Privacy Policy
Effective 2026-10-11
This policy explains what personal data Tabilinks — the browser extension and the website tabilinks.app — processes, why, for how long, and what rights you have. We collect as little as the service needs, we do not sell data, and we do not use it for advertising profiles.
Who is responsible
The controller of your personal data is:
Matej Kovac, sole trader
Registration number (IČO): 21870781
Kaprova 42/14, 110 00 Praha 1, Czech Republic
Email: [email protected]
Write to that address with any question about your data or to exercise any of your rights.
Using the extension without an account
The extension works without an account. Your links, groups and settings then stay in your browser's own storage and are never sent to us. The extension reports only an anonymous count of opened new tabs, which is added to a daily total and cannot be linked to you.
- The side panel on the new tab page lists the tabs open in your browser; that list is read from the browser when the panel is drawn and is never stored or sent anywhere.
- Recently closed tabs are recorded by default, and browsing history only if you turn it on; both are kept in your browser's storage, and both can be turned off in Settings → Privacy, which also deletes what was recorded.
- Incognito windows are not recorded unless you allow the extension there.
What we process when you have an account
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Username, email address, display name | To create and run your account, and to send the activation and password-reset emails | Contract, Art. 6(1)(b) |
| Password | Stored only as a one-way hash; nobody can read it back | Contract, Art. 6(1)(b) |
| Google account identifier and email, if you sign in with Google | To recognise you when you sign in with Google | Contract, Art. 6(1)(b) |
| Your devices: a device name and the browser name, when each was last used | To keep each installation signed in and to let you see and sign out your devices | Contract, Art. 6(1)(b) |
| What each installation of the extension holds: the names of its profiles and workspaces, how many groups, subgroups and links each workspace has, and whether it synchronises - including data that does not synchronise. Never a link, its address or a group name | To show you on the website, device by device, what synchronises and what stays on the device over a limit | Contract, Art. 6(1)(b) |
| Sign-in tokens, activation and reset codes | Stored only as hashes, to keep you signed in and to confirm emailed links | Contract, Art. 6(1)(b) |
| Your synchronised content: workspaces, profiles, groups, links, their titles and descriptions; recently closed tabs (address, title, icon address, device name, time closed) unless you turned them off; and, only if you turned it on, your browsing history - the most recent visited pages (address, title, icon address, device name, time visited), at most 50 on a free account and 1000 on premium. The tabs currently open in your browser are never sent | The synchronisation and backup you use the account for | Contract, Art. 6(1)(b) |
| Premium status: plan, paid-until date, amount and currency charged, and the payment provider's customer, order and subscription identifiers | To give you the premium features you paid for | Contract, Art. 6(1)(b) |
| A count of failed sign-in attempts | To protect your account from password guessing | Legitimate interest, Art. 6(1)(f) |
We never receive or store your card or bank details.
You can also sign in without synchronising, by unticking "Synchronise this browser" when you sign in or in the extension's menu - for example to use premium on a browser whose links should stay on it. That browser then exchanges with us only what keeps it signed in: your sign-in, its device name, its inventory as described above, and whether your account is premium. Your links, closed tabs and history stay in the browser.
Visitors of the website
- Registration limit. A random, anonymous visitor token limits how often one browser can register or check whether a username is taken, to stop abuse. We store only its hash, and delete it once it expires. Legal basis: legitimate interest, Art. 6(1)(f).
- Visitor statistics. Each browser is counted at most once a day into a total number of visitors. We store only the daily total — no address, identifier or browsing history. Legal basis: legitimate interest, Art. 6(1)(f).
- Technical data. Delivering pages and answering requests necessarily involves your IP address and browser details. The address is held briefly in memory to limit how many requests one source can send; we do not store it in our database.
- Currency suggestion. Cloudflare tells us which country a request comes from, derived from your IP address, and we use it only to show prices in the currency that fits you — euros in the EU and EEA, the United Kingdom and Switzerland, US dollars elsewhere. The country is not stored or logged. Legal basis: legitimate interest, Art. 6(1)(f).
Who else receives data
We use these providers, only for the purpose given:
- Cloudflare (Cloudflare, Inc., USA) sits in front of the website and our servers, protecting them from attacks and delivering pages, and forwards emails sent to our support address. It processes your IP address, your requests and, for support emails, their content. Cloudflare is certified under the EU–US Data Privacy Framework.
- Brevo (Sendinblue SAS, France) delivers our emails — activation and password reset. It receives your email address and the content of the message.
- Google processes your sign-in if you choose "Sign in with Google", under Google's privacy policy.
- Creem is the reseller and Merchant of Record for premium purchases. It collects your payment details, name, email and billing address itself, as a controller of that data, under Creem's privacy policy. It tells us only what we need to activate your premium features.
Our servers and database run in the European Union. Cloudflare may process requests outside the European Economic Area, relying on the EU–US Data Privacy Framework and the European Commission's standard contractual clauses; where Google or Creem do, they rely on their own safeguards, described in their policies.
How long we keep data
- Your account and everything tied to it — devices, tokens, synchronised content, premium status — is kept until you delete the account.
- Deleting the account on the Account page erases all of it immediately and permanently. You can also ask us to do it by email.
- Visitor tokens are deleted when they expire; activation and reset codes stop working when they expire or are used.
- Daily statistics contain no personal data and are kept indefinitely.
- Recently closed tabs and browsing history roll: the oldest entries are deleted as new ones arrive. Turning either off in Settings → Privacy deletes it at once, on every device and on our servers.
- Invoices and payment records are kept by Creem, as the seller, for as long as tax law requires.
Your rights
Under the GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict or object to its processing, and to receive it in a portable form. Most of your data is visible and editable on the Account page, and you can delete the account there yourself. For anything else write to [email protected]; we answer within one month.
You also have the right to lodge a complaint with a supervisory authority — in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz), or the authority of the EU country you live in.
Other things you should know
- We make no automated decisions with legal or similar effect on you.
- The extension regularly asks our server whether your account is premium. If our server cannot be reached for a long time while you are premium, it checks whether your internet connection works by requesting https://www.gstatic.com/generate_204 (Google) and https://1.1.1.1/cdn-cgi/trace (Cloudflare). Nothing about you is sent with those requests, beyond what any request to a server reveals, such as your IP address, and they are never made while our server answers.
- Free versions of the extension show a small banner at the bottom of the new tab page. Today it shows only our own offer of premium; if a third-party advertising network is ever added, this policy will be updated first.
- The service is not directed at children under 16.
- Browser storage used by the website is described in the Cookies statement.
Changes
When this policy changes we update the date at the top. If a change affects how we use data you have already given us, we will tell account holders by email before it takes effect.