Privacy Policy
Last updated: July 9, 2026
自动薯 ("XHS Auto", "the Extension", "we", "us", or "our") is a Chrome extension that helps users automate interactions on Xiaohongshu (小红书, xiaohongshu.com). This Privacy Policy explains in detail what user data the Extension collects, how it uses that data, where the data is stored, and with which third parties it is shared. By installing or using the Extension you agree to the practices described below.
1. Summary (At a Glance)
- The Extension reads the Xiaohongshu pages you visit in order to automate the actions you request (for example: auto-comment, auto-like, auto-favorite, AI-generated reply).
- The Extension reads your Xiaohongshu login cookies so that it can act on your behalf while you are signed in.
- Your user-configured settings (AI prompts, keyword filters, schedules, automation rules) are stored locally in your browser via
chrome.storage.local.
- When you trigger an AI-powered feature (such as generating an automated comment), the Extension sends the relevant Xiaohongshu post/reply text to a third-party AI provider (a Chinese large-language-model API of your choice) over HTTPS, solely to produce the reply.
- Activity logs (a history of actions performed by the Extension on your behalf) and license/subscription status may be sent to our self-hosted backend over HTTPS for sync, fraud prevention, and customer support.
- We do not sell your personal data. We do not share your data with advertisers or data brokers.
2. Data We Collect
The Extension collects the following categories of data. Each item is linked to a specific feature of the Extension; if you do not use a given feature, the related data is not collected.
2.1 Data you provide directly
- License / subscription key (if you purchase a paid plan): the activation code you enter inside the Extension popup. We use it to verify your entitlement on our backend. We do not collect your name, billing address, or payment-card details — payments are processed by the third-party payment processor shown at checkout.
- User-configured settings: AI system prompts, keyword/audience filters, schedules, accounts to operate on, and other options you enter into the Extension UI.
2.2 Data collected automatically when you use the Extension
- Xiaohongshu session cookies: cookies set by xiaohongshu.com that keep you signed in. The Extension reads these cookies only on xiaohongshu.com and only in order to perform automation actions as you.
- Xiaohongshu page content: the text of posts, comments, and other content visible to you on xiaohongshu.com that the Extension needs to read in order to perform the automation you requested.
- Activity logs: a record of actions the Extension performed on your behalf (timestamp, action type, target post/comment ID, success/failure).
- Extension settings and state: stored locally in
chrome.storage.local on your device (see Section 4).
2.3 Data we do not collect
- We do not collect your name, email, phone number, address, government ID, or any other contact information unless you voluntarily send it to us through support.
- We do not collect your payment-card or banking details. Payments are handled by our third-party payment processor.
- We do not collect your browsing history on websites other than xiaohongshu.com.
- We do not use tracking pixels, advertising SDKs, or cross-site analytics.
3. How We Use Your Data
We use the data described above only for the following purposes:
- To operate the Extension's core features: automation of comments, likes, favorites, and replies on Xiaohongshu.
- To generate AI replies: when you request an AI-generated comment or reply, the relevant Xiaohongshu text is sent to your selected AI provider so that the provider can return a generated reply. We do not retain the prompts on our servers.
- To verify your license / subscription: if you purchase a paid plan, we verify your activation key against our self-hosted backend.
- To provide customer support: when you contact us, we use the information you provide to respond.
- To prevent abuse and fraud: to enforce license terms, prevent unauthorized redistribution, and protect the service.
- To improve the Extension: aggregated, non-identifying diagnostics (for example, feature usage counters) may be used to fix bugs and prioritize improvements. We do not associate these counters with your identity.
We will not use your data for advertising, profiling for automated decisions that produce legal or similarly significant effects, or any purpose unrelated to operating the Extension.
4. How We Store and Protect Your Data
- Local storage on your device: user settings, automation rules, keyword filters, and on-device activity history are stored in
chrome.storage.local. This data lives only on your computer and is removed when you uninstall the Extension or clear its storage.
