Privacy Policy
Effective Date: July 26, 2026
Last Updated: July 26, 2026
This Privacy Policy describes how Tabzo ("Tabzo", "Company", "We", "Us", or "Our") processes your information when you use our Chrome Extension, Web Application, and associated services (collectively, the "Service").
We are committed to protecting your personal information and handling it responsibly. By accessing or using Tabzo at https://tabzo.app or via our browser extension, you acknowledge the processing practices described in this Privacy Policy.
1. Information We Collect
We collect information directly from you, automatically through your interaction with our Service, and via third-party authentication providers.
- A. Data Collected directly and via the Chrome Extension
- Workspace & Tab Metadata: When you freeze or save a workspace, Tabzo collects the full URLs, page titles, favicons, and tab order of your open browser tabs. Tab history for restored or suspended sessions is generated automatically to manage your workspace states.
- URLs and Embedded Metadata: When saving workspace sessions, Tabzo collects the full page URLs you have open. Please note that certain web applications embed sensitive parameter data directly in URLs (such as document IDs, private share tokens, user identifiers, or access keys from platforms like Google Docs, Notion, or internal dashboards). Tabzo handles these URLs strictly as workspace configuration data, but users should avoid intentionally saving URLs containing temporary authentication tokens or other sensitive credentials.
- Workspace Content: For synced accounts, we store the content you input into your workspace tools, including the Markdown Scratchpad (notes, code snippets, documentation links) and Focus Micro-Tasks (checklists and task completion statuses).
- Chrome Storage API
(chrome.storage.local): For both anonymous and registered users, workspace data, preference settings, active tab states, and temporary caches are stored strictly on your local machine using Chrome’s chrome.storage.local API. We do not utilize chrome.storage.sync or chrome.storage.session.
- B. User Account & Identity Data
- Anonymous Accounts: Free Tier users may utilize Tabzo without providing an email address or password. In this mode, an anonymous identifier is generated to manage local workspace state and sync limits.
- Claimed & Registered Accounts: When you create or claim an account (to enable cloud syncing across devices or upgrade to paid tiers), we collect:
- Email address
- Profile information provided by third-party identity providers (e.g., name, profile picture, or unique OAuth ID if signing in via Google or future OAuth providers such as GitHub)
- Account credentials managed securely via NextAuth (e.g., hashed authentication tokens or Magic Link session tokens).
- C. Billing & Payment Data
- Payments are processed by Stripe. When you subscribe to a paid tier (Solo Pro or Team/Agency), Stripe collects your billing details, such as payment card information, billing address, and transaction details.
- Note: Tabzo does not store or process your raw credit card or banking details on our servers. Stripe handles all payment processing under its own privacy policy and compliance standards.
- D. System, Operational & Diagnostic Data
- Hosting & Telemetry: Our Web Application and API infrastructure are hosted on Vercel. Vercel automatically collects standard network server logs, which may include your IP address, browser type, operating system, timestamp, and HTTP request headers necessary for service delivery, security monitoring, and network performance.
2. Chrome Extension Permissions & Web Store Disclosures
To provide window freezing, taskbar naming, and workspace restoration, the Tabzo Chrome Extension requires specific browser permissions. Each permission is requested strictly for core app functionality:
- storage: Required to store workspace configurations, notes, tasks, and settings locally using
chrome.storage.local. - tabs: Required to query open tab URLs, page titles, favicons, and tab index positions to perform window freezing, restoration, and inter-op link jumping.
- windows: Required to create, close, and manage isolated browser window frames and inject project prefaces into OS window headers.
- cookies: Required to authenticate and maintain session synchronization between the Chrome Extension and the Tabzo Web Application.
- system.display: Required to detect display bounds and monitor configurations so restored workspace windows open seamlessly on the correct physical monitor.
Google Chrome Web Store Privacy Disclosure
- No Sale of Personal Information: Tabzo does not sell, rent, or trade your personal information or workspace data to third parties.
- No Advertising Use: Tabzo does not use, transfer, or disclose collected tab data or user information to serve targeted advertising, cross-site tracking, or credit/lending assessments.
- Single Purpose Usage: Data collected via Chrome Extension permissions is used exclusively to provide and improve Tabzo's core tab management functionality.
