Privacy Policy — Tweet2Skill

Last Updated & Effective Date: August 21, 2026 | Item ID: gpggdojppnknejkhhggmpkfpdjmecnbb

This Privacy Policy applies to the Tweet2Skill browser extension for Google Chrome (Item ID: gpggdojppnknejkhhggmpkfpdjmecnbb) and its accompanying service platform located at https://tweet2skill.hero-apps.com. Tweet2Skill is developed and operated by Dorien Van den Abbeele (Hero-Apps) ("we", "us", or "our").

Summary / Core Pledge: Tweet2Skill operates on a privacy-first, local-first architecture. We do NOT sell, rent, or trade your personal information. We do NOT track your overall browsing history. Data is collected solely to authenticate your account, enforce credit quotas, and convert user-selected webpage/thread text into developer agent skills upon your explicit request.

1. Information We Collect

Depending on how you use Tweet2Skill, we collect and process the following categories of data:

A. Identification & Authentication Data (Optional Cloud Mode)

Google Account Profile: When you choose to sign in via Google OAuth, we receive your email address, full name, and profile picture URL directly from Google Identity Services.
Authentication Tokens: Temporary Google ID tokens and signed session JWTs used to securely authenticate your requests to our backend API endpoints.

B. User-Initiated Web Content & Thread Data

Active Webpage & Tweet Content: When and only when you explicitly click "Turn into Skill" or select text in your browser, the extension reads the text content, post author handle, timestamp, and structure of the active tab (e.g. X/Twitter thread or technical documentation page).
Selected Text: If text is highlighted, only the highlighted text snippet is extracted.
Source URL & Page Title: Captured to format the attribution metadata in the generated markdown skill.

C. Client-Side Preferences & API Keys (Local Storage)

Custom API Keys (BYOK Mode): If you choose Bring-Your-Own-Key mode by entering a Google Gemini API key, the key is saved strictly in your browser's private local storage (chrome.storage.local) on your device. It is never transmitted to or stored on our servers.
Configuration Settings: Your preferred AI agent format (Google Antigravity, Claude Code, Cursor, Windsurf, Copilot), local host mode path, and Deep Thread toggle state.

D. Technical, Usage & Diagnostic Data

Rate Limit Counters & Ledger: For free-tier and Pro cloud users, we store daily and monthly generation counter keys linked to your account ID to enforce fair-use quotas and verify Pro credit balances.
Support & Feedback Submissions: If you submit feedback via the built-in feedback drawer, we receive your message, selected feedback type (Bug/Suggestion/Praise), extension version, and optional email address.

2. How We Process and Use Your Data

We process collected data strictly for the following operational purposes:

Skill & Rule Generation: Transmitting the user-selected webpage or tweet text to Google Gemini AI models to structure it into actionable AI coding skill markdown files (.md).
Account Authentication & Access Control: Verifying your identity, preventing unauthorized access, and maintaining your login session.
Quota & Billing Management: Managing daily free credits, tracking one-time purchased Pro credit packs, and preventing service abuse.
Local File Synchronization: Communicating with your local native messaging Python helper (save_skill.py) to save files directly into your specified workspace directory when local host mode is enabled.
Customer Support & Bug Resolution: Troubleshooting issues reported directly by users through our feedback channel.

Policy Compliance Certifications:
• We do NOT sell, rent, monetize, or lease personal user data to third parties or data brokers.
• We do NOT use or transfer user data for serving personalized advertising or marketing campaigns.
• We do NOT use user data for creditworthiness, lending, or employment screening purposes.
• We do NOT track, store, or monitor your general web browsing history outside of pages where you explicitly launch the extension.

3. Data Storage, Security & Retention

Where Data is Stored:

Local Device Storage: User preferences, local directory paths, and BYOK Gemini API keys reside exclusively inside chrome.storage.local within your Chrome profile.
Cloud Database (Upstash Redis): Account records (email, name, tier, remaining credit balances) and rate-limit counters are stored in an encrypted Redis database operated by Upstash in secure US/EU cloud regions.
Ephemeral In-Memory Processing: Raw webpage content and tweet texts sent to /api/generate are processed entirely in memory during the execution of the serverless function. We do not permanently store or archive the raw text of pages you convert.

