Tabvora Privacy Policy

Effective Date: July 31, 2026 • Version 2.0.0

Summary: Tabvora operates on a local-first design. Tabvora stores locally your shortcuts, workspaces, notes, preferences, optional Draft Recovery data, website usage statistics, browser usage statistics, browser usage limits, and Digital Wellbeing settings. No personal information or user-generated data is transmitted to external servers.

1. Introduction & Core Principles

Tabvora is a local-first browser extension created for shortcut organization, custom workspaces, productivity tools, and browser navigation. We believe personal browsing data, shortcuts, scratchpad notes, usage stats, and local configurations belong entirely under user control. No user account or sign-in is required to use Tabvora.

2. What Data Is Stored Locally

Tabvora relies on browser-native local storage APIs (specifically chrome.storage.local, chrome.storage.session, and IndexedDB) to preserve dashboard data across browser sessions:

  • Shortcuts & Workspaces: Saved custom links, titles, custom workspace categories, colors, and layout order.
  • Quick Notes: Scratchpad text stored inside the local note widget.
  • Settings & Appearance: Selected themes, card sizing, grid gap density, corner radius, background options, widget choices (including Browser Usage Card), and default search choices.
  • Archive Data: Items manually archived from the primary shortcut grid.
  • Browser Usage Statistics & Limits: Locally calculated browser usage time and user-configured limit values.
  • Digital Wellbeing Settings: Local user preferences and session-based state timers.

3. Optional Privacy-Sensitive Features

To ensure absolute user choice, privacy-sensitive functionality is controlled via toggles inside extension settings and disabled by default where applicable:

  • Draft Recovery (Default OFF): Temporarily saves eligible unsaved text field inputs across tabs to prevent data loss from accidental closes. Snapshots remain stored locally inside IndexedDB and can be wiped or disabled at any time. Users can disable the feature or delete stored drafts at any time through the extension settings.
  • Website & Browser Usage Statistics (Default OFF): Locally calculates domain visit frequency, duration, and overall Chrome browser usage to render local statistics charts and optional dashboard usage cards. Data is calculated and retained strictly inside local browser storage and can be cleared by the user at any time.
  • Global Browser Usage Limit (Default OFF): Allows users to set a total daily browser usage threshold and receive local reminder popups when reached. All checks run locally without external communication.
  • Digital Wellbeing (Default OFF): Provides periodic wellness reminders (Eye, Stretch, Walk, and Long Break Reminders) to encourage healthy computer habits. Reminders run locally, rely solely on session-based timers, reset automatically when Chrome closes, and do not collect or upload health or profiling data. Digital Wellbeing reminders are productivity features only and are not intended to diagnose, monitor, treat, or provide medical advice.

4. What We Do NOT Collect

Tabvora enforces strict technical parameters. We do not collect, transmit, or record any of the following items:

  • Email addresses.
  • Account credentials or login passwords.
  • Passwords, PINs, or OTP authentication tokens.
  • Credit/debit card numbers, CVV codes, or financial inputs.
  • Personal identity documents, medical/health data, or biometric information.
  • Advertising identifiers, tracking cookies, or user fingerprinting parameters.
  • Remote logs, background telemetry, or cloud copies of browsing data.

5. Security & Sensitive Field Exclusion

When optional Draft Recovery is enabled, Tabvora screens active form inputs. Password inputs (type="password"), payment forms, credit card fields, hidden security tokens, and authentication paths are automatically excluded from local draft snapshots.

6. Browser Permissions Declared

Tabvora requests only the permissions listed in its manifest.json that are directly needed for implemented functionality. No permission is requested "for future use":

  • storage: Saves shortcuts, workspaces, notes, archived items, and user preferences to chrome.storage.local on this device only.
  • tabs: Reads the active tab so Tabvora can open shortcuts, determine which page is currently focused for the optional Website Usage Statistics feature, and support in-dashboard navigation. Page content is never read through this permission.
  • bookmarks: Reads your bookmarks only when you manually click "Import Bookmarks" to populate the shortcut grid. Never accessed automatically or in the background.
  • contextMenus: Adds right-click ("Add to Tabvora") menu options in the browser for saving shortcuts.
  • alarms: Used for scheduled local maintenance tasks such as service worker recovery, optional usage tracking, Digital Wellbeing reminders, and other background operations required by the extension.
  • favicon: Uses Chrome's built-in favicon API to display each shortcut's site icon locally, without contacting third-party favicon services.
  • host_permissions (http://*/*, https://*/*): Required only for optional user-enabled features such as Draft Recovery, Website Usage Statistics, Browser Usage Statistics, Browser Usage Limits, and website availability checks. Browsing data is never transmitted to Tabvora servers.

6a. Chrome Web Store Compliance

Tabvora's use of user data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements:

  • Data accessed through granted permissions is used only to provide and improve Tabvora's user-facing features described in this policy.
  • Tabvora does not sell or transfer user data to third parties.
  • Tabvora does not use or transfer user data for advertising, personalized ad targeting, or profiling, and does not use it for purposes unrelated to Tabvora's single purpose (a new-tab shortcut and workspace dashboard).
  • Tabvora does not use or transfer user data to determine creditworthiness or for lending purposes.
  • No humans read user data unless required for security purposes (e.g., investigating abuse), with the user's consent, or to comply with applicable law.

7. Network Usage

Tabvora does not upload user data to external servers. Tabvora does not operate backend servers for storing browsing data. Internet traffic occurs strictly through standard browser navigation when you intentionally:

  • Click a saved shortcut link to navigate to a website.
  • Click links to open the Official Website, Official Chrome Web Store page, GitHub Repository, Contact Page, Privacy Policy, or Report an Issue pages.

Some optional features (such as checking the availability of a saved website) may send a direct request from the user's browser to that destination website. Tabvora never proxies, receives, stores, or analyzes that network traffic.

8. Data Retention & User Control

Users retain full administrative control over stored local data. Through Extension Settings, users can:

  • Enable or disable optional features (Draft Recovery, Usage Statistics, Global Browser Limits, and Digital Wellbeing) at any time.
  • Clear saved Draft Recovery records or clear Usage Statistics logs instantly.
  • Individual shortcuts, notes, and archived items can be deleted at any time.
  • Perform a complete Factory Reset to clear all local Tabvora storage.
  • Draft Recovery automatically purges local records according to the retention period selected by the user, while Digital Wellbeing session data resets automatically when Chrome closes.
  • Uninstalling Tabvora removes extension-managed local data in accordance with Chrome's extension storage behavior.

9. Code Transparency & Supporting Resources

This repository contains public documentation, selected source files, and supporting resources. Public documentation and selected supporting resources are provided for transparency and community reference.

10. Core Privacy Guarantees

No user data is sold, rented, shared, or transferred to third parties for advertising, profiling, or analytics purposes.

Local First
100% device-level data retention
Zero Tracking
No background telemetry scripts
User Controlled
Optional features remain Default OFF
Manifest V3
Built using secure extension standards
No Cloud Sync
All user data remains on this device unless explicitly exported

11. Updates to This Policy

If changes are made to this Privacy Policy to reflect future extension updates, the Effective Date at the top of this document will be updated. All revisions will strictly maintain our local-first data architecture.

12. Resources & Contact

For questions, bug reports, or support, visit our official links: