Extension Privacy Policy

Wannalead ("we") provides APIs for LinkedIn, Instagram, X and Facebook. The extension connects a user's existing sessions to Wannalead so that requests made through the product can run from that user's own browser.

The extension has one purpose: connect the user's already-authenticated social network sessions in their browser to Wannalead, and execute the requests the user asks for through the Wannalead API. It does nothing else.

• LinkedIn session cookies (presence and metadata). The extension reads whether the LinkedIn authentication cookies (li_at, JSESSIONID) are present in the browser and derives the session validation token required by LinkedIn. This is used to (a) confirm the user is logged into LinkedIn and (b) execute the user-requested LinkedIn requests with the user's own session. Cookie values are never logged. Only presence flags and a non-reversible hash of the cookie set are sent to Wannalead to detect session changes.
• LinkedIn request results. When the user requests a LinkedIn action through Wannalead, the backend sends the extension a fully-resolved request (method, LinkedIn URL, allowed headers). The extension performs that request against linkedin.com using the user's session and returns the raw response to Wannalead so the product can parse and return it to the user.
• Instagram session status, when enabled. Instagram access is optional and off by default. After the user enables it in the popup, the extension checks whether the required Instagram session cookies are present and live. It then executes only allowlisted reads and workspace-enabled writes requested through Wannalead, returning the response needed for the request, private mirror, or campaign. It does not send raw Instagram cookie values.
• X session and requested content, when enabled. X access is optional. The extension keeps X cookies in Chrome and sends only account/status metadata and requested results to Wannalead. These include posts, messages, image uploads and Articles, and the private mirror of messages, mentions, connections and post metrics. Campaigns use the texts and targets you supply. Public animation parameters for request IDs are cached locally for up to 24 hours; downloaded scripts are read as text and never executed. Images are transferred in bounded chunks and expire from temporary upload storage.
• Facebook session and requested results, when enabled. Facebook access is optional and off by default. The extension checks whether the Facebook sign-in cookies are present and unexpired. After the user pairs the account, it sends the non-secret numeric Facebook account identifier and connection status to Wannalead. It executes only signed, allowlisted requests for that account when an enabled workspace requests a read or an individually confirmed action. The requested response returns to Wannalead for parsing. Facebook cookie values and local CSRF tokens stay in Chrome. No Facebook mirror or bulk campaign is run.
• Messenger, when you turn it on. A separate, optional switch in the popup grants the scripting permission. For one Messenger action your workspace requested (list or read conversations, send one approved message, accept or delete one message request) the extension opens that page on www.facebook.com in a background tab, runs a function shipped in the extension and closes the tab. It reads only what Messenger shows you, including end-to-end encrypted conversations this browser can already decrypt. Opening a conversation marks it as seen.
• Messenger PIN, only if you opt in. You may type your Messenger PIN in the popup and tick "remember my Messenger PIN on this device". It is encrypted with a non-extractable key and kept only in this browser's extension storage; it is never sent to Wannalead or anyone else, never synced and never logged. The extension types it only into Messenger's own PIN screen. A PIN Messenger rejects is deleted at once; "Forget" (next to the saved PIN) or turning Messenger off deletes it.
• Local extension state (chrome.storage): pairing state, extension connection identifier, service endpoint, and last-known status metadata.

• It never asks for or stores the user's LinkedIn, Instagram, X or Facebook password.
• It never injects UI into LinkedIn, Instagram, X or Facebook pages and never reads arbitrary browsing history. The only page code it runs is the packaged Messenger action above, in a facebook.com tab it opened itself.
• It never executes remote code. The backend sends data (which request to run), never executable code.
• It does not sell user data, does not use it for advertising, and does not transfer it to data brokers.

Data is sent over encrypted connections to Wannalead servers (wannalead.co): authentication status for enabled networks, browser/extension metadata, and the payloads needed to fulfil the user's requests. A paired Facebook account's numeric identifier, requested raw responses and bounded results are included. Instagram, X and Facebook cookie values are not sent. Facebook raw responses are kept in the gateway's local result spool for up to seven days; normalized results are stored with workspace-scoped jobs. Data is used solely to provide the Wannalead product to that user (Limited Use). We retain it only as long as needed to provide the service and honor deletion requests.

Every network request is fulfilled in-flight from the connected user's own session, bounded by what that user can already see and do from their own account. We do not pool, cross-reference, resell, or maintain a shared dataset across users, and we do not perform cross-account lookups. Data obtained through one user's session is used only to provide the Wannalead product to that same user.

Our use of data received from the extension complies with the Chrome Web Store Limited Use policy: data is used only to provide and improve the user-facing features of Wannalead; it is not sold, not used for ads, and not transferred except as required to operate the service or by law.

Uninstalling the extension stops all data collection. Users can disable the optional Instagram, X or Facebook access in onboarding or the popup, revoke a network session from that network's settings, and request deletion of their data by contacting us.

support@wannalead.co