure on https. It lasts about 30 days. tf_oauth lasts about 10 minutes and only holds the OAuth state and PKCE verifier for the sign-in redirect.
Cloud sync
Cloud sync is off unless you run tf login and then tf sync push on a machine that has tweet-factory. Login only links that checkout. Push sends a copy of the local library: likes, bookmarks, your posts, public metrics, article text, Notion tags, persona/PERSONA.md, and drafts/*.md. Local files remain on that machine.
Tweet text, author descriptions, article extracts, Notion notes and page text, and persona and draft bodies are encrypted at rest before they are written. The key is held by the site operator, so this is not end-to-end encryption. Ids, usernames, metrics, tags, and filenames are stored so the account page can list files. Each copy is tied to the X account that approved the device code.
On the account page, Export downloads that copy as JSON. Delete synced data removes the cloud copy and the device link. It leaves the sign-in session and it does not delete files on your computer. A default quota caps how much one account can store.
Delete account
On the score page, while signed in, Delete account removes the session, encrypted tokens, cached rates, mutual sample, and saved drafts. When cloud sync is configured, it also removes the synced copy. It does not change your X account. Sign out clears the session cookie and leaves the stored rows until you delete the account.