Privacy Policy

Tab Atlas works locally. Optional Sync sends an encrypted copy of your saved collection to a service only after you enable and confirm it. Open browser tabs and browser history are not part of Sync. Tab Atlas has no advertising or usage analytics and does not sell your data.

Optional features depend on your installed version. Sync is available from version 1.3.0; the optional Telegram integration described below is prepared for version 1.4.0. Neither feature is enabled merely by installing an update.

What Tab Atlas stores locally

Time machine recording is enabled by default. Tab Atlas automatically records changes to folders, active saved links and their order locally, including saves from the popup and page context menu while the dashboard is closed. Archived links are excluded from ordinary snapshots and the timeline. You can pause or turn off recording in its options menu; that choice is kept after restarting. Browser tab activity, browsing history, website contents, settings, scroll positions and manual workspace snapshots are excluded. No Chrome browsing-history permission is requested.

Snapshots and the protected return point for Undo are stored in the separate tab-atlas-collections-history IndexedDB database. Desktop history has a 200 MiB accounted payload budget and is trimmed towards 160 MiB as it fills, keeping the latest protected return point. The mobile budget adapts to available browser storage and may be smaller. There is no fixed maximum age; available depth depends on collection size and changes. Physical database overhead and browser origin quotas apply separately. You can pause or turn off recording, or explicitly clear snapshots and protected Undo from Time machine options → History storage. Clearing history leaves current folders, saved links, archive and browser tabs unchanged. Regular backup files do not include history. Removing the extension or clearing this site's data can remove its local history.

Restoring changes active Atlas collections and protects the exact preceding state separately for durable Undo, including the prior archive state of reactivated links. Restored links return active to their original folder without duplicating the same currently archived identity. Other current archived links stay unchanged. Undo after newer edits requires confirmation and protects those newer edits too. A restore receipt, collection revision and generation are stored locally to recover interrupted operations. Older collection history is migrated to active-only snapshots while preserving recorded moments and protected Undo data. Opening a saved historical link is a separate action in the current normal browser window; restoration does not create browser windows or record browser activity.

Saving a page from the toolbar popup or the page context menu stores its title and URL in your chosen folder on this device. One latest quick-save result and Undo record are retained locally so you can undo the save after reopening the popup. After you confirm a popup save or invoke the page context menu, a temporary notification is inserted into that page using access granted by your action. It removes itself afterward, does not extract website content, and makes no network requests. A local copy of your theme and sound settings keeps feedback consistent with the dashboard. Save and Undo sounds are packaged locally and can be disabled with Sound.

When you use the save, folder, workspace, theme, or shortcut features, Tab Atlas stores the relevant data using Chrome's local storage (chrome.storage.local), the browser's localStorage and IndexedDB. The mobile app uses IndexedDB for its collection and pending changes. This may include:

• URLs and page titles of tabs you explicitly save for later or archive
• Folder names and the pages you file into them
• Workspace snapshots (window layouts and the tabs they contain)
• Your theme choice, privacy-mode state, and editable shortcuts

This remains on your device unless you explicitly enable Sync or share or export a copy. Workspaces, open browser tabs, Time machine, theme and sound preferences are excluded from Sync.

What Tab Atlas does not do

• No analytics or telemetry
• No advertising
• No sign-in or collection uploads for local-only use
• No tracking cookies; Sync credentials are kept in the device's local vault
• No upload of open browser tabs or Chrome browsing history
• No remote fonts or favicon services; the main app uses packaged scripts. Optional sign-in verification loads the provider's scripts on a separate origin.

Optional Telegram reading queue

Telegram is off until you connect it. Tab Atlas uses its own registered Telegram application parameters; users do not register an application or enter API keys. Signing in by QR and, when required, your Telegram two-step password authorizes a Telegram session on this device. The authorization key and related session state stay in a separate local IndexedDB database. The password is used during sign-in and is not retained in saved collections, backups or Sync.

After you select a bot conversation, Tab Atlas reads forwarded messages in that conversation to save their source link, channel identity/name, message identifier, publication time and a short title extracted from the forwarded text. It deletes the forwarded copy in that conversation only after the import is durably saved. The original channel post is unchanged. Tab Atlas sends no bot replies and does not import your other conversations or automatically subscribe to channels.

Opening a saved post retrieves its text and requested media directly from Telegram. Telegram receives the authenticated requests and normal network metadata. Text and media are held temporarily for reading, rather than stored as an Atlas content archive. Photos can load automatically; larger and other attachments require an action. Files you explicitly download remain in your browser's download location. An unavailable source can be opened in Telegram instead.

Only the saved link, extracted title, source metadata and read state become collection data, including local history and exported backups. If you enable Sync, those fields are encrypted with the rest of the saved collection. Original post bodies, media, Telegram login passwords and session credentials are excluded. Disconnecting Telegram removes the local session but retains saved links. You can also revoke the session in Telegram's Devices settings.

