Tabfolio

Tabfolio privacy policy

Last updated: October 29, 2026

Tabfolio helps you organize browser tabs. The extension has no accounts, analytics, telemetry, or Tabfolio-operated data servers. Your Spaces, preferences, and recovery records are stored locally. Thumbnail and favicon features make network requests to the sites and image providers described below. Optional folder sync writes a file only to a folder you choose.

Website analytics

The tabfol.io website uses self-hosted Minilytics to measure visits and clicks. Minilytics stores visitor and session identifiers in first-party cookies and receives analytics events at minilytics.minilytics-round6.workers.dev. This analytics script is used on the website, not in the extension.

Data Tabfolio handles

Tabfolio reads the URLs, titles, favicon URLs, window/tab positions, active and pinned state, and available last-accessed timestamps of open tabs through Chrome’s tabs API. It uses these to display, search, group, inspect duplicates, and manage your tabs. It does not query Chrome’s browsing-history database.

Tabfolio also handles URLs and titles you save or import into Spaces (including files exported from other tab managers or browsers), notes you write on Spaces, plus website metadata and images used to display thumbnails and favicons. URLs and titles can contain sensitive information; only save or import data you want Tabfolio to handle. In Chrome Web Store terminology, these features handle Web history and Website content, including when processed locally.

Tabfolio does not read page form fields, passwords, or the browser’s cookie store. It does not inject content scripts into your pages. Its thumbnail worker fetches HTML to locate preview-image metadata, as described below.

What Tabfolio stores locally

Tabfolio uses chrome.storage.local on your computer:

Spaces and preferences remain until you change or delete them. Chrome removes extension storage when you uninstall Tabfolio. Locally stored records are not uploaded to Tabfolio servers. Some URLs, domains, and video IDs are used for outbound display requests below; this is not a claim that no data leaves your computer.

Inspection searches stay in the manager session and are not sent to a search service. If you choose Copy diagnostic details, Tabfolio copies its version, build identifier/time, extension ID, and browser user-agent to your clipboard. Those details exclude tab URLs, titles, Space names, and installation paths. Diagnostics are never sent automatically.

Folder sync (optional)

Folder sync is off until you choose a folder in Settings. Tabfolio then reads and writes one file, tabfolio-sync.json, in that folder while a Tabfolio page is open. The file contains your Spaces (names, notes, saved URLs, titles, favicon URLs, settings and timestamps) and deletion records. Preferences, recovery history and the thumbnail cache are not written to it.

Tabfolio does not contact any sync service. If the folder is synced by a service such as Dropbox, iCloud Drive or Syncthing, that service copies the file under its own terms. Without a passphrase the file is readable JSON. With a passphrase, the contents are encrypted with AES-256-GCM using a key derived by PBKDF2-SHA-256. The passphrase is stored only in this browser’s extension storage and is never written to the folder. Anyone who can use your browser profile can read it there.

Address bar and side panel

Typing tf and a space in the address bar sends what you type next to Tabfolio, which matches it against your local Spaces, open tabs and stored page descriptions inside the browser. Tabfolio does not send that text anywhere. Chrome’s own handling of address-bar input is governed by Chrome’s settings and policies. The side panel shows the same local data beside the page you are on.

Shared copies of a Space

Copy as Markdown and Download as web page create a copy of one Space’s name, note and links for you to share. The web page contains no scripts and loads no remote resources. Once you share these copies, they are outside Tabfolio’s control.

Network requests

Tabfolio does not add an account or installation identifier to these requests. Receiving servers still see normal network information such as your IP address, request URL, and browser headers. A URL may include query parameters. Providers’ privacy policies govern their handling of those requests.

Thumbnail metadata and image hosts

For public HTTP/HTTPS URLs shown in tab or Space cards, the background worker can fetch HTML and look for an Open Graph, Twitter image, structured-data image, or touch-icon URL, and for the page’s meta description. It reads a bounded prefix of the response, stopping at the end of the HTML head when present. It keeps the image URL and description described above and does not retain the rest of the HTML.

The worker uses credentials: 'omit', so that metadata fetch does not send cookies. It follows redirects. Requests go directly to the page’s server and redirect destinations, not a Tabfolio proxy. The resolver skips common local/private address patterns before the initial request.

The manager then loads the resulting image from its host, which may be a separate CDN. It can also load the favicon URL provided by Chrome. Image requests use the browser’s normal network and cookie rules; the image elements use a no-referrer policy. Tabfolio does not read the browser’s cookies.

If a site blocks other pages from displaying its preview image (for example with a Cross-Origin-Resource-Policy header), the background worker fetches that image itself, with credentials: 'omit', only for public HTTP/HTTPS addresses. It shrinks the image and hands it to the manager for display. The copy is kept in memory for the open manager page only and is not stored.

Favicon fallback services

If a tab’s favicon is unavailable, Tabfolio can request a favicon for its host:

The provider receives the host and normal network information, not your full Space collection or recovery history.

Video thumbnails

For YouTube and Vimeo URLs, Tabfolio extracts the video ID and loads a thumbnail:

These requests reveal the video ID to the image provider, along with normal network information. Tabfolio does not send your whole tab list.

Fonts and executable code are bundled with the extension. No font CDN or remote executable code is used at runtime.

Permissions

The extension declares:

Tabfolio also uses Chrome’s windows API to create and focus windows. The package lists windows, but Chrome does not require a permission for that API and the entry grants no additional access. The tf address-bar keyword and the keyboard shortcuts are manifest settings, not permissions. Folder access is granted by you through the browser’s folder picker.

Limited use

Tabfolio’s use of data complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. Data is used only for the disclosed user-facing tab-management and display features. Transfers to page and image providers are limited to those features. Tabfolio does not sell data, use it for advertising or credit decisions, or send browsing records to its developers for human review. No analytics or telemetry service is included.

Export, deletion, and recovery limits

Use Settings to export or import Space backups, restore pre-import data, clear the thumbnail cache, or stop folder sync. Stopping sync leaves the sync file in your folder; delete it there if you no longer want it. Use Recovery history to forget copies or clear that history. Delete a Space to remove its saved entries, or uninstall Tabfolio to remove its extension storage. Exported files you save outside the extension must be deleted separately.

Undo and recovery reopen URLs. They do not restore form contents, passwords, scroll positions, or deleted Space structure.

Children

Tabfolio is a general-purpose productivity tool. It does not ask users for their age or operate an account-registration system.

Changes and contact

We update this policy when data practices or disclosures change. Previous versions are retained in the project’s version history.

For privacy questions, support, or feedback, email hello@round6.co.