Tab Grove Privacy

Data-use principles

• We do not sell user data. Necessary data may be disclosed or transferred to service providers only to deliver product functionality or in permitted circumstances.
• We use or transfer user data only for Tab Grove’s single purpose: organizing, managing, backing up and optionally syncing saved collections.
• We do not use or transfer user data to determine creditworthiness or for lending purposes.

Chrome Web Store data-use restrictions

Tab Grove handles user information, including information obtained through Google APIs, under the Chrome Web Store User Data Policy and Limited Use requirements. Data is used only for the disclosed product features. Disclosure to providers is limited to feature needs, necessary security or legal requirements, never personalized, retargeted or interest-based advertising.

There is no routine human review. Human reading is limited to specific support content you explicitly authorize, necessary security purposes, legal requirements, or aggregated and anonymized internal operations in accordance with applicable privacy and legal requirements. These exceptions do not introduce advertising or behavioral analytics.

Read the official Limited Use requirements

Data categories and their specific scope

The seven categories below correspond to the Chrome Web Store’s current-or-future disclosure scope. Local and cloud processing are distinguished. A category does not mean every type of data within it is collected or that future payments are already enabled.

Personally identifiable information

Optional accounts use a stable Google subject identifier, verified email and internal account identifier. This version does not store profile photos or display names.

Authentication information

Client 0.12.3 stores Tab Grove access/refresh tokens locally with application-layer encryption. The server records token digests, session identifiers, necessary timestamps and revocation state. The local unlock password is not uploaded. We do not collect Google or browser-saved passwords or access Gmail or Drive.

Web history

Current-tab URLs, titles, windows, positions and pinned state support local display, selection and locating pages. Complete URLs you choose to save become collections. Only regular non-incognito HTTP/HTTPS pages are supported. We do not read Chrome’s past browsing history or upload the live open-tabs list.

User activity

Collection creation/modification times, operation receipts, backup reminders, session last-use times and trial-start times support collection and account management. There are no advertising or behavioral-analytics services. Local preferences and recovery records are not uploaded.

Website content

This is limited metadata: page titles, complete saved URLs and directories or collections you name. We do not collect page bodies, images, videos or form entries. Cloud sync includes confirmed saved collections and necessary metadata, not running-page state or the original bookmark tree.

Financial and payment information

Planned Alipay features involve orders, amounts, currencies, billing periods, transaction/refund status and identifiers, and entitlement records. Real payments are disabled. We do not collect card numbers, bank details or payment passwords. Retention and refund procedures still need confirmation before payment launch.

Location

The scope is connection IP addresses processed by the backend and hosting/network infrastructure for necessary security and in-memory rate limiting; an address may belong to a proxy. There is no GPS, precise-coordinate, nearby-device-information or IP-geolocation feature. Nginx access logs for the Tab Grove API are disabled. Necessary runtime output goes to systemd journal without a fixed retention period in days.

The extension has no health-information or personal-communication collection feature. It does not read your email or chat bodies, page bodies, cookies or browser-saved passwords. Messages you choose to send support are handled under the operating standard below; this does not give the extension access to your inbox. Bookmarks are copied only after you grant optional permission and confirm a preview; original bookmarks are not automatically deleted, moved or renamed.

1. Open tabs and saved collections

The toolbar and current-tabs panel read regular-window tab URLs, titles, positions, window identifiers, pinned state and incognito state to show, select and save pages or perform a closing action you explicitly choose. The live tab list is not uploaded to our account server; incognito tabs cannot be saved.

Saved directories, collections, complete URLs, titles, identifiers, timestamps and order are stored in the workspace. URL queries and fragments may contain search terms, access parameters or private-resource identifiers. We save links and metadata, not page bodies, forms or running-page snapshots. Only regular non-incognito HTTP/HTTPS pages can be saved; internal, extension and local-file pages and URLs with embedded credentials are excluded.

2. Local password, backups and accounts

Client 0.12.3 uses a local unlock password and AES-256-GCM to encrypt collections, account caches and sync baselines, sign-in credentials, undo/recovery records, content-bearing operation records and preferences. Set a password on first use or upgrade, then unlock once after a browser restart, extension update or reload. Normal background-worker suspension does not require another entry. Locking hides the workspace and pauses sync without closing open pages.

The password and decryption key are not persisted with product data or sent to Tab Grove servers or Google; the runtime key is limited to the current browser session. Exports are encrypted by default using the local password in effect when exported. Readable JSON requires explicit confirmation and must be protected by you. Encrypted imports verify the password and integrity before you preview and confirm a merge. If that password is forgotten, the corresponding encrypted backup cannot be unlocked either; recovery is limited to existing cloud collections or readable JSON backups.

Local preferences, limited undo/recovery records and backup information are not uploaded. Bookmark permission is requested as needed; you preview copying first, and original bookmarks are not automatically moved, deleted or renamed. Chrome manages browser-level bookmark sync. Current collections obtained from bookmark imports or backup restoration may be synced if you choose.