Data Retention Periods:

Account & Pro Credit Ledgers: Maintained for as long as your account remains active or until you request account deletion.
Daily & Monthly Rate Limit Records: Automatically expire and are purged via Redis TTL (Time-To-Live) every 24 hours and 30 days respectively.
Feedback & Diagnostic Submissions: Retained for a maximum of 90 days to diagnose and resolve reported bugs, after which they are deleted.

4. Third-Party Sharing & Data Disclosures

We share data only with trusted service providers strictly necessary to operate Tweet2Skill:

Service Provider	Data Shared	Purpose	Privacy Link
Google Identity Services	OAuth authentication credentials, email, profile name	User authentication and sign-in verification	Google Privacy Policy
Google Gemini API (Google Cloud)	User-extracted tweet/webpage text and generation prompt	AI LLM inference to format structured skills (not used to train public models)	Google Cloud Privacy
Stripe Inc.	Payment transaction identifiers, billing email	Secure processing of one-time Pro purchases (Tweet2Skill never receives or stores payment card numbers)	Stripe Privacy Policy
Upstash Inc.	Account ID, email, credit balances, rate limit counters	Encrypted cloud database storage for user state and rate limiting	Upstash Privacy Policy
Vercel Inc.	Ephemeral HTTP request headers (IP, User-Agent)	Serverless hosting infrastructure and edge SSL termination	Vercel Privacy Policy

5. Chrome Extension Permissions & Justifications

In compliance with the Chrome Web Store Developer Program Policies, here is the functional justification for every permission requested in manifest.json:

Permission	Scope & Technical Requirement
activeTab	Allows the extension to access the active tab's URL and title solely when you explicitly click the toolbar icon.
scripting	Executes the client-side DOM parser script to extract the text content of the active educational post or technical webpage.
nativeMessaging	Enables secure local inter-process communication with the local Python script (save_skill.py) to save files to your workspace directory.
storage	Saves your preferences, target AI format, local mode switch, and custom BYOK Gemini API key locally inside your browser.
tabs	Reads the active tab's URL and title during popup initialization to pre-fill the workspace scope.
downloads	Provides a one-click browser file download fallback if you choose not to use the native Python host helper.
identity	Facilitates secure Google OAuth sign-in to verify your email and retrieve your Pro credit balance.
host_permissions (x.com, twitter.com, tweet2skill.hero-apps.com, accounts.google.com)	Enables seamless DOM reading on X/Twitter threads, communication with the Tweet2Skill backend API, and secure Google OAuth token exchange.

6. Your Rights & Data Deletion Requests

Under international privacy regulations (including GDPR, UK GDPR, and CCPA/CPRA), you possess the following rights regarding your personal data:

Right to Access & Portability: You may request a copy of all personal data and records linked to your account.
Right to Rectification: You may update or correct your profile details at any time.
Right to Erasure (Data Deletion): You may request the permanent deletion of your account, credit records, and associated data from our Redis database.
Client-Side Erasure: You can wipe all local storage data, saved preferences, and BYOK API keys at any time by clearing extension storage or uninstalling the extension from Chrome.

How to Submit a Data Deletion Request:

To request permanent deletion of your cloud account and all associated records, send an email to support@hero-apps.com with the subject line "Tweet2Skill Data Deletion Request" from your registered Google email address. We will verify your identity and permanently delete all records from our database within 30 days.

7. Children's Privacy

Tweet2Skill is a developer productivity utility intended for software developers and AI practitioners. It is not directed to individuals under the age of 13 (or under 16 in the European Union). We do not knowingly collect personal information from children.

8. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. Any updates will be posted directly to this URL (https://tweet2skill.hero-apps.com/privacy) with an updated "Last Updated" date. Continued use of the extension after revisions constitutes acceptance of the updated policy.

9. Contact Us & Developer Information

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please reach out to us:

Product: Tweet2Skill (Chrome Web Store ID: gpggdojppnknejkhhggmpkfpdjmecnbb)
Developer / Entity: Dorien Van den Abbeele (Hero-Apps)
Support Email: support@hero-apps.com
Website: https://tweet2skill.hero-apps.com
X / Twitter: @dorienvibecodes