Privacy policy

Last updated 25 October 2026

XRAY is a Chrome extension that lets you look up and trade crypto tokens mentioned on X. This policy explains exactly what the extension reads, what it stores, what it sends and to whom. XRAY has no servers of its own, no user accounts and no analytics. We do not sell data and we do not show ads.

What XRAY reads

• Post text on X. On x.com, twitter.com and pro.x.com, XRAY reads the text of posts, bios and display names to find $TICKERS, contract addresses and links to trading sites. Nothing else on the page is read, and the text itself is never stored or sent anywhere.
• Your pointer and keys, while the panel is open. XRAY opens its panel when you rest the pointer on a marked token, and listens for its hotkeys (1 to 4, Q, W, E, R, B, S, P, Esc) only while the panel is open. These events are handled on your device and are not recorded or sent.

What XRAY stores on your device

• Instant wallet keys, encrypted with AES-256-GCM under a key derived from your password (PBKDF2-SHA256, 310,000 rounds). Your password is never stored.
• An unlocked-session key, kept only in Chrome's in-memory session storage until your auto-lock time passes or the browser closes. It is never written to disk.
• Your settings (trade sizes, slippage, fees, display options, an optional custom RPC address).
• Your trade history and positions, built from your own confirmed transactions, so XRAY can show your P&L.
• Public addresses of wallets you connect, such as Phantom or MetaMask. XRAY never has access to the keys of those wallets.

All of this stays in your browser's extension storage. Removing the extension deletes it.

What XRAY sends, and to whom

To show prices and place trades, the extension talks directly to these services from your browser. Each receives only what it needs:

• Token lookups: the ticker or contract address you are looking at is sent to Dexscreener, Jupiter, GeckoTerminal and GoPlus Security to fetch price, chart, liquidity, holder and safety data.
• Balances: your wallet's public address is sent to Jupiter and to a Solana RPC provider (PublicNode by default, or the provider you choose in Settings), and for EVM tokens to that chain's public RPC.
• Trades: your public address, the tokens and the amount are sent to Jupiter or LI.FI to build a route. Signed transactions are sent to the Solana network through Helius Sender, Jito and your RPC provider, or through your own wallet for EVM chains.
• Token images are downloaded from the image host the token lists (for example IPFS gateways).

Your private keys and password never leave your device. Blockchain transactions are public by nature: anything you trade is visible on the chain.

Fees

When enabled, XRAY adds a 0.3% platform fee to swaps as a SOL transfer inside the same transaction. It is shown before you trade and is visible on chain like the rest of the transaction.

How data is used

Data is used only to provide XRAY's single purpose: finding tokens on X and trading them. We do not sell or transfer user data to third parties outside the uses above, we do not use it for advertising or for purposes unrelated to that purpose, and we do not use it to determine creditworthiness or for lending.

Children

XRAY is not intended for anyone under 18.

Changes

If what XRAY reads, stores or sends changes, we will update this page and tell you in the extension before the change takes effect.

Contact

Questions about privacy: see the support page.