Your privacy matters to us. Learn how we protect and respect your personal information.
Last updated: Jun 12, 2026
At PlugMonkey, we believe in transparency and putting you in control of your data. We collect only what's necessary and protect everything we handle.
PlugMonkey's Chrome extensions comply with the Chrome Web Store User Data Policy(opens in new tab), including the Limited Use requirements(opens in new tab). The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Concretely, this means: we use the personal or sensitive user data each extension handles only to provide or improve the user-facing feature that data was collected for; we do not transfer that data to others except as necessary to provide the extension's single purpose or to comply with applicable laws; we do not use that data for personalized, retargeted, or interest-based advertising; and no human at PlugMonkey reads your data except in the limited circumstances Google's policy explicitly permits (your explicit consent for support; investigating abuse; complying with law; or aggregated and anonymized internal operations).
Your data is processed locally in your browser - we don't store your X credentials or account content.
We only collect essential data needed to provide our services and improve user experience.
Clear information about what data we collect, how we use it, and your rights to control it.
Full control over your personal information with rights to access, correct, or delete your data.
Our privacy practices differ between our website and our Chrome extensions. This distinction is important for understanding how your data is handled.
Our website uses Google Analytics 4 with enhanced features for website analytics and advertising purposes. See details below.
Our Chrome extensions use only the official Google Analytics property provided by Google for telemetry, which is strict and minimal.
Three design choices govern how every PlugMonkey extension handles your data. They are deliberate and load-bearing — almost everything else follows from them.
Eight of our ten Chrome extensions store everythingin your browser's local storage and transmit no user-generated content anywhere outside the platform the extension targets. That is: X Unfollow Pro, Instagram Unfollow Pro, X Followers Exporter Pro, Instagram Followers Exporter Pro, LinkedIn Connection Remover Pro, Video Downloader Pro, Reddit Scout Pro, and TradingView Screener Pro all use only chrome.storage.local — never chrome.storage.sync.
The remaining two — Prompt Anything Pro and ReadMonkey Pro — use chrome.storage.sync only for compact per-user state that should travel with your Chrome profile across devices: in PAP, your API keys, custom templates, and default provider; in ReadMonkey, your article metadata (titles, URLs, excerpts, tags), reading prefs, and the text highlights and notes you make on saved articles. Sync storage is encrypted at rest by Chrome under your Google account. Large user-generated content — your prompt history in PAP, your saved article bodies in ReadMonkey — stays in chrome.storage.local on the device where you saved it. In PAP, the Personal Info store also defaults to local; Chrome sync is opt-in only.
You will never be asked to create a PlugMonkey account, sign in, or link an identity to use any of our extensions. PRO entitlements are represented as a license key you receive after purchase — a short string the extension stores locally and validates against license.plugmonkey.xyz periodically. We do not maintain user profiles, behavioral histories, cohort tags, or any other server-side record beyond what is strictly required to validate a license. This is a deliberate architectural choice: we cannot leak data we never collect in the first place.
Our extensions do not opportunistically send your data anywhere. The only third-party data flow that exists across the product line is the one in Prompt Anything Pro, and even there, it is always user-initiated and user-configured: you choose which AI provider to use, you supply your own API key for that provider, and only then are your prompts routed to that provider on the requests you yourself trigger.
For everything else — features, browsing, in-extension activity — we do not share, sell, broker, or otherwise transmit your data to any third party. The telemetry mentioned elsewhere in this policy is the Chrome Web Store's official extension analytics program, which Google provides to all extension developers for aggregate usage diagnostics; we don't add additional analytics packages on top of it inside the extensions.
Anonymous usage statistics to help us improve our extensions
12 months
Product improvement and analytics
Purchase details and license keys for Pro users
Lifetime of license
License validation and support
Processed locally - not stored on our servers
Local only
Extension functionality
Our website (plugmonkey.xyz) uses several analytics and advertising tools to understand website usage, improve our services, and deliver relevant advertising. All tracking respects your consent preferences.
We use Google Analytics 4 through Google Tag Manager to analyze website traffic and user behavior. The following features are enabled:
Your Control: Access and delete associated data via Google's My Activity(opens in new tab). Opt out of personalized ads via Google's Ad Settings(opens in new tab).
We use PostHog for product analytics to understand how users interact with our website. PostHog collects:
Your Control: PostHog respects your consent preferences. You can opt out through our cookie consent banner or by contacting us.
We use the X (Twitter) pixel for advertising and conversion tracking. This helps us:
Your Control: The X pixel respects your consent preferences. You can opt out of X personalized ads through X's privacy settings(opens in new tab).
