Totem

Privacy Policy

Last updated: September 16, 2026

How Totem handles your data.

The Totem extension keeps your reading queue on your device. You do not need an account, and your bookmark storage lives in your browser.

Totem reads your own X bookmarks from your existing browser session and turns them into a reading queue right inside your new tab. Everything stays on your device.

Website analytics never receives your extension data.
The extension does not collect analytics or behavioral telemetry.
No personal data is sold or shared with third parties.
No X password is ever requested — Totem uses your existing session.

Short version

Stored on your device

Bookmarks cache, tweet details, reading progress, highlights, notes, settings, and the auth/runtime metadata Totem needs to stay connected.

Sent to X only

Authenticated requests to x.com to fetch your bookmarks, fetch tweet details, and delete a bookmark when you do that inside Totem. Nothing goes anywhere else.

Sent only when you search

Your query goes directly to your chosen search provider, or to Chrome's default search if you enable that option and submit a search.

Optional features

Quick Links uses optional topSites and favicon permissions. Default-search integration uses the optional search permission.

Permissions explained

Each permission maps to a specific feature. Optional permissions are requested only when you turn on the feature that needs them.

storage

Always on
Why
Totem needs local storage so your reading queue and notes work like an on-device app.
What it does
Stores bookmarks and tweet detail cache, reading progress, highlights, notes, settings, and runtime/auth metadata in browser storage.

webRequest

Always on
Why
Totem needs to read the auth headers already present in your own x.com session.
What it does
Observes your x.com requests so Totem can capture the authorization, cookie, and CSRF headers required to load your own bookmarks locally.

cookies

Always on
Why
Totem needs to identify your active X account without asking for your password.
What it does
Reads x.com session/account cookies locally so Totem can scope the bookmark cache to the right account and notice login or logout changes.

declarativeNetRequest

Always on
Why
Totem needs its X requests to match the authenticated browser session you already have.
What it does
Applies the required request headers when Totem asks x.com for bookmarks, tweet details, or bookmark deletions.

https://x.com/*

Always on
Why
Totem only works against your own account on x.com, so it needs permission to operate there.
What it does
Lets Totem run content scripts on x.com, detect account context, and observe bookmark activity needed to keep local data in sync.

topSites

Optional
Why
Quick Links can show the sites you visit most often on the new tab page.
What it does
Reads Chrome's top-sites list only after you enable Quick Links.

favicon

Optional
Why
Quick Links are easier to scan when Chrome can show each site's icon.
What it does
Lets Chrome provide favicon images for the sites shown in Quick Links.

search

Optional
Why
Some people want Totem's search bar to use Chrome's default search engine instead of a fixed provider.
What it does
Lets Totem hand your search query to Chrome's default search only when you choose that mode and submit a search.

Full policy

What Totem stores

  • IndexedDB stores bookmarks, tweet detail cache, reading progress, highlights, and notes.
  • chrome.storage.local stores runtime and auth state, including captured auth headers, bookmark mutation queue data, and GraphQL endpoint catalog metadata.
  • chrome.storage.sync stores theme and settings when Chrome sync storage is available.
  • localStorage stores small UI preferences such as the selected reading tab and wallpaper choice.
  • Totem does not run a backend database for extension data.

What Totem sends over the network

  • Totem sends authenticated API requests to x.com to fetch bookmarks and tweet details, and to delete bookmarks when you choose to unbookmark inside Totem.
  • Totem may fetch x.com or abs.twimg.com bundles to discover GraphQL query IDs when needed to stay compatible with X.
  • Search queries are sent directly to your chosen search provider, or to Chrome's default search if you enable that integration and submit a search.
  • The Totem extension does not send analytics or behavioral telemetry to a Totem-operated server.
  • Totem does not sell personal data or share it with advertising or tracking platforms.

Website analytics

  • The public website, usetotem.xyz, uses Google Analytics 4 and Umami hosted on our own server to count pageviews, referrers, and install or download clicks.
  • Google Analytics may set cookies. Umami does not use analytics cookies, and we exclude URL query strings and fragments from Umami page tracking. Embedded website previews do not send Umami events.
  • Website analytics does not receive your extension bookmarks, notes, X session, or search queries.

How long data stays

  • Tweet detail cache stays for up to 30 days, then cleanup logic removes older entries.
  • Bookmark mutation event cache stays for up to 14 days.
  • GraphQL endpoint catalog entries stay for up to 30 days.
  • Auth headers are refreshed from live x.com traffic and may remain in local storage until session/auth state changes or you remove the extension.

Your controls

  • You can remove the extension at any time.
  • You can reset Totem local data from settings.
  • Reset local data clears bookmark and content caches plus most local state, but currently preserves auth and query metadata used for account continuity.
  • Optional permission grants are managed by Chrome. Turning a feature off in Totem stops using it, but does not automatically revoke the permission from Chrome.
  • To revoke optional permissions, use Chrome extension permission controls for Totem.
  • If you use Totem in another browser profile, that profile has its own X login, extension data, and optional permission grants.