3. How We Use Your Information
We use the collected information for the following operational purposes:
- Core Service Delivery: To suspend, save, organize, and restore your browser tabs, as well as render your Index-0 Workspace Dashboard, Markdown notes, and micro-task lists.
- Account Management & Synchronization: To allow cross-device cloud synchronization of your workspaces, manage your account status (Anonymous vs. Claimed), and administer subscription tiers.
- Communication: To send essential account notifications, authentication links (Magic Links), subscription updates, and customer support communications via Brevo.
- Payment Processing: To enable Stripe to bill, manage, and verify subscriptions for paid tiers.
- Security & Infrastructure Maintenance: To protect against fraudulent usage, perform system maintenance, and ensure infrastructure stability via Vercel.
4. Legal Bases for Processing (GDPR)
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases established by Regulation (EU) 2016/679 (GDPR):
| Purpose / Processing Activity | Categories of Personal Data | Legal Basis under GDPR |
|---|
| Account Creation & Authentication | Email address, OAuth IDs, session tokens | Art. 6(1)(b) - Contract Performance: Necessary to create and manage your Tabzo user account. |
| Workspace Sync & Cloud Features | Tab URLs, page titles, favicons, Markdown notes, micro-tasks | Art. 6(1)(b) - Contract Performance: Necessary to deliver cross-device syncing and saved workspace features. |
| Subscription Management & Payment | Transaction records, payment tokens, billing details | Art. 6(1)(b) - Contract Performance & Art. 6(1)(c) - Legal Obligation: Necessary to fulfill your subscription and comply with statutory tax/accounting obligations. |
| Transactional Communications | Email address, account status, security alerts | Art. 6(1)(b) - Contract Performance: Necessary to send authentication links (Magic Links), service alerts, and account notices via Brevo. |
| System Security, Logging & Infrastructure | IP address, browser type, standard HTTP request headers | Art. 6(1)(f) - Legitimate Interests: Necessary to secure our Vercel infrastructure, prevent fraud, and maintain network stability (as recognized in GDPR Recital 49). |
| Customer Support & Assistance | Email address, support tickets, user-provided context | Art. 6(1)(f) - Legitimate Interests / Art. 6(1)(b) - Contract Performance: Necessary to respond to inquiries and assist you with technical issues. |
5. Third-Party Service Providers
We share necessary data with trusted third-party service providers strictly to operate, host, and maintain our Service. These third parties access your information solely to perform tasks on our behalf and are obligated not to disclose or use it for any other purpose:
| Provider | Purpose | Information Shared |
|---|
| Vercel | Cloud Infrastructure, Hosting & Backend API | System requests, IP addresses, application backend data |
| Stripe | Subscription Billing & Payment Processing | Billing name, email address, transaction history, payment tokens |
| Brevo | Email Delivery & Service Messaging | User email address, transactional email logs |
Future Analytics Notice
We do not currently deploy non-essential tracking or behavioral analytics cookies. However, we plan to integrate Google Analytics in future updates to better understand product usage patterns and improve user experience. When implemented, Google Analytics may collect anonymous device information, usage metrics, and IP addresses, and this policy will be updated accordingly.
6. AI Features & Future Services
Tabzo does not currently use third-party AI services to process user content.
7. Cookies and Local Browser Storage
Tabzo uses essential cookies and local browser storage necessary to operate the platform securely:
- Essential Authentication Cookies: Managed via NextAuthon our Web Application, including session cookies and CSRF tokens.
next-auth.session-token / __Secure-next-auth.session-token (Maintains your active logged-in user session).next-auth.csrf-token / __Host-next-auth.csrf-token (Protects against Cross-Site Request Forgery attacks).next-auth.callback-url (Stores redirect state during OAuth or Magic Link authentication).
- Local Storage: (
chrome.storage.local) Utilized by the Chrome Extension strictly on your local machine to store workspace caches, offline state, and settings.
We do not use third-party advertising cookies or cross-site behavioral tracking cookies.
8. Data Storage, Retention, and International Transfers
- Primary Infrastructure & Storage Location: Tabzo's web application, API infrastructure, and primary database services are hosted on Vercel. Data may be processed in the United States and other countries where our service providers operate.
