Privacy Policy | X Bookmarks Archive

This policy covers the Chrome extension "X Bookmarks Archive" and the website shelf.zimolab.org, both operated by Zhang Yu, an individual ("we", "us"), who is the controller of the data described here. In short: your bookmarks and likes stay on your own computer. We never see them.

Extension: data stays on your computer

Using the session you are already signed in with on x.com, the extension calls X's own web interfaces to read your bookmarks and likes (post text, authors, image and video links, dates) and stores them locally in your browser (IndexedDB).
It never likes, bookmarks or posts on your behalf. The only action that changes data on X is when you manually click "Remove on X" on a single post and confirm: it affects that one post only, just like clicking it on X, and there is no bulk option.
The cookies permission is used only to read the twid cookie on x.com, to tell which X account is signed in so data can be kept per account. Credentials are used only inside x.com pages and are never stored, exported or sent to us.
To complete post details, the extension may request public post data from X's own service (cdn.syndication.twimg.com).
This data is never uploaded to our servers. You can clear it in the extension's settings; uninstalling the extension also removes it.

Extension: AI organize (Pro, optional)

Used only after you enter your own API key, agree to send content and start organizing.
The extension sends short digests of the posts being classified (post text, author handle, link domains, quoted snippets) and your tag names directly from your browser to the AI service you chose (DeepSeek or Anthropic), not through our servers. That service's privacy policy applies to this data.
Your API key is stored only in your browser.

Extension: Pro activation

Activating Pro, and re-verifying about every 7 days, sends to shelf.zimolab.org:

the activation code;
a randomly generated device id (contains no personal information);
the device type, such as "Mac · Chrome".

The server keeps these and the last verification time only to count the slots used by each code (up to 3). No bookmarks, likes or X account data are sent.

Website: purchases

When you buy Pro we record the order number, amount, currency, payment status and the payment provider's transaction number; for purchases via Waffo we also receive the email address you enter at checkout. We use this only to deliver and recover your activation code, process refunds and answer support requests.
Payments are handled by the providers below. We never receive your card number or WeChat account:
- Waffo Pancake acts as Merchant of Record for card and other payments and, under its privacy policy, collects what is needed to complete payment (such as name, email, billing country and card details), calculate taxes and prevent fraud. Card data is processed by its PCI-DSS compliant systems and is not stored on our servers.
- Z-Pay / WeChat Pay for WeChat payments.
The purchase page remembers your latest order in your browser (localStorage) so you can come back to your code.
This website uses no ads, no third-party analytics and no tracking cookies. It is hosted on Cloudflare, which keeps standard access logs (such as IP address and time) for security and troubleshooting.

We never sell or rent your data. We share it only with the following, and only as needed to provide the service:

Payment providers (Waffo Pancake, Z-Pay, WeChat Pay): to complete payments and refunds;
Hosting provider (Cloudflare): to run the website and activation server and store order and activation records;
The AI service you choose (DeepSeek or Anthropic): only when you use AI organize, sent directly from your browser, not through us;
Legal requirements: when required by law or a lawful request from authorities.

What we never do

Sell or rent any of your data;
Use it for advertising or profiling;
Use it to determine creditworthiness or for lending.

The extension's use of data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Storage and security

Bookmarks, likes, tags and API keys stay in your own browser; we cannot access them.
Order and activation records are stored in a Cloudflare database, transmitted over HTTPS and accessible only to us. Servers may be located outside your country.
Retention: order records are kept while your license is valid, so you can always recover your code, and as required for tax and accounting; device activation records are deleted when you remove the code or after 45 days without verification.

Your rights

Wherever you are, you can:

Access: ask what data we hold about you and get a copy;
Correct: have inaccurate information (such as your email) corrected;
Delete: have your order and activation records deleted (you will then be unable to recover the code; transaction records we must keep by law are excepted);
Object or restrict: object to how we process your data;
Complain: if you are in the EU, UK or similar regions, lodge a complaint with your local data protection authority.

To exercise these rights, email 86168@88.com. We reply within 30 days.

Deleting data

Extension data: use "Clear local data" in settings, or uninstall the extension.
Activation records: "Remove code" in the extension deletes that device's record; you can also email us to delete all records of your order (you will then be unable to recover the code).

Children

The extension and website are not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.

Changes and contact

We will update this page and its date when the policy changes. Questions: 86168@88.com.