- Our self-hosted backend: when license verification or cloud sync is enabled, the following items are stored on our server, associated with your license key: license status, activation timestamp, last-seen timestamp, and (if cloud sync is enabled) a copy of your activity logs.
- Transmission: all data transmitted between the Extension, our backend, and third-party AI providers is sent over HTTPS / TLS 1.2+.
- Retention: we retain server-side data only for as long as your license is active or as long as needed to provide support. You can request deletion at any time (see Section 8).
- Security: access to our backend is restricted to authorized personnel, protected by authentication and audit logging. No system is 100% secure, but we use commercially reasonable safeguards.
5. Who We Share Your Data With (Third Parties)
We share data only with the categories of recipients listed below. We do not sell, rent, or trade your personal data.
5.1 AI service providers
To generate AI-powered replies, the Extension sends the relevant Xiaohongshu text to a Chinese large-language-model API provider selected by you in the Extension settings. Common providers include (but are not limited to): Alibaba Cloud 通义千问 (Qwen), Baidu 文心一言, DeepSeek, Zhipu 智谱 GLM, ByteDance 豆包, and similar services. The data sent is the post/reply text needed as context for generation; it is transmitted over HTTPS to the provider's API and used solely to return the generated text. Each provider processes the data under its own privacy terms — please review the privacy policy of the AI provider you select.
5.2 Payment processor
If you purchase a paid plan, payment is handled by a third-party payment processor (for example, a domestic Chinese payment provider such as 微信支付 / 支付宝, or an international provider such as Stripe). We receive only the transaction status and license key — we do not receive your card or bank-account details.
5.3 Hosting and infrastructure providers
Our self-hosted backend runs on infrastructure operated by reputable cloud providers (for example, Alibaba Cloud, Tencent Cloud, or similar). These providers may process server logs (such as IP address and request timestamps) for the purpose of providing hosting services.
5.4 Legal disclosure
We may disclose information if required to do so by law or in response to a valid legal process (court order, subpoena, or equivalent governmental request), or to protect our rights, your safety, or the safety of others.
5.5 Business transfers
If we are involved in a merger, acquisition, or sale of assets, user data may be transferred as part of that transaction. We will notify affected users where required by law.
We do not share your data with advertising networks, data brokers, marketing platforms, or social-media trackers.
6. Chrome Permissions We Use and Why
- Host permissions for xiaohongshu.com: required to read page content and your login session in order to perform the automation you requested.
- cookies permission: required to read your existing xiaohongshu.com session cookie so the Extension can act as you while you are signed in. We do not modify cookies set by xiaohongshu.com.
- storage permission: required to save your settings, automation rules, and activity history locally via
chrome.storage.local.
- activeTab / scripting: required to inject the Extension's automation logic into the active Xiaohongshu tab when you click the Extension action.
- alarms / notifications (if used by scheduled automation): to run scheduled tasks and show completion notifications.
7. Children's Privacy
The Extension is not intended for children under 16, and we do not knowingly collect personal data from children. Xiaohongshu itself has age restrictions in its terms; users below the minimum age should not use the Extension.
8. Your Rights and Choices
- Uninstall: uninstalling the Extension removes all data stored locally via
chrome.storage.local and revokes all Chrome permissions.
- Clear local data: you can clear the Extension's local storage from the Chrome extensions page at any time.
- Disable cloud features: you can disable license sync and cloud history from the Extension settings; in that mode, no data is sent to our backend.
- Access, correction, deletion: you may request a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Contact us at kan831019@gmail.com.
- AI opt-out: you can disable AI-generated replies in the Extension settings; in that mode, no page content is sent to any AI provider.
9. International Data Transfers
Our backend and the AI providers we integrate with may be located in different jurisdictions (including the People's Republic of China and other regions). By using the Extension you understand that your data may be processed in these jurisdictions. We rely on the contractual and technical safeguards described in Section 4 to protect your data in transit and at rest.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. If the changes are material, we will make a reasonable effort to notify users (for example, by an in-Extension notice or a notice on our homepage). Continued use of the Extension after a change indicates acceptance of the updated policy.
11. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us: