Tab Grove Privacy

Data-use principles

• We do not sell user data. Necessary data may be disclosed or transferred to service providers only to deliver product functionality or in permitted circumstances.
• We use or transfer user data only for Tab Grove’s single purpose: organizing, managing, backing up and optionally syncing saved collections.
• We do not use or transfer user data to determine creditworthiness or for lending purposes.

Chrome Web Store data-use restrictions

Tab Grove handles user information, including information obtained through Google APIs, under the Chrome Web Store User Data Policy and Limited Use requirements. Data is used only for the disclosed product features. Disclosure to providers is limited to feature needs, necessary security or legal requirements, never personalized, retargeted or interest-based advertising.

There is no routine human review. Human reading is limited to specific support content you explicitly authorize, necessary security purposes, legal requirements, or aggregated and anonymized internal operations in accordance with applicable privacy and legal requirements. These exceptions do not introduce advertising or behavioral analytics.

Read the official Limited Use requirements

Data categories and their specific scope

The seven categories below correspond to the Chrome Web Store’s current-or-future disclosure scope. Local and cloud processing are distinguished. A category does not mean every type of data within it is collected; the actual payment status is explained below.

Personally identifiable information

Optional accounts use a stable Google subject identifier, verified email and internal account identifier. This version does not store profile photos or display names.

Authentication information

The Tab Grove extension automatically encrypts access/refresh tokens locally. The server records token digests, session identifiers, necessary timestamps and revocation state. The local key and old passwords used for legacy migration or old-backup imports are not uploaded. We do not collect Google or browser-saved passwords or access Gmail or Drive.

Web history

Current-tab URLs, titles, windows, positions and pinned state support local display, selection and locating pages. Complete URLs you choose to save become collections. Only regular non-incognito HTTP/HTTPS pages are supported. We do not read Chrome’s past browsing history or upload the live open-tabs list.

User activity

Collection creation/modification times, operation receipts, backup reminders, session last-use times and trial-start times support collection and account management. There are no advertising or behavioral-analytics services. Local preferences and recovery records are not uploaded.

Website content

This is limited metadata: page titles, complete saved URLs and directories or collections you name. We do not collect page bodies, images, videos or form entries. Cloud sync includes confirmed saved collections and necessary metadata, not running-page state or the original bookmark tree.

Financial and payment information

When you choose to create or query an order, purchase, renew manually or request a refund, we process necessary account-linked orders, amounts/currency, purchased terms, order status, creation/expiry/payment/refund times, merchant order numbers, transaction/refund identifiers, payment-event digests and entitlement status for payment verification, billing, reconciliation, refunds and prevention of duplicate grants. Payment is completed at Alipay checkout. We do not store card numbers, bank details, payment passwords or raw payment-notification bodies.

Location

The scope is connection IP addresses processed by the backend and hosting/network infrastructure for necessary security and in-memory rate limiting; an address may belong to a proxy. There is no GPS, precise-coordinate, nearby-device-information or IP-geolocation feature. Nginx access logs for the Tab Grove API are disabled. Necessary runtime output goes to systemd journal without a fixed retention period in days.

The extension has no health-information or personal-communication collection feature. It does not read your email or chat bodies, page bodies, cookies or browser-saved passwords. Messages you choose to send support are handled under the operating standard below; this does not give the extension access to your inbox. Bookmarks are copied only after you grant optional permission and confirm a preview; original bookmarks are not automatically deleted, moved or renamed.

1. Open tabs and saved collections

The toolbar and current-tabs panel read regular-window tab URLs, titles, positions, window identifiers, pinned state and incognito state to show, select and save pages or perform a closing action you explicitly choose. The live tab list is not uploaded to our account server; incognito tabs cannot be saved.

Saved directories, collections, complete URLs, titles, identifiers, timestamps and order are stored in the workspace. URL queries and fragments may contain search terms, access parameters or private-resource identifiers. We save links and metadata, not page bodies, forms or running-page snapshots. Only regular non-incognito HTTP/HTTPS pages can be saved; internal, extension and local-file pages and URLs with embedded credentials are excluded.

2. Local encryption, backups and accounts

The Tab Grove extension generates a local AES-GCM key and stores it as a non-exportable CryptoKey in local IndexedDB to encrypt collections, account caches, access/refresh credentials, recovery records and local state containing user content. The key is not uploaded to Tab Grove servers or Google. The key and ciphertext remain in the same Chrome profile. This is not user-password protection, hardware protection or end-to-end encryption, and does not guarantee resistance to complete-profile copying or an already-compromised running device. Cloud collections remain processable by the server. Fresh installs and normal use require no local password; only legacy migration or deliberate import of an old encrypted backup may handle an old password locally, without uploading it.

Existing encrypted 0.12.3 data migrates automatically when a valid legacy session is available. If an update cleared that session, the old password is needed once to migrate old data. Failed migration preserves the original data; normal use after migration requires no routine unlocking. Only deliberately importing an old encrypted backup requires the password used for that old export.

The default export is ordinary readable JSON with no password. It contains collections and display settings, without authentication credentials. Anyone holding the file can read its complete page URLs, titles and collection names; keep it private. Imports are still validated and previewed before you confirm the merge. Export files are not automatically uploaded or turned into cloud backups.

Local preferences, limited undo/recovery records and backup information are not uploaded. Bookmark permission is requested as needed; you preview copying first, and original bookmarks are not automatically moved, deleted or renamed. Chrome manages browser-level bookmark sync. Current collections obtained from bookmark imports or backup restoration may be synced if you choose.

Optional Google sign-in requests openid, email and profile for authentication, recording a stable Google identifier, verified email, internal account, session-token digests and trial/entitlement times. We do not read Google passwords, Gmail or Drive. Account collections are isolated by account and backend address. Device lists represent login sessions, recording creation, last use, expiry and revocation rather than hardware, IP or User-Agent profiles.

3. Sync, region, providers and logs

You preview a merge before deciding whether to copy local collections into your account. Sign-in does not start a trial automatically. Cloud writes and cloud-history restoration require sync plus an explicitly started one-time 14-day card-free trial or active Pro. After expiry, local features remain available and existing cloud collections can be read with history previews.

Cloud sync includes saved directories, collections, complete page URLs, titles, identifiers, timestamps, order and deletion markers. It excludes live tabs, page content/state, forms, cookies, passwords, appearance preferences, the original bookmark tree and local recovery history. The account service runs on a DigitalOcean Droplet in Singapore, where account and synced data are stored. Google provides the authentication flow you choose; site icons come from Chrome's cache.

The backend and hosting/network infrastructure process connection IP addresses for necessary security and in-memory rate limiting, without GPS, precise-location, advertising or behavioral analytics. API Nginx access logs are disabled and error logs discarded. Necessary runtime logs go to systemd journal without a fixed retention period in days. Disabled access logs do not mean IP addresses are never processed.

4. Security, retention and deletion limits

Cloud data is transmitted over HTTPS. The Singapore server stores its database, temporary files, deletion ledger, operational keys and private configuration in a LUKS2 encrypted volume; disaster backups and the independent deletion ledger use AES-256-GCM. Cloud sync is not end-to-end encrypted: the server processes collections for sync, while human reading is limited to the Limited Use exceptions above. Local application encryption does not protect a compromised running device or establish physical erasure of historical Chrome files, vendor snapshots or old storage blocks.

Local collections remain until you delete them, clear extension data or uninstall. Local recovery holds at most five entries, sharing an 8 MiB limit with collections and single-step undo, rather than a fixed number of days. Cloud history is capped at 10 versions, 30 days and 32 MiB; any limit may remove older entries early. These are not retention periods for primary account data or disaster backups.