We use Google Tag Manager to manage and deploy tracking tags on our website. GTM itself does not collect data but helps us organize our analytics and advertising tools.
Important: All website tracking tools listed above apply only to our website (plugmonkey.xyz). Our Chrome extensions do not use these tools and only use minimal, strict Google Analytics tracking as provided by Google's official extension analytics program.
PlugMonkey ships several Chrome extensions and they do different things — so their data flows differ too. The lists below describe the baseline that applies to every extension. For the specifics of each extension (what is stored, what is transmitted, and to whom), see the Per-Extension Data Practices section immediately below.
Beyond this baseline, individual extensions may store additional information you configure (e.g. API keys, custom templates, saved profile fields), and may transmit content you author (e.g. AI prompts) to third-party services you yourself choose. All such specifics are disclosed per-extension below.
Each PlugMonkey Chrome extension below has its own data practices. Where an extension routes user-authored content to a third-party service (e.g. an AI provider you supply credentials for, or the platform the extension acts on), that service is named explicitly along with what is sent, when, and why. Use the jump bar to skip to a specific extension; expand "Show full data flow" on any card for the stored/transmitted/not-shared/your-controls breakdown.
AI prompting, inline writing assistant, and multi-input form auto-fill. By design, the user supplies their own API key for a cloud AI provider — or chooses an on-device option — and the extension routes prompts to whichever provider the user picked.
Bulk unfollow tool for X (formerly Twitter). Operates inside your already signed-in X session: a content script running on x.com / twitter.com captures the Bearer and CSRF tokens X itself issued to your browser, and the extension uses those tokens to call X's own API on your behalf to perform unfollow (and follow) actions you initiate. The extension does not ask for your X password and does not log you in — it piggy-backs on your existing browser session. No X tokens, cookies, or follower-list data are ever transmitted to PlugMonkey servers.
Bulk unfollow tool for Instagram. Operates inside your already signed-in Instagram session: a content script running on instagram.com reads your Instagram numeric user ID directly from the `ds_user_id` cookie Instagram itself sets in your browser, and captures the `x-csrftoken` and `x-ig-app-id` headers Instagram's web app uses for its own API calls. The extension then uses those values to call Instagram's own internal API on your behalf to perform unfollow (and follow) actions you initiate. The extension does not ask for your Instagram password and does not log you in — it piggy-backs on your existing browser session. No Instagram tokens, cookies, or following-list data are ever transmitted to PlugMonkey servers.
Export your X (formerly Twitter) followers and following lists to CSV. Operates inside your already signed-in X session using the same MAIN-world page-script auth pattern as X Unfollow Pro: a content script on x.com / twitter.com captures the Bearer and CSRF tokens X itself sends with its own API calls, and the extension uses those tokens to call X's own API on your behalf to page through your followers / following lists. The collected data is then rendered to a CSV file generated entirely in your browser (Blob URL → hidden anchor with `download` attribute → your browser's native Downloads folder). The CSV never leaves your machine — there is no upload step, no server-side processing.
Export your Instagram followers and following lists (or any public account's) to CSV. Operates inside your already signed-in Instagram session: the extension reads the `ds_user_id` cookie Instagram itself sets and uses your existing session to call Instagram's own internal GraphQL and Web API endpoints on your behalf, paging through the follower / following list. The collected data is then rendered to a CSV file generated entirely in your browser (Blob URL → hidden anchor with `download` attribute → your browser's native Downloads folder). **The exported CSV is never transmitted anywhere — no upload step, no server-side processing, no PlugMonkey involvement after the rows are fetched from Instagram.** The auth surface is simpler than other PlugMonkey Instagram tools: no `declarativeNetRequest` permission, no MAIN-world page script — the extension relies on `credentials: 'include'` on its outbound fetches so Instagram's own session cookies are sent automatically by the browser.
Bulk-cleanup tool for LinkedIn connections and follows. Operates inside your already signed-in LinkedIn session: the extension reads the `JSESSIONID` cookie LinkedIn itself sets in your browser (via Chrome's `chrome.cookies` API) and uses it as the CSRF token LinkedIn's web app requires on its own internal API calls. The extension calls LinkedIn's internal Voyager API on your behalf, with `credentials: 'include'` so your session cookies are sent automatically. Two distinct actions are supported, neither of which is autonomous: "Remove Connection" fully ends the connection both ways; "Unfollow Profile" keeps the connection but stops their posts appearing in your feed. The extension does not ask for your LinkedIn password and does not log you in.