- International Data Transfers: Personal data originating from the European Economic Area (EEA) or UK that is transferred to the United States is protected using the European Commission’s Standard Contractual Clauses (SCCs) or equivalent lawful transfer mechanisms implemented by our cloud providers (Vercel, Stripe, Brevo).
- Data Retention:
- Local Extension Data: Remains stored on your local device via
chrome.storage.local until you uninstall the Chrome Extension or manually clear your browser extension storage. - Cloud Workspaces: Saved workspace metadata, Markdown notes, and tasks associated with registered accounts are retained for as long as your account remains active.
- Account Deletion Options: You can delete your account directly through your in-app account settings for immediate automated removal, or request deletion by emailing support@tabzo.app. Upon account deletion, all associated cloud-synced workspaces, notes, and user profile records are permanently removed from our active databases, except where longer retention is strictly required by applicable law (e.g., financial transaction records retained for tax compliance via Stripe).
9. Account Claiming & Data Linking
Free Tier users operate with anonymous local accounts. If you choose to claim your account by signing in with an email address or OAuth provider:
- Your locally cached workspaces will be associated with your newly registered user account.
- This allows your tab states, Markdown scratchpads, and task lists to sync securely to our cloud database across different machines and browser instances.
10. Your Choices & Data Control
You have full control over your data within Tabzo:
- Data Export: You can export your saved workspaces, tab links, and notes at any time directly through the data export options in the Tabzo Web Application.
- Account Deletion: You may permanently delete your account and clear all cloud-synced workspaces instantly through your in-app Account Settings.
- Disable Cloud Sync: You can choose to use Tabzo on the Free Tier without creating an account, keeping all workspace data stored 100% locally on your machine via
chrome.storage.local. - Uninstall Extension: Uninstalling the extension generally removes its locally stored data. Users may also clear extension data through their browser settings.
11. European Privacy Rights (GDPR)
If you reside in the European Economic Area (EEA), you have the following rights regarding your personal data under the General Data Protection Regulation (GDPR):
- Right of Access: The right to request copies of your personal data.
- Right to Rectification: The right to request that we correct inaccurate or incomplete information.
- Right to Erasure ("Right to be Forgotten"): The right to request that we erase your personal data.
- Right to Restrict Processing: The right to request that we restrict the processing of your data.
- Right to Data Portability: The right to request that we transfer your collected data to another organization or directly to you in a structured format.
- Right to Object: The right to object to our processing of your personal data based on legitimate interests.
- Right to Withdraw Consent: Where processing is based on consent, you have the right to withdraw consent at any time without affecting prior lawful processing.
To exercise any of these rights, please contact us at support@tabzo.app. We will respond within the time required by applicable law (generally within one month under the GDPR).
12. Security Measures
We implement standard, industry-accepted security practices to safeguard your information:
- Encryption in Transit: All communications between the Tabzo Chrome Extension, Web Application, and Vercel cloud infrastructure are encrypted using standard
HTTPS/TLS protocols. - Secure Authentication: User authentication is managed using secure session tokens and industry-standard authentication mechanisms.
- Payment Security:Payment card details and financial transactions are processed entirely within Stripe’s PCI-DSS compliant environment.
While we take reasonable technical precautions to protect your data, no method of digital transmission over the internet or electronic storage can be guaranteed to be 100% secure.
13. Children’s Privacy
Tabzo is a general audience productivity tool designed for developers, researchers, and professionals. Our Service is not directed to children under the age of 13 (or 16 in certain jurisdictions). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us at support@tabzo.app so we can delete the information promptly.
14. Governing Law
This Privacy Policy and any disputes arising out of or related to the use of Tabzo shall be governed by and construed in accordance with the laws of Romania, without giving effect to any principles of conflicts of law.
15. Changes to This Privacy Policy
We may update our Privacy Policy from time to time to reflect changes in our technology, legal obligations, or product features. Any updates will be posted on this page with an updated “Last Updated” date at the top. We encourage you to review this Privacy Policy periodically. Continued use of the Service after any changes constitutes acceptance of the updated policy.
16. Contact Information & Data Controller
Tabzo is operated by its developer as an independent software project based in Romania. If you have any questions, concerns, or data deletion requests regarding this Privacy Policy or Tabzo’s privacy practices, please contact us at:
