appreciate the scrutiny here. these are important discussions, and weβd love to be active contributors to the broader conversation around the future of social interoperability and privacy.
from the beginning, Pulse was designed around data minimization and user-controlled verification.
thatβs why we built browser-based verification around zkTLS - so users can prove specific off-platform claims without handing over their credentials or exposing entire account datasets.
the post brings together several very different parts of Pulse: privacy-preserving verification, X-native analytics, and anti-abuse infrastructure. we want to clarify how each of them actually works.
more importantly, weβll be open-sourcing Kaito Pulse this week so anyone can inspect the code and verify.
a few clarifications:
1. browser-based verification is powered by zkTLS.
zkTLS allows Pulse to verify a specific off-platform claim while minimizing the underlying information disclosed to Kaito.
when you start a verification, Pulse uses only the account data required to generate a cryptographic attestation. once complete, we receive the resulting attestation, rather than a general copy of your account data or browsing history.
2. ChatGPT, Claude, Binance and other supported verification sites are only used for verification when you explicitly initiate one.
these optional, user-initiated verification features will roll out over the coming days and weeks as part of our broader vision to bring verified off-platform activity into the native X experience.
no verification is initiated, and no verification data is sent to Kaito, unless you explicitly choose to start one - as our friend Ultra also noted in his reply.
once initiated, as described in point 1, the verification flow accesses only the account data required to generate the requested proof. we then receive only the resulting attestation rather than a general copy of your account data or browsing history.
3. Pulse does collect interaction data on X - and we explicitly ask for permission to do so during onboarding.
Pulse is an X-native extension. it measures signals such as what content is shown, dwell time, and user interactions. this data is used for functionality, product analytics, and attention measurement within the X experience.
Pulse does not send your general browsing activity elsewhere on the web to Kaito.
it also does not capture your screen or passwords, or record what you type.
this distinction is important: X functionality is native and ongoing while you use X, while off-platform verification is optional, user-triggered, and purpose-specific.
4. some users are seeing a Chrome permission message suggesting that Pulse can read and write data across all websites.
to clarify, Pulseβs read/write functionality is used on X, where it is required to integrate features directly into the native X experience β including trading positions on the timeline, Smart Followers, sentiment, and other Pulse features.
the permission scope currently shown by Chrome is broader than how Pulse actually uses those permissions. weβre correcting this in the next version so the permissions shown to users more accurately reflect the productβs behavior.
5. device fingerprinting is used solely for anti-abuse.
Pulse uses device-level signals to combat farming, Sybil behavior, automated scraping, and other forms of abuse. device- and browser-level signals are commonly used across websites and online services for fraud and abuse prevention.
these signals are used solely for anti-abuse purposes and are not used for analytics or other purposes.
=============
ultimately, these are exactly the kinds of questions users should ask of any browser extension β especially one trying to build a new layer between social identity and what people do across the internet.
our vision for Pulse has always been to make the internet more interoperable, verifiable, and privacy-preserving: allowing people to bring what they build, trade, create, and achieve across platforms into their social identity, without having to hand over more data than necessary.
we also believe infrastructure like this should be built in the open.
thatβs why Kaito Pulse will be open source this week. anyone will be able to inspect what the extension does, challenge our assumptions, suggest improvements, and contribute to the discussion around how this kind of social and verification layer should work.
weβre still early, and weβd love for everyone to be part of the conversation as we build it.
so i was looking at the source code of kaito pulse and found some interesting things:
- it fingerprints your device. it hashes how your gpu renders an invisible image, your gpu model, and how your hardware handles a test tone. that combo is unique to your laptop and it doesn't change
- it goes up with your twitter id attached, so every x account you use on that laptop points back to the same machine
- they can see what you see and replay your whole session. every post your feed served you including the ones you scrolled straight past, how many milliseconds you spent on each, every click, follow and unfollow, and a ping every 30 seconds with idle detection so they know exactly when you were on and for how long. not just your timeline either, it covers your search results and your bookmarks
- it reads your claude and chatgpt subscriptions, which plan you pay for and what percent of your rate limit you've burned (not your conversations though)
- on chatgpt it opens your settings page and clicks through to Usage by itself
- on binance it clicks the Positions tab for you, then re-sends your logged in requests to read wallet balances, futures positions, pnl, and deposit and withdrawal history
- the zktls is a fork of a project called primus
the 12 domains it runs on:
- markets: binance, okx, bybit, hyperliquid, lighter, polymarket, tradexyz, variational
- ai: chatgpt, claude
- social: X (all the telemetry is here)
- kaito (only site allowed to talk to the extension)