Slop Smash privacy policy
Effective 28 October 2026 ยท Contact, privacy requests and misuse reports: immadiuttej4@gmail.com
The short version. Slop Smash lets you rate posts on X and see what other people thought. Post text never leaves your browser. Before you agree, nothing leaves your browser at all. After you agree, we receive the IDs of posts near your screen (to look up their scores) and your ratings (signed by a pseudonymous key made on your device, with a per-post code from your network block that is deleted within 7 days). We have no accounts and never see your X handle. You can turn sharing off or delete your data from the popup at any time.
Who we are
Slop Smash is a browser extension and a small web service run by its developer (the "controller" for this data). Slop Smash is not affiliated with X Corp.
What happens before you agree
Nothing is sent anywhere. The extension can show quick on-device hints on posts, and your smashes are kept on your device (for your own stats and so you can undo them), never sent.
What we process after you agree
- Score lookups. The numeric IDs of X posts shown on or near your screen are sent to our server so it can return their community scores. These requests carry no identifier and are not stored. Like any web server, ours sees your IP address while handling the request; we don't store it with lookups.
- Your ratings. When you rate a post, we receive the post ID, the category you chose (AI slop, engagement bait, low effort, rage bait or actually good) and the time. Each rating is signed by a key pair generated on your device. We store the public key and an ID derived from it, and which posts that key rated, so each install gets one vote per post and you can change or undo it. If you undo a rating, we keep a blank record that this key once rated the post (so the vote can't be re-cast at full weight later). This record isn't linked to your X account, name, email or any other identity.
- Network codes. To stop one group of people counting as many, each rating stores a 16-bit code computed from your network block (the first three parts of an IPv4 address, or the first 32 bits of IPv6) together with that post's ID, using a secret key. The same network gets the same code on the same post and unrelated codes on different posts. One code on its own matches hundreds of networks, but someone holding both our database and our secret key could combine the codes from several of your ratings to work out your network block. We never do this, and to limit the risk the codes are deleted within 7 days of each rating. For sign-up limits we also keep a keyed hash of your network for at most 48 hours. We never store your IP address.
- Trust and abuse signals. Per-key counters of how many ratings you made in the last minute, ten minutes and day (for rate limits), how many posts your key has rated in total, when it was created (to the day, after 2 days), whether and when it became established (a week old with 10+ ratings, on 3+ days, of posts that people on other networks rated too; this check uses the network codes while they exist), and per rating whether your key was established at the time. Each post also keeps, per category, counts of its raters for each network code, which go with the codes after 7 days. These decide how much a rating counts.
What stays on your device
- Your settings, stats, streaks, your most recent 5,000 ratings (so the extension can show what you rated) and how many of the posts you saw looked like slop (used only for your own weekly stats).
- The private half of your key, stored so it can't be exported.
- On-device AI (Chrome's built-in Gemini Nano, when your device supports it) reads post text locally to estimate a score. That text is never sent to us or anyone else.
What we never collect
Post text, images or links; the authors of posts; your X account, handle, followers, likes or messages; the addresses of pages you visit; your location beyond the network codes above. We don't use advertising or analytics SDKs.
Why we use this data
Only to show community and AI scores on posts, record your ratings, let you change or remove them, and prevent abuse. We don't sell data, use it for ads, build profiles of people (the per-key rating history above is used only to weigh votes and, when someone reports misuse, to check whether the keys that rated the reported posts acted together; keys that did can be banned, which removes their ratings), make credit decisions, or use it to train AI models.
Limited Use. The use of information received from Slop Smash complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.
Who else sees it
- Cloudflare hosts our service (Workers and D1) and processes requests, including IP addresses in transit, on our behalf.
- Everyone, as totals only. Per-post totals (for example "41 people rated this, mostly AI slop") are shown to every user, and daily totals per category are public. Neither can be traced to you.
- Our email provider, if you email us: it receives your message and address. We use misuse reports (to immadiuttej4@gmail.com) and the post IDs in them only to look into the report, and delete them within 12 months.
- No one else. We have no other third parties.
How long we keep it
| Data | Kept for |
|---|---|
| Request nonces (anti-replay) | about an hour |
| Per-post network codes, and the per-network counts made from them | deleted within 7 days of the rating |
| Sign-up counters per network | up to 48 hours |
| Exact time of a rating, and of your key's sign-up, rate-limit windows and trust checks | at most 3 days, then only the day is kept |
| Your ratings and public key | until you delete them, or 12 months after your last rating |
| Per-post totals and daily category totals | kept, anonymous (daily totals up to 400 days) |
| Misuse reports you email us | up to 12 months |
| Data on your device | until you delete it or uninstall |
Our database host (Cloudflare D1) keeps automatic point-in-time backups for up to 30 days, which we can't switch off. Deleted data can stay in those backups for up to 30 days after it is deleted; we only use them to recover from failures.
Your choices
- Say no at setup. The extension then works in local-only mode.
- Turn sharing off any time with "Community scores" in the popup.
- Delete my data in the popup removes your ratings and key from our server, resets your stats on the device, and turns sharing off. Per-post totals that included your ratings are recalculated without them (a post still keeps the day it was first rated, when it last changed, and network-diversity counts frozen after its first week, none of which identify you). Public daily counts (such as "12,408 posts rated today") are not, because they can't be traced to anyone.
- Uninstalling removes the data on your device, but not your ratings on our server, so use "Delete my data" first. If you've lost access, email us and we'll help.
Security
All traffic uses HTTPS. Ratings are signed with your device key and protected against replay. The private key can't be exported from the browser. Our servers don't log request bodies.
Your rights
We rely on your consent, which you can withdraw at any time. Wherever you live (including under GDPR, UK GDPR and CCPA), you can ask us to access or delete your data. Most of this is self-serve in the popup, or you can email immadiuttej4@gmail.com. Slop Smash isn't directed at children under 13 (or under 16 where that applies).
Changes
If we change what we collect, we'll update this page and ask for your consent again inside the extension before anything new is sent.