Optional Google sign-in requests openid, email and profile for authentication, recording a stable Google identifier, verified email, internal account, session-token digests and trial/entitlement times. We do not read Google passwords, Gmail or Drive. Account collections are isolated by account and backend address. Device lists represent login sessions, recording creation, last use, expiry and revocation rather than hardware, IP or User-Agent profiles.

3. Sync, region, providers and logs

You preview a merge before deciding whether to copy local collections into your account. Sign-in does not start a trial automatically. Cloud writes and cloud-history restoration require sync plus an explicitly started one-time 14-day card-free trial or active Pro. After expiry, local features remain available and existing cloud collections can be read with history previews.

Cloud sync includes saved directories, collections, complete page URLs, titles, identifiers, timestamps, order and deletion markers. It excludes live tabs, page content/state, forms, cookies, passwords, appearance preferences, the original bookmark tree and local recovery history. The account service runs on a DigitalOcean Droplet in Singapore, where account and synced data are stored. Google provides the authentication flow you choose; site icons come from Chrome's cache.

The backend and hosting/network infrastructure process connection IP addresses for necessary security and in-memory rate limiting, without GPS, precise-location, advertising or behavioral analytics. API Nginx access logs are disabled and error logs discarded. Necessary runtime logs go to systemd journal without a fixed retention period in days. Disabled access logs do not mean IP addresses are never processed.

4. Security, retention and deletion limits

Cloud data is transmitted over HTTPS. The Singapore server stores its database, temporary files, deletion ledger, operational keys and private configuration in a LUKS2 encrypted volume; disaster backups and the independent deletion ledger use AES-256-GCM. Cloud sync is not end-to-end encrypted: the server processes collections for sync, while human reading is limited to the Limited Use exceptions above. Local application encryption does not protect a compromised running device or establish physical erasure of historical Chrome files, vendor snapshots or old storage blocks.

Local collections remain until you delete them, clear extension data or uninstall. Local recovery holds at most five entries, sharing an 8 MiB limit with collections and single-step undo, rather than a fixed number of days. Cloud history is capped at 10 versions, 30 days and 32 MiB; any limit may remove older entries early. These are not retention periods for primary account data or disaster backups.

The server creates encrypted disaster backups daily and prunes hourly. Backups are retained for at most 30 calendar days from creation, pruned from age 29 days and rejected for restore at age 30 days. Deletion requests do not extend that lifetime. Recovery requires the current trusted deletion ledger; a missing ledger, wrong key or expired copy is rejected and restored-copy sessions are revoked. Offsite copies are maintained manually, updating the ledger, inventory and cleanup after deletions and during regular retention maintenance; continuous automatic offsite replication is not configured. After a server restart, manual unlocking is required, temporarily interrupting cloud login and sync. Already-unlocked local collections can still be managed and exported.

OAuth flows last five minutes, exchange codes 60 seconds, access tokens 15 minutes and login sessions at most 30 days. Expired temporary records are cleaned periodically, without guaranteed physical erasure at a specific second. Account identities, primary cloud collections, trial records and primary ledgers have no single automatic retention deadline; session expiry is not account-data deletion.

5. Data requests and deletion

Email the contact below for support or account-data requests. The owner responds within seven business days and verifies identity manually. Account and online cloud data are deleted within 30 calendar days after verification, rather than through instant automatic self-service deletion. Online deletion and final backup cleanup are separate steps. Unsettled data or legally required retention is verified separately, with its actual basis explained.

The current independent deletion ledger prevents old backups from restoring deleted accounts and must not be replaced by an old ledger. It stores only a keyed internal-account digest (HMAC) and deletion time, not raw Google identities, email addresses or collections. After relevant restorable copies have been checked and removed, the operator handles the minimal markers; the ledger is not discarded early.

You may stay signed out, export backups, pause sync, sign out or revoke sessions and bookmark permission. Signing out or revoking a session does not automatically erase local account caches or cloud data. Cloud account deletion does not remotely clear local collections, exports or Chrome bookmark copies; you must clear them separately. Deleting a directory moves its collections to the default directory without deleting the collections or their pages.

Email addresses, messages and minimal ticket evidence you choose to send support are used for replies and identity checks. Unnecessary content is manually cleared within 30 days after case completion, with any legally required extra retention explained. Do not send passwords, codes, payment passwords or complete private collections.

6. Payments, requests and changes

Payments are disabled, with no automatic renewal. Future checkout is planned for Alipay only; payment-data retention and refunds must be confirmed and the policy updated before launch. We do not collect card numbers, bank details or payment passwords. Requests involving paid, refunded, unsettled or uncertain orders require manual verification, without an unconfirmed multi-year or indefinite retention exception. The effective and updated date is shown on this page.

Contact and data requests

The owner manages the public mailbox directly for product questions, account-data requests and future refund questions, responding within seven business days. The account and online cloud data are deleted within 30 calendar days after identity verification. Payments remain disabled. Do not send passwords, verification codes, payment passwords or complete private collections.

nemo.wangxx@gmail.com