Privacy Policy for Tab Widgets

Effective Date: 15th October 2026

Tab Widgets is operated by NOIR APPS PTY LTD, a company registered in Australia ("we," "us," or "our"). We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal information when you use the Tab Widgets browser extension and its web version (together, the "Extension") and our website at https://tabwidgets.com. It also describes your rights regarding your data and how to exercise them.

1. Information We Collect

We may collect the following types of information:

• Account Information: If you subscribe to Tab Widgets Pro, we collect your email address and name (provided during checkout), a securely hashed password, and your subscription status. Payments are processed by Stripe. We do not receive or store your full card details.

• Synced Data: If you use cloud sync, we store your pages, widget settings, app settings, and any images you upload, so that they can be backed up and synced across your devices.

• Usage and Diagnostic Data: We collect information about how the Extension is used, such as browser type, operating system, Extension version, interactions within the Extension (e.g., widgets added and buttons clicked), error reports, and session recordings in which all text and form inputs are masked. If you are signed in, this information is linked to your account ID and email address.

• Widget Request Data: Some widgets get their content through our servers (see Section 3). For these, we receive what the widget needs to fetch it, such as the location you choose or search for in the Weather and World Clock widgets, the feed URLs in the RSS widget, the fuel stations in the FuelWatch widget, and game names you search for in the Link widget. Our servers fetch the content from the provider and return it to your browser. These requests, including these details, may be recorded in our server logs.

• Support Information: Any information you choose to send us, for example when you contact support or send feedback.

• Google User Data: When you connect widgets to Google services (Gmail, Google Calendar, Google Drive, or Google Tasks), the Extension accesses data from those services through Google's OAuth 2.0 authentication. The specific data accessed depends on which widgets you connect and the permissions you grant. See Section 4 for full details.

2. How We Use Your Information

The information we collect is used to:

• Provide, maintain, and improve the Extension.
• Back up and sync your pages and widgets across your devices.
• Manage your account and subscription.
• Analyze usage patterns and diagnose errors to better understand how the Extension is used.
• Respond to your inquiries and provide support when requested.
• Notify you about updates, new features, or changes to the Extension.

Google User Data is only used as described in Section 4. We will not use your data for any purposes not disclosed in this Privacy Policy. If we need to use your data for a new purpose, we will update this policy and obtain your consent before doing so.

3. Third-Party Services

We use the following third-party services to operate the Extension. They process data on our behalf or at your direction, and are subject to their own privacy policies:

• Stripe: processes subscription payments.
• PostHog: analytics, error reporting, and session recordings, as described in Section 1.
• Infrastructure providers: host our servers and database, store uploaded files, and send account emails.
• Google: provides the Google APIs used by the Google-connected widgets (see Section 4). The Extension also uses Google's favicon service to display website icons, which sends the domain names of links on your pages to Google.
• Other widget providers: some widgets (e.g., Weather, World Clock location search, RSS, FuelWatch, and Steam game search) send their requests through our servers, which fetch the content from the provider, as described in Section 1. Other widgets (e.g., music or embedded websites) send requests directly from your browser to those services.

We do not sell or rent your personal information, and we do not share it with third parties for marketing or advertising purposes.

4. Google User Data

Certain widgets within the Extension request access to Google services through Google's OAuth 2.0 authentication. These widgets only access your Google account after you connect it and grant permission. This section describes how we access, use, store, share, protect, retain, and delete data received from Google APIs ("Google User Data").

4.1 Data Accessed

The Extension accesses the following Google User Data, depending on the widgets you connect:

• Gmail (access to read your email and change its labels): the Extension retrieves your most recent messages, or messages matching a search you enter in the widget. For each message it retrieves the sender, subject, and date headers, a short snippet, and whether it is unread, starred, in the inbox, or in the trash, and displays the sender, subject, snippet, and date in the email widget. It also reads your Gmail address to identify the connected account. Only when you ask it to, the Extension marks an email read or unread, stars or unstars it, archives it, or moves it to or from the trash. The Extension never sends or composes emails, and never permanently deletes them.

• Google Calendar (read access to your calendar list and access to view and edit events on all your calendars): the Extension reads your list of calendars and their events (including event titles, times, locations, descriptions, and attendees) to display your upcoming events in the calendar widget. When you use the widget's "create event" form, the Extension creates the event you entered in your primary calendar. Only when you ask it to, the Extension edits or deletes an existing event, or one or all occurrences of a recurring event, on the calendar it belongs to. If the event has guests, Google emails them the change or cancellation.

• Google Drive (access to view and manage your Google Drive files): the Extension reads file and folder metadata (such as names, types, sizes, dates, folder locations, thumbnails, and links) so you can browse and search your files in the Google Drive widget. It also reads your Google account name, email address, profile photo, and account ID to identify the connected account. Only when you choose to, the Extension downloads a file to your device, uploads files you drop onto the widget, or renames, moves, or moves a file to the trash. The Extension never permanently deletes your files.

• Google Tasks (access to view and manage your tasks): the Extension reads your task lists and their tasks (including titles, notes, due dates, and completion status) to display them in the Google Tasks widget. Only when you ask it to, the Extension adds, completes, edits, reorders, or deletes tasks, and creates, renames, or deletes task lists. Deleting a task list deletes every task in it.