Detects videos on the page you are viewing and lets you download them to your own Downloads folder. The content script inspects the current page's DOM and (on a small set of platforms — Twitter, Vimeo, Dailymotion, Instagram, Twitch, Reddit, Facebook, TikTok, AliExpress, Bunny Stream) calls that platform's own public/oembed/metadata endpoints from your browser to resolve a downloadable URL. The actual download request goes from your browser (or the extension's service worker, for HLS/DASH segment assembly) straight to the video host — **never via PlugMonkey servers, and the downloaded file is never uploaded anywhere**. YouTube is explicitly excluded by the manifest. Pages identified as end-to-end-encrypted messengers (e.g. web.whatsapp.com) are refused — the extension renders an explanatory message and skips detection.
A periodic Reddit keyword monitor for sales/marketing/community-research use cases. You configure a list of keywords and (optionally) subreddit groups in the side dashboard; a background `chrome.alarms` cycle (interval depends on free vs PRO tier) queries Reddit's public search endpoints (`https://www.reddit.com/search.json` or `https://www.reddit.com/r/{sub}/search.json`) with those keywords as the `q` parameter, dedups results against a locally-stored `seenIds` set, stores fresh matches under `chrome.storage.local`, and fires local `chrome.notifications` for new matches. The content script runs ONLY on `*.reddit.com/*` (not on `<all_urls>`) and is purely visual — it highlights your configured keywords inside the Reddit page DOM via a Shadow-DOM highlighter. **No browsing history, no Reddit account credentials, no scan results, and no exported leads are ever transmitted to PlugMonkey.** Note: this extension's automatic scan is currently degraded because of Reddit's 2026 Responsible Builder Policy update (the legacy `.json` endpoints it queries are being deprecated); the extension is undergoing Reddit developer approval — when approved, the underlying scan endpoint will be migrated to Reddit's OAuth-authenticated API, but the data-flow shape (Reddit → your browser → local storage; PlugMonkey not involved) will not change.
A reading-list and distraction-free reader. You explicitly save a page (popup button, Alt+Shift+S, or right-click context menu); the extension uses `chrome.scripting.executeScript` against the active tab to read the page's `<article>` (or `<main>`) `outerHTML`, builds a clean reader view, and stores it locally. Reading-list **metadata** (titles, URLs, excerpts ≤ 150 chars, tags, your reading settings, your highlights) is written to `chrome.storage.sync` so it can follow your signed-in Chrome profile across devices; the **full article body** (HTML and plain text), the local search index, and per-article scroll position stay in `chrome.storage.local` on the device that captured it — **never synced, never transmitted to PlugMonkey**. The extension does not have `<all_urls>` host permission; it only acts on a tab when you explicitly invoke save via the popup, keyboard command, or context menu.
Side-panel quant screener and watchlist tool that talks directly to TradingView's public scanner API. The content script reads `document.body.innerText` on the page you are viewing to find ticker-shaped tokens (e.g. `$AAPL`, `BTC`, `EURUSD`) via a regex filtered against a common-words blocklist; the extracted ticker symbols (and **only** the extracted symbols — never the surrounding page text) are sent to `scanner.tradingview.com` to look up price, market cap, and rating data, which is shown to you in a non-intrusive toast on the page and in the side panel. Watchlist, recent scans, and PRO alert state live in `chrome.storage.local` on your device. PRO users get a 15-minute `chrome.alarms`-driven watchdog that re-scans their watchlist via the same TradingView endpoint and fires local `chrome.notifications` when configured conditions trigger — the alert content is composed on-device and never sent off-device. **No page text, no page URL, no watchlist contents, no alert configuration, and no scan results are ever transmitted to PlugMonkey.**
You type a domain into the popup or dashboard; the extension POSTs that domain to PlugMonkey's own backlinks API (`https://backlinks.plugmonkey.xyz/api/backlinks`) and renders the list of linking domains it returns. The architecture is intentionally minimal: just the `storage` permission, no `<all_urls>`, no content scripts, no cookies, no DNR. Results are cached locally in IndexedDB for 7 days (keyed by data-release + domain) so re-checking the same domain doesn't re-hit the API. **Unlike the other extensions, the user-typed query DOES travel to a PlugMonkey-hosted server** — that's the whole point of the tool — so this entry discloses the request body, what gets logged on our side, and what doesn't.
To provide and maintain our extensions
To improve our extensions based on usage patterns
To verify Pro licenses and provide support
To respond to your requests and provide updates
Most of the data processing for our extensions happens locally in your browser. We do not store your social media credentials or account content on our servers.
For the limited data we do store (such as license information), we implement appropriate security measures to protect against unauthorized access, alteration, disclosure, or destruction of your personal information.
Request access to information we have about you
Request correction of inaccurate information
Request deletion of your information
Withdraw consent for data processing
To exercise these rights, please contact us using the information provided at the end of this policy.