Privacy Policy

Bag Check is a browser extension for X. When someone posts about a company they have a publicly reported financial stake in, like a board seat, an investment, or a founder or employee role, Bag Check adds a tag to the post with a link to the public source. It does the same when a post shares that person's words, like a quote of their post, a clip or an interview.

In short

What runs on your device

Bag Check does its work in your browser.

• It reads the posts on the x.com pages you visit, to see whether the author, or someone the post quotes or names, is in its dataset, and which companies the post mentions.
• It reads the names on posts and X's affiliation badges (the company logo next to someone's name). When you're signed in, X shows only the logo, so a small script on the x.com page finds which account the badge belongs to, from the page itself. It reads nothing else and sends nothing.
• The dataset of people, companies and their sourced ties comes with the extension and updates with it.
• About every 10 minutes while you're on x.com, it downloads a public update file: stakes and companies found since your version was built, current news, and what tech X is talking about right now (we call these "moments"). Everyone gets the same file, and nothing about you is sent to get it.
• Your settings, and the name you give if you give one, are kept in your browser's extension storage.
• It keeps a short-lived cache on your device: which authors posted about which news events in the last 12 hours or so, and recent model answers by post ID.

Your messages

Bag Check doesn't read your direct messages. Nothing from them is collected, kept or sent anywhere.

On X's Messages pages (x.com/i/chat, and x.com/messages before it), the extension looks only at the page's address, so it knows to stay out. It doesn't read anything on the page, tags nothing there, and selection mode doesn't run there. It never attaches a Messages page's link to feedback or a request, since the link shows who the conversation is with. The same goes for the messages panel X can open beside the timeline.

What leaves your device

Apart from the install count and anything you choose to send (both below), the extension sends something to Bag Check's server in only four cases. Each one is about a public post by someone in the dataset (investors, and founders of companies in it), or a post by someone else that quotes or names them (a quote of their post, a clip, an interview, "X says…").

1. Checking what a post is about. When one of these posts names a company the person has a stake in, or a close rival of one, the extension may send the post's text and ID, the text of any post it quotes or replies to, the names it matched, and short facts from Bag Check's own data about the companies and people involved. A classification model (Jev, by TypeSafe) then answers a few set questions. Does a name that's also an ordinary word ("Ramp", "Cursor") mean the company? Is the post about the company (or about an investor in the dataset), or does it take a shot at it? Is a post by someone else sharing what the person said? The model only answers. It never writes a tag.
2. Checking what a post is reacting to. When one of these posts goes up while tech X is talking about something involving a company the person has a stake in (a moment, like a fight, a filing or a launch lots of people are posting about), the extension may send the post's text and ID, the text of any post it quotes or replies to, and the IDs of up to five moments. The server reads the post's public text, the posts above it in its thread and the author's public bio (through FxTwitter, a public X viewer). It asks the model which moment, if any, the post weighs in on, and whether it's about the author's own company. Nobody's stakes are sent. Versions from before October 28, 2026 send short descriptions of up to five news stories, with the companies in them, instead of moment IDs. The model is asked which story, if any, the post reacts to, and which companies each story is about.
3. X Articles. When a post by someone in the dataset shares an X Article, the extension sends the post's ID. The server reads the article's public text (through FxTwitter) so the tag can reflect what the article says.
4. Long posts. X cuts long posts short ("Show more") in timelines and profiles, and long quoted posts everywhere. It can also show a reply without the post it answers. When that happens, the extension sends the post's ID (or the ID of the post it replies to), and the server reads the full public text, and the post it answers, through FxTwitter. That way the tag is the same wherever the post appears.

None of this includes anything about you: no account details, no browsing history, no cookies, nothing that says who is looking. Each check carries the extension's random install ID, so the server can limit what each install's checks cost (see "The install ID" below). The server keeps each answer for up to 7 days, so each post is checked once for everyone.

To stop anyone running up its costs, the server looks at each request's IP address:

• It counts requests per minute by address. Those counts are deleted after 2 minutes.
• It counts each day's paid checks under a one-way hash of the address, made with a secret key. Those counts are deleted after 2 days.
• An address that abuses the server is blocked. Bag Check keeps the hash, the reason, and the name of the network it came from (a provider, like a hosting company), until 30 days after the block ends.

The address itself isn't kept in any of this. Cloudflare, which runs the server, may log requests with their address for up to 7 days, and only Bag Check's maintainer can see those logs.

The install ID

When you install the extension, it makes a random ID. It isn't tied to you, your browser profile or your X account.

The ID goes with each check described above. Bag Check runs on paid checks, and one copy running them up, through a fault or a script, could use up what keeps them on for everyone. So when a check costs money (the server asks the model, rather than reusing an answer it already has):

• The server counts it on the install's day, under a one-way hash of the ID made with a secret key. An install past the day's limit gets no new paid checks until the next day (UTC). Answers the server already has still come back. These counts are deleted after 2 days.
• For an install that sends the install count (below), the server adds 1 to the ID's count of paid checks and adds what it cost to the ID's running total. No dates, no posts, no addresses.

The install count

When you install the extension, and then at most once a day while it runs, it sends:

• the random ID above
• your browser (Chrome or Safari)
• the extension's version, and how you got it (a developer build, the beta download or a store install)

Bag Check uses this only to count installs and see which versions are in use. Nothing about you or the pages you read goes with it. Bag Check for Safari from the Mac App Store or TestFlight doesn't send it, because Apple counts those installs.

