Applies to the Flagged Chrome extension · Last updated March 2026

Flagged is a browser extension that filters your X (Twitter) timeline by account country. This policy explains what data the extension accesses and how it is handled.

What data the extension accesses
Account country information — when you visit X, the extension looks up the registered country for accounts visible on your timeline by querying X's own internal endpoint. This is the same public information shown on any profile page.
Your own handle — read from the page to ensure your own posts are never filtered.
Your settings — filter mode, country list, whitelist, blacklist, and preferences are stored locally using chrome.storage.local.
Account cache — resolved account countries are stored locally so future lookups are instant.

What data is never collected
No personal data is collected, stored externally, or transmitted to any server operated by this extension.
No analytics, tracking, or telemetry of any kind.
No account credentials or authentication tokens are accessed.
The content of tweets is never read or stored.

Local storage only
All data — your settings, your cache, your imported databases — lives entirely on your device. Nothing leaves your browser except the requests described below.

Shared Database
When the Shared Database is enabled (on by default), the extension queries a community-sourced database to look up account countries, and automatically contributes newly discovered account countries back. Only two pieces of data are ever sent: the account handle and its registered country — both of which are already public information on X. No user data, IP addresses, or personal information are stored by this service.

Import & export
The extension lets you export your local cache to a file and import files from others. This is entirely user-initiated. No data is uploaded anywhere automatically.

Third-party services
The extension makes requests to x.com to resolve account countries, and optionally to the shared community database. No other third-party services are contacted.