4.2 Data Use

Google User Data is used only to provide the widget features you have enabled and that are prominent in the Extension's user interface: displaying your emails, events, files, and tasks, and carrying out the actions you request. We do not use Google User Data:

• to serve advertisements, including personalized or retargeted ads;
• to sell it, or for data broker or information reseller purposes;
• to determine credit-worthiness or for lending purposes;
• for analytics; or
• to develop, improve, or train generalized artificial intelligence and/or machine learning models.

4.3 Data Storage

The content of your emails, calendar events, Drive files, and tasks is never sent to or stored on our servers. The Extension requests this data directly from Google in your browser, and it stays on your device:

• OAuth access and refresh tokens are stored in your browser's extension storage (or, for the web version, in your browser's local database).
• Gmail messages and Google Calendar events are cached in your browser's local database so that widgets load quickly. Cached Gmail data expires after 24 hours and cached Calendar data expires after 1 hour.
• Google Tasks task lists and tasks are cached in your browser's local database so that the widget loads quickly and works offline. Cached Tasks data expires after 7 days.
• Google Drive file lists are held in memory only while the Extension is open. Files you download are saved to your device.

Our servers only handle the following limited data:

• Sign-in with Google: exchanging the authorization code Google issues when you connect an account, and refreshing your access token, require our app's confidential client credentials. To do this, the authorization code or refresh token is sent from your browser to our server, which forwards it to Google and returns Google's response to your browser. Tokens are not stored or logged on our servers.
• Cloud sync: if you use cloud sync, the settings of your Gmail and Google Drive widgets are synced to our servers like other widget settings. These settings include an identifier for the connected Google account (your Gmail address, or your Google Drive account ID or email address) and any search text or tabs (names and Gmail searches) you set up in the widget. Google Tasks widget settings include only the IDs of the task lists you chose. They do not include tokens or the content of your emails, events, files, or tasks.

4.4 Data Sharing

We do not transfer or disclose Google User Data to any third party, including analytics, error reporting, or advertising providers, except:

• With your explicit consent.
• When necessary for security purposes (e.g., investigating abuse).
• To comply with applicable laws, regulations, or legal processes.
• In connection with a merger, acquisition, or sale of assets, but only with your explicit prior consent.

The limited data handled by our servers (Section 4.3) is hosted by our infrastructure providers, who process it only on our behalf to operate the Extension.

4.5 Human Access to Data

No humans (including our employees and contractors) will read your Google User Data, unless:

• You have given us your affirmative agreement to view specific data.
• It is necessary for security purposes (e.g., investigating a bug or abuse).
• It is required to comply with applicable law.
• The data is aggregated and anonymized and used for internal operations in accordance with applicable privacy and data protection laws.

4.6 Data Protection

We protect Google User Data by:

• Encrypting all communication between the Extension, our servers, and Google using HTTPS (TLS).
• Keeping Google User Data and tokens on your device, in browser storage that websites you visit cannot access.
• Keeping our Google OAuth client secret on our servers only, and never storing or logging the tokens that pass through them.
• Restricting access to our servers and database to authorized personnel.

4.7 Data Retention and Deletion

• Cached Gmail data is kept for up to 24 hours and cached Google Calendar data for up to 1 hour, and cached Google Tasks data for up to 7 days. Expired data is deleted from your device the next time the Extension starts.
• Disconnecting a Google account in a widget's settings deletes the widget's sign-in for that account, and the Google User Data the widget cached, from your device. Other kinds of Google widget connected to the same account keep theirs until you disconnect them too. The Extension's access with Google stays until you remove it in your Google Account permissions (Section 4.8).
• Uninstalling the Extension, or clearing your browser's data for the Extension, immediately deletes all Google User Data stored on your device.
• Account identifiers, search text, and tabs in synced widget settings (Section 4.3) are kept while you have a Tab Widgets account. To have them deleted, or to delete your account and all its data, contact us at and we will delete the data within 30 days.

4.8 Revoking Access

You can revoke the Extension's access to your Google account at any time through your Google Account permissions. Once access is revoked, the Extension can no longer retrieve data from, or make changes to, your Google account.

4.9 Limited Use Disclosure

Tab Widgets' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

5. Data Security

We take data security seriously. We implement reasonable measures to protect your information from unauthorized access, alteration, or destruction, including encrypting data in transit and storing passwords only as secure hashes. However, no method of transmission over the Internet or electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of unauthorized access to your information, we will notify you promptly.

6. Cookies and Local Storage

The Extension and our website use cookies and browser storage to keep you signed in, save your settings, and measure usage as described in Section 1. You can manage cookies and site data through your browser settings.

7. Your Rights

You have the right to:

• Request access to the personal data we hold about you (if any).
• Request the correction or deletion of your personal data.
• Withdraw consent to the collection of personal data (if previously provided).
• Request details about what data we access, use, store, or share.

To exercise any of these rights, please contact us at .

8. Children's Privacy

Our Extension is not intended for use by children under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us, and we will take steps to delete that information.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated policy on this page and updating the "Effective Date" at the top. If we make material changes to how we handle Google User Data, we will provide notice and obtain your consent before the changes take effect.

10. Contact Us

If you have any questions or concerns about this Privacy Policy or your data, please contact us at:

• Company: NOIR APPS PTY LTD
• Email:
• Website: https://tabwidgets.com