What you choose to send

• Requests, disputes and feedback. When you ask for someone to be covered, dispute a tag, or send an idea or a problem, the extension sends what you typed or picked: the person's X handle and name, the tag's words, the post's link and ID, your reasons, your note, and the x.com page you were on. It goes with your install ID, and with the name or @handle you gave under Give Feedback in the toolbar menu, if you gave one. Giving one is optional, and the email box next to it stays in your browser for now.
• Searches. Searching for someone sends what you typed to Bag Check's server to look them up. An @handle is looked up on FxTwitter. Searches aren't stored.
• The website's request form. Asking for someone on Bag Check's website sends their handle or name, plus a note and a way to reach you if you add them. Before it's sent, Cloudflare Turnstile checks that you're a person and not a script. Its script loads only then, and asks you to click only if Cloudflare isn't sure. Cloudflare's Turnstile privacy terms cover that check, and Bag Check only learns yes or no. To stop spam, Bag Check counts requests per hour using a one-way hash of your IP address. The hash is kept for about two hours, and the address itself is never stored.
• What the website remembers. The website keeps a list of the @handles you've asked it to check, in your own browser's local storage, so it doesn't offer them again. The list stays on your device, is never sent to Bag Check, and is forgotten after 90 days. Clearing the site's data removes it.
• TestFlight. If you test Bag Check for Safari through TestFlight, Apple tells Bag Check how you joined (by the public link, which keeps you anonymous to Bag Check, or by an invitation, with the name Michael entered for it), whether you've installed it, and when. Bag Check keeps that while you're a tester and deletes it 90 days after you leave. Apple's terms cover what Apple collects.

How long it's kept

• What you send with a request, dispute or feedback (your words, the page, your install ID and name) is kept while it's open, so it can be acted on, and deleted 180 days after it's closed. A request closes when the person is researched or declined, a dispute when it's upheld or rejected, and feedback when it's marked done. All of it is deleted when the beta ends. Whether a public figure was added to Bag Check stays on record, but not who asked.
• An install ID is kept while it's in use, with its count and running total of paid checks, and deleted after a year without a ping.
• A one-way hash of an install ID is kept 2 days with that day's count of paid checks.
• A one-way hash of an IP address is kept 2 days with that day's counts. If the address was blocked for abuse, it's kept until 30 days after the block ends.
• A job runs every hour to delete whatever has reached its time.
• The database is backed up every day, encrypted, and backups are kept for 30 days. Anything deleted is gone from every copy within 30 days.
• Only Bag Check's maintainer sees any of it. It's never sold or shared, and never used for advertising.

What Bag Check's server reads on its own

To keep the dataset current, Bag Check's server reads public information about the people and firms in it. This involves no one's browsing. It happens the same way whether or not anyone uses the extension, and nothing the extension sends is kept for it.

• Their public posts. The server reads the public X posts of the people and firms in the dataset (through FxTwitter), their public replies among them, and keeps them for two weeks, each reply with the public post it answers. It looks for stakes they mention ("excited to lead…") and funding announcements they share. It reads public funding news the same way. When posts are part of a news story, the story keeps their words for up to 17 days. From the stories and posts, it works out what many of these people are talking about at once (a moment), and keeps each moment for 30 days, with two of the public posts about it, their words, and which of the posts it keeps were part of the conversation, so Michael can read it as it happened.
• Reporters and commentators. To hear what's being talked about, the server also reads the public posts of about a hundred accounts many of these people follow (tech reporters, newsletter writers, commentators and company leaders), and keeps them for the same two weeks. These posts are used only to find what's being talked about. They're never checked for stakes or tagged.
• Checking its own tags. To check its tags on moments, the server runs these posts through the same steps the extension takes. It keeps the ones it would tag for 90 days (the public post, the moment and the model's answer) so Michael can mark them right or wrong.
• Who they follow. Every two weeks, the server reads who the people and firms in the dataset follow on X (their public following lists, through FxTwitter). It keeps the public profiles of the followed accounts worth finding: those followed by two or more of them, or by one, with 2,000 followers or more. That's the name, handle, bio, follower and following counts, and the address of the profile photo. It lets the website find someone by name ("gaby goldberg") and offer to check them. An account no one in the dataset follows anymore drops out at the next read.
• Profile photos. The server keeps a copy of the public X profile photo of each person and firm in the dataset, and of people someone asked to add, fetched once. The extension, the website and Bag Check's own pages load photos from Bag Check's server, not from X, so showing a photo tells X nothing about who is looking.

What Bag Check never does

• No ads, no tracking and no third-party analytics. Apart from the counts that stop abuse, the only counts are the anonymous install count above and what each install's checks cost. Nothing is sold or shared.
• It doesn't read any site but x.com and twitter.com, and it doesn't read your X messages.
• Tags never say anything about anyone's intent. They state publicly reported stakes, with links.

Chrome Web Store User Data Policy

Bag Check's use of the information described here adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements: it is used only to provide and improve Bag Check's single purpose (showing publicly reported stakes on posts), never transferred except as described here, never used for advertising, credit-worthiness or lending, and never read by people except Bag Check's maintainer acting on what you sent, for security, or as the law requires.

Corrections

Every tag's details have a "Dispute this tag" form. Disputes are checked against the public sources, and a tag the sources don't support is taken down for everyone.

Contact: hmu@mikemillmade.it