The server creates encrypted disaster backups daily and prunes hourly. Backups are retained for at most 30 calendar days from creation, pruned from age 29 days and rejected for restore at age 30 days. Deletion requests do not extend that lifetime. Recovery requires the current trusted deletion ledger; a missing ledger, wrong key or expired copy is rejected and restored-copy sessions are revoked. Offsite copies are maintained manually, updating the ledger, inventory and cleanup after deletions and during regular retention maintenance; continuous automatic offsite replication is not configured. After a server restart, manual unlocking is required, temporarily interrupting cloud login and sync. Local collections can still be managed and exported without a routine local password.

OAuth flows last five minutes, exchange codes 60 seconds, access tokens 15 minutes and login sessions at most 30 days. Expired temporary records are cleaned periodically, without guaranteed physical erasure at a specific second. Account identities, primary cloud collections, trial records and primary ledgers have no single automatic retention deadline; session expiry is not account-data deletion.

5. Data requests and deletion

Email the contact below for support or account-data requests. The owner responds within seven business days and verifies identity manually. Account and online cloud data are deleted within 30 calendar days after verification, rather than through instant automatic self-service deletion. Online deletion and final backup cleanup are separate steps. Unsettled data or legally required retention is verified separately, with its actual basis explained.

Deletion requests involving payments, refunds or unsettled orders require manual review. Account and online cloud-content deletion still follows the 30-calendar-day standard after identity verification. The owner will handle minimum settlement, refund and accounting records required for necessary financial matters separately from account/cloud-content deletion. Such retention does not justify keeping cloud collections or unrelated Google sign-in identity. Scope and duration follow the actual financial-archiving basis, necessary processing and unresolved disputes, with records reviewed and removed accordingly; raw business orders and all identity data are not automatically treated as accounting vouchers. Self-service or automatic financial separation is not offered, and unconditional erasure is not promised.

The current independent deletion ledger prevents old backups from restoring deleted accounts and must not be replaced by an old ledger. It stores only a keyed internal-account digest (HMAC) and deletion time, not raw Google identities, email addresses or collections. After relevant restorable copies have been checked and removed, the operator handles the minimal markers; the ledger is not discarded early.

You may stay signed out, export backups, pause sync, sign out or revoke sessions and bookmark permission. Signing out or revoking a session does not automatically erase local account caches or cloud data. Cloud account deletion does not remotely clear local collections, exports or Chrome bookmark copies; you must clear them separately. Deleting a directory moves its collections to the default directory without deleting the collections or their pages.

Email addresses, messages and minimal ticket evidence you choose to send support are used for replies and identity checks. Unnecessary content is manually cleared within 30 days after case completion, with any legally required extra retention explained. Do not send passwords, codes, payment passwords or complete private collections.

6. Payments, requests and changes

Pro pricing is CNY 9.90 for one month or CNY 79 per year (12 months), with the same features. Renewal is manual, with no automatic charges. Alipay is the only payment method. Cloud writes and cloud-history restoration require Pro or an explicitly started, one-time 14-day card-free trial. Local features remain free after expiry; existing cloud collections stay readable and cloud history can be previewed.

When you choose to create or query an order, purchase, renew manually or request a refund, we process necessary account-linked orders, amounts/currency, purchased terms, order status, creation/expiry/payment/refund times, merchant order numbers, transaction/refund identifiers, payment-event digests and entitlement status for payment verification, billing, reconciliation, refunds and prevention of duplicate grants. Payment is completed at Alipay checkout. We do not store card numbers, bank details, payment passwords or raw payment-notification bodies.

Contact nemo.wangxx@gmail.com within seven days of successful payment to request a manual full refund for that order. Arrival follows Alipay processing; an instant refund is not promised. A refund removes only that order’s paid entitlement. Local collections, backups and the original trial remain. Duplicate charges or services not provided are handled separately.

Contact and data requests

The owner manages the public mailbox directly for product questions, account-data requests and order/refund questions, responding within seven working days. Account and online cloud-content deletion follows the 30-calendar-day standard after identity verification. Payments, refunds or unsettled orders require manual financial review; the owner will handle minimum necessary financial records separately from cloud content. Do not send passwords, verification codes, payment passwords or complete private collections.

nemo.wangxx@gmail.com