Who operates this service
Block Slop and its community reporting service are operated by Pulkit Gupta. Contact infiplextech@gmail.com for privacy questions. This extension is independent of X Corp.
What stays on your device
Breakout detection reads post timestamps, visible engagement statistics and author handles from the X page you have open. Its settings and per-author pace samples are saved in your browser's local storage for x.com. Your cached report choices, community-sharing preference, community-collapse preference and minimum-report threshold, and random installation credential are saved in extension-owned browser storage. These local settings and pace samples are not uploaded to the community service.
Optional community reports
Community sharing starts off. While it is off, hiding or restoring a post stores your choice in this browser. Enabling sharing later does not upload private hides. After you choose “Enable community reports,” the extension registers a random installation credential and requests report counts for visible post IDs. When you explicitly mark or undo a mark, it sends that post ID and your choice. These requests go to the Block Slop community service hosted on Cloudflare.
- Sent with sharing enabled: visible post IDs used for count lookups, explicit report or undo choices, and the installation credential used to authenticate requests.
- Stored by the service: a one-way hash of the installation credential and its creation time; reported post IDs linked to that hash; and report creation times. The original credential is not stored by the service.
- Count lookups are processed to return totals and whether your installation has reported a post. Lookup IDs are not separately added to a browsing-history table.
- Not sent in report-count or voting requests: post text, author names or handles, your X username, X login credentials, X cookies, private messages, or the breakout detection history. Shared-list publishing sends only the handles and post IDs you explicitly enter, as described below.
Report totals represent installation reports, not verified unique people. Reports are subjective opinions about quality, not proof that a post was AI-written. Community totals do not collapse posts by default. If you enable “Collapse community-reported posts” and set a minimum report count, posts meeting that count collapse locally while sharing is on. You can reveal any collapsed post. Your own reports collapse content independently of the community threshold. The extension does not post, reply, like, follow, or file a report with X on your behalf.
Optional lifetime Pro and checkout
Basic breakout indicators are free. Pro adds filtering and shared blocklists for a one-time US$4.99 price, plus applicable taxes shown at checkout. Dodo Payments hosts checkout and processes payment details and the buyer email under its own policies. Card details are not entered into the extension or our server. The checkout states whether it is a test or live payment.
When you enter a license key, the extension sends it to our service for product-bound activation and validation with Dodo Payments. The key is kept in extension-owned local storage for revalidation. Activation and validation use HTTPS request bodies. Dodo may append a license key and email to its post-payment return URL; the completion endpoint immediately redirects to a clean URL without those parameters and uses no-store and no-referrer headers. The service stores only a hash of the key, provider license and activation identifiers, product/business/environment identifiers, verification time and active status. It does not retain the raw key or customer fields from Dodo responses. Checkout session IDs and URLs are cached for ten minutes for retry handling, then cleaned up daily. Paid access is periodically revalidated; successful refunds disable license keys through Dodo. Deactivating a browser releases its activation when the provider accepts the request and does not refund a purchase or erase provider commerce records.
Shared blocklists
Publishing a list sends the list name, the public handles and post identifiers you explicitly enter, and your authenticated browser identity. Anyone who has its share ID and applicable access can retrieve the list; there is no public directory. List ownership can be associated with the verified license hash so the same license can restore ownership on another browser. Following sends only the chosen list ID and browser identity. Matches are applied locally; the list service does not receive which posts matched your followed lists.
Lists and subscriptions remain until you change or remove them. Archiving a list stops its distribution and application but retains entries for restoration. Removing a browser identity removes that browser's subscriptions; licensed publisher lists remain available to their owner. Contact us for permanent erasure of an owned list. Turning the local followed-list switch off restores content without changing your X account. These lists never call X's account-blocking API.
Network data and abuse prevention
As with any network request, your IP address and connection metadata reach Cloudflare, which hosts the service. Application code uses the Cloudflare-provided IP address only to derive a secret-salted digest that changes each UTC day. It stores the digest in short-lived quota counters, not the raw IP address. Installation hashes are also used for quota counters.
Quota windows last one minute or one hour. Expired counters are scheduled for deletion daily; with the scheduled cleanup operating normally, a counter is retained for at most about 25 hours from creation. A failed cleanup can extend that period until the next successful run.
Retention and deletion
Installation records and reports remain in the live database until you undo the report or delete your shared reports. Turning sharing off stops further community requests and disables community-based collapsing; it does not delete previous reports. Your own cached report marks remain until you undo them or delete shared data. “Delete my shared reports” removes your reports from the live database, disables sharing, clears cached shared marks, and preserves separate private choices. If this browser has a stored Pro license, its identity and license settings are retained so reporting deletion does not consume another activation. Otherwise its random browser identity is removed too. License deactivation and shared-list management are separate controls. Short-lived quota counters are removed on the cleanup schedule described above.
Use the deletion control before uninstalling or clearing extension storage if you want to remove shared reports. The random credential is the only way to authenticate ownership of an installation; if it is lost, individual reports cannot be linked back to you through an X account or email address. Provider-managed database recovery copies may retain deleted records under Cloudflare's retention and recovery policies until those copies expire.
Logs, providers and data use
Worker application observability is disabled. Application code does not log request bodies, credentials, IP addresses or post IDs. Cloudflare may separately process and retain infrastructure, security, account and billing records under its own policies; disabling application logs does not disable all provider processing.
Cloudflare processes data to host and secure this service, including its Workers and D1 products. Dodo Payments separately processes optional checkout and licensing data; see Dodo Payments privacy policy. See Cloudflare's privacy policy. The extension has no advertising or analytics SDK. We do not sell this data, use it for advertising, or use it to determine creditworthiness or lending eligibility. Shared reports are used to provide report counts, maintain your choices and prevent abuse.
Chrome Web Store Limited Use
Block Slop’s use of user data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use browsing data only to provide the feed features described in this policy.
Your choices and changes
You can keep community sharing off, turn it off later, undo individual reports, or delete your installation's shared data. Browser controls let you remove local extension data; X site-data controls separately manage local breakout settings and samples. Privacy questions can be sent to the contact above without including your installation credential. If data handling changes, this policy and the extension's disclosures will be updated before the changed behavior is released.