Your data, explained

Privacy Policy for WeeTabs

Last updated: 22 October 2026. Applies to version 2.2.0.

What the extension does

WeeTabs — Private Bookmarks & Sessions stores a separate password-protected collection of bookmarks, category labels, favourites, creation timestamps, notes, private site logins, manually saved tab sessions, and automatic tab-history checkpoints. It does not add vault entries to Chrome's ordinary bookmarks unless you explicitly export and import them there. Existing Chrome bookmarks, browsing history, open tabs, and other suggestion sources are unaffected. Importing copies bookmarks; it does not remove Chrome originals.

Local vault and passwords

New vault data uses AES-256-GCM authenticated encryption with a randomly generated vault key. The vault key is encrypted under a key derived from your password using PBKDF2-HMAC-SHA-256 with 600,000 iterations and a random salt. Older local vaults are upgraded after successful authentication. Older encrypted backup files remain readable; newly exported encrypted backups use the authenticated format.

The encrypted vault, encrypted sessions, encrypted vault key, and preferences are stored in your browser profile. While unlocked, the extension holds decrypted data and encryption keys in memory. For continuity between the popup, side panel, and service worker, the master or decoy password is also kept in Chrome's memory-backed storage.session area while unlocked. It is removed on locking and cleared by Chrome on browser restart, extension reload, update, or disable. The password is not sent to our server. Encryption at rest does not protect against a compromised running browser or device.

Automatic locking is based on user inactivity. Background saving does not extend the unlock period. A forgotten password cannot be recovered by the developer. Browser-profile deletion, removing the extension, or drive failure can delete local records; keep an encrypted backup outside the profile.

Saved sessions, automatic history, and Incognito

During first-run setup, normal and Incognito history are preselected. Before creating or restoring a vault, you choose the modes to record and explicitly confirm the disclosure that recording continues while locked and saved Incognito checkpoints persist after private windows close. You may turn off both modes before continuing. Recording starts only after vault initialization with your chosen settings. Existing vault recording preferences are preserved. Each mode has its own recording switch in History and Settings. Disabling one mode stops new recording for that mode without deleting its existing checkpoints. History and sessions can be managed in the popup, side panel, or the larger Settings manager. Normal and Incognito history appear in separate tabs; searching, restoring, keeping, or deleting one mode does not act on the other mode.

History continues recording while the vault is locked. A public RSA-OAEP-3072/SHA-256 key wraps a fresh AES-256-GCM data key for each captured checkpoint. The matching private key is encrypted under the primary vault key and can only be used after unlocking. The locked worker can encrypt new records without retaining the password or a private decryption key. The public key, opaque record identifiers, checkpoint timestamps, normal/Incognito capture mode, ciphertext lengths, and recording preferences are visible in the local profile; checkpoint URLs, titles, and names are encrypted. Existing vaults require one successful unlock after updating to initialize this capture key. The implementation has not undergone an independent security audit.

History saves eligible URLs and titles, window membership, original normal/Incognito mode, tab order, pin/selection state, and tab-group details when optional permission is granted. It reacts to browser events and uses a periodic alarm as a fallback; it is not guaranteed to capture every last change before a crash or shutdown. Page contents, cookies, login credentials, and unsaved forms are not captured. Known suspended-tab wrapper formats can be read to recover their original web URLs without loading the original site.

Each browsing mode has its own retention budget. The timeline selects up to 12 recent checkpoints, the newest checkpoint from each of up to 12 hourly UTC buckets within the last 24 hours, and the newest checkpoint from each of up to 7 daily UTC buckets within the last seven days. Overlaps count once, with at most 31 checkpoints per mode. Each mode has up to 1 MiB of decrypted history, further limited by the shared 100-session/3 MiB capacity after reserving manually saved sessions. Available storage and large workspaces can shorten coverage. The encrypted pending queue applies the same tiers, with a 2800 KiB total budget split equally between modes and reduced when browser storage is nearly full. Older mixed encrypted records temporarily use a third share until unlocked. If pending records cannot merge, the manager reports the problem and remains usable; pending retention limits still apply. To avoid repeated identical captures after background-worker restarts, memory-backed storage.session holds a separate SHA-256 workspace fingerprint and timestamp for each mode, plus the public capture-key identifier, without clear URLs, titles, passwords, or private decryption keys. This cache clears on browser restart or extension reload. Old entries are pruned during later writes or unlocks; this is not a guarantee of secure erasure at an exact wall-clock time. Manually saved sessions and checkpoints copied with Keep snapshot are not silently pruned. Previously exported files keep their own copies. Browser-profile deletion, removing the extension, disabling it, permission loss, or storage failure can interrupt capture or remove records.