Optional encrypted Sync

Sync is off by default. Setup previews the first collection upload and requires your confirmation. If you enable it, folder names, colors, locks and order, saved page titles and URLs, Telegram source metadata and read state, folder membership and archive state are encrypted on your device before upload. Connected devices download and decrypt these records. The server stores encrypted collection snapshots and encrypted changes; it does not receive the collection's decryption key through this exchange.

Sync does not make all information anonymous. The service sees account and device identifiers, device names (including an available model), access and revision records, encrypted payload sizes, timestamps and normal network information such as IP addresses. Tab Atlas does not add IP addresses to the device list or maintain a separate IP history for that feature. Provider access logs can contain network metadata.

The current test service uses Supabase for authentication, the signed API and encrypted database, and Cloudflare for HTTPS app hosting and Turnstile verification during sign-in. The test database is in Frankfurt, Germany; hosting and verification use the providers' infrastructure. Opening the hosted app makes network requests for its assets. Enabling Sync makes additional authenticated requests. Verification runs on a separate origin and can receive normal browser/network information; collection contents are not sent to it.

You can connect another device using a temporary QR invitation and confirm matching codes on the trusted device. The QR contains temporary public connection information, not your password, sign-in token or permanent collection key. Google sign-in is an optional recovery method you must link beforehand. Google receives its sign-in requests; this sign-in flow does not send your collection to Google. A Google account alone cannot decrypt the collection: you also need the current encrypted recovery file and its passphrase. Without linked Google access, that file restores only its own local snapshot.

If you link Google for recovery, the authentication service also stores your Google account identifier, email address and basic profile returned during sign-in. These identity records are separate from your encrypted saved links and folders.

Turning Sync off pauses exchange; signing out stops this device's authenticated access. These actions do not delete the cloud collection. Removing a device's access stops future authorized requests but cannot remotely erase copies it already downloaded. Changing the collection key is a separate confirmed action and produces a new recovery file. Restoring or undoing a Time machine snapshot while Sync is enabled changes the shared collection; the historical snapshots and protected Undo remain on that device.

For service recovery, the operator also stores encrypted database backups in Google Drive. These backups include the encrypted collection records and service metadata described above. A separate layer of backup encryption is applied before upload; its recovery key is kept outside Google Drive. The operator's backup access is separate from your optional Google sign-in and does not request access to your Google Drive.

Encrypted collection data remains on the service until you delete the cloud collection. The confirmed Delete cloud collection action removes its active encrypted snapshots, operation journal and stored operation receipts and revokes device access. Minimal deletion/access records remain to reject stale uploads and acknowledge an interrupted deletion. Temporary requests and encrypted pairing grants have expiration and quota controls; expiration alone does not mean every stored record is immediately erased. Provider logs, authentication records and any provider backups have their own retention. Deleting the active cloud collection does not immediately remove records from earlier encrypted database backups. The operator keeps the newest backup from each of the latest 30 available backup days and 12 available months in Google Drive, using Europe/Budapest dates; overlapping copies are kept once. Retained copies are verified before older copies move to Drive trash, where Google deletes them after 30 days. Encrypted local operator copies are retained separately and are not automatically pruned by this Drive policy. This test feature makes no immediate-erasure or uninterrupted cloud-backup guarantee.

Optional folder sharing

When you explicitly choose to share a folder, Tab Atlas creates a compressed encrypted copy in the link's fragment (the part after #). It does not upload that copy or retain it on a server. It may remove known tracking parameters where safe and excludes sensitive and local-network links by default; signed URLs are left unchanged.

The link contains an encrypted copy of this folder. Anyone who has the complete link can decrypt, view, and import it. Encryption prevents casual reading and detects changes; it does not restrict recipients and does not provide revocation, expiry, or server-side access control.

Site icons (favicons)

Tab Atlas displays site icons using Chrome's built-in local favicon cache (the _favicon API). It does not contact the sites themselves or any third-party icon service to fetch them.

Data use

• Data is not sold to third parties.
• Data is not used for any purpose unrelated to the extension's core functionality.
• Data is not used for creditworthiness or lending purposes.

Retention and your control

Locally saved data stays until you remove it. You can delete saved items and archive entries directly in the extension, clear the extension's local storage, or uninstall the extension to remove everything. Backup files are exported and imported only at your explicit request, and they are ordinary local files on your computer.

Regular exported backups contain readable saved-link and folder data. They do not contain Time machine, Sync queues, previous connection copies or recovery keys. Keep them private. An encrypted recovery file is a separate passphrase-protected file containing a local snapshot and key material. Clearing app data can remove unsent changes and keys; send pending changes and keep a backup and recovery file before clearing it. Clearing a local copy does not delete copies on other devices or on the Sync service.

Contact

Questions about privacy can be sent to nsvyatogo26@gmail.com or Telegram support.