Privacy Policy
Last updated: 2026-08-05
Tab Garden is a local-first browser tab manager extension. This policy explains how we (barely) handle your data and what you should know when using Supabase sync.
1. Local-first: data stays in your browser by default
All core features of Tab Garden (virtual groups, board layout, snoozed items, custom groups, domain rules) are stored only in the browser's local chrome.storage.local. We do not run any backend server that receives or stores your tab data.
2. No tracking, no analytics, no tab upload
Tab Garden contains no analytics SDK, tracking pixel, or third-party statistics code. The extension never auto-uploads or streams your currently open tabs. Your browsing history is never collected, transmitted, or sold.
3. Cross-device sync (optional)
If you want to sync settings, domain rules, board layout, and workspaces across devices, you must register and connect your own Supabase project. The sync credentials are yours; Tab Garden does not hold your Supabase secrets. Synced data is limited to: stable settings, domain rules, ignored-site lists, board group metadata, board layout metadata, and workspace snapshots (tab titles and URLs) you manually save.
4. Data scope and runtime IDs
Workspace snapshots store only tab titles and URLs, never runtime IDs (tabId, windowId). Runtime browser state (tabId, windowId, virtual board assignment keys) is stored locally only and never uploaded. The extension does not auto-upload your currently open tabs; only content you explicitly save as a workspace is synced.
5. Extension permissions
Tab Garden requests only these permissions: tabs (read tab titles and URLs for display in the board), storage (local settings and board data), and an optional Supabase host permission (used only when sync is enabled). The extension does not request tabGroups, history, bookmarks, cookies, webRequest, or any sensitive permission. Groups exist only in the board; chrome.tabs.group is never called.
6. Data export and deletion
You can export all local data as a JSON file from the extension options page. Removing the extension clears all local data. If you use Supabase sync, you can delete rows from tables such as user_settings in your own Supabase dashboard at any time.
7. Supabase RLS row-level security
Sync tables have row-level security (RLS) enabled, with policies based on auth.uid() = user_id to enforce data ownership. Only you, after authenticating, can read or write your own data. The service_role key never enters the extension or build artifacts.
8. Contact
For privacy-related questions, reach us via the feedback entry in the extension options page.