Chrome's Allow in Incognito setting is required to access private windows. The first-use interface explains that automatic encrypted history includes private tabs and continues while locked. Recorded private URLs remain saved after Incognito windows close, until deleted or pruned. Manual Save all windows shows the selected normal/private counts and requires a separate private-tab confirmation before saving. Restoring reopens URLs in their original modes; it does not recover cookies or logins. Private URLs are never silently reopened in normal windows if permission is unavailable.

Automatic history always targets the primary vault's public capture key, including during a decoy session. A decoy password cannot decrypt primary history. Decoy manual sessions stay in their separately encrypted store. History and sessions may be included only after separate cloud-backup category consent as described below. Encrypted file backups include bookmarks, private logins, sessions, readable history, and pending/unreadable encrypted capture records with the capture keys needed for portable recovery. These keys are enclosed inside the password-encrypted backup and, after import, inside an AES-GCM-encrypted main-vault recovery store. Readable records merge subject to age and capacity rules; unreadable ciphertext is preserved and reported, not repaired. Recovery archives have a separate 6 MiB decoded limit and can be explicitly deleted in Settings. They are excluded from cloud and plaintext bookmark exports and cannot be restored into a decoy vault. Older releases cannot restore version-3 backup payloads containing these archives.

Private site logins

Private logins are entered explicitly in the extension or offered through the optional Incognito save prompts described below, and stored in a separate AES-256-GCM record under the active real or decoy vault key. Password entries require HTTPS origins. Viewing, saving, editing, deleting, backing up, or filling credentials requires an unlocked vault. The extension clears its login list and editor when locked and masks revealed passwords after 15 seconds or when focus leaves. No copy-to-clipboard action is provided.

Automatic save prompts are off until you approve an HTTPS site in Passwords → Automatic save prompts and grant Chrome's optional scripting and site permissions. Approval is per origin; the extension requests access to that site's HTTPS host, not all websites. Chrome site grants may cover other ports on that host; WeeTabs still matches the exact approved origin. Approved site addresses and the enable switch are stored as unencrypted local preferences, and Chrome retains its site permissions, even while the vault is locked. Removing a site also removes its Chrome host permission; the main switch stops observation without deleting saved logins. Chrome's Allow in Incognito setting is also required.

While the main vault is unlocked, the worker injects a packaged, isolated-world observer only into top-level Incognito documents on approved sites. It reads the username and password only on a sign-in form submission following a trusted click or Enter gesture. It does not monitor typing or network traffic, alter the submission, or inject this observer into normal tabs. Single visible password forms with same-origin HTTPS POST actions are supported; registration/new-password, multiple-password and cross-origin forms are skipped. Programmatic attachment is best effort around navigation; very fast submissions may occur before the observer is ready. Some custom sign-in flows, embedded frames, passkeys and multi-step forms are unsupported. Detection does not establish that authentication succeeded: the prompt asks you to save only after a successful sign-in.

Before creating a prompt, the worker checks the main unlocked vault session, approved site permission, Incognito source, top frame, prepared document ID and private nonce. The candidate is encrypted under the current vault key in memory-backed extension storage.session, which is not exposed to content scripts. Its identifier, source tab/window IDs, expiry and session token are temporary metadata; credential contents remain encrypted. Only one candidate is pending at a time, for up to two minutes. A WeeTabs-owned confirmation window shows the site and username with the password hidden. Save or Update must be clicked before the credential enters the vault. Identical saved logins are not offered again; updates preserve the existing label and require confirmation. Concurrent edits are preserved rather than silently overwritten. Pending candidates are discarded on dismissal, expiry, source-tab/window closure, lock/session change or removal of permission. Save prompts do not operate in a decoy session. The confirmation is a normal extension window because Chrome's spanning Incognito mode cannot host an extension main-frame page in an Incognito window. It is outside the website's page.

Filling is an explicit action available only for an active Incognito tab matching the saved HTTPS origin exactly. It requires optional scripting permission and either temporary activeTab site access granted by invoking the extension on that page, or the host permission separately approved for save prompts. Before passing credentials to a page, the worker checks the unlocked session, Incognito state, origin, pending navigation, and document identity. An isolated-world script fills one visible main-frame sign-in password field, rejects new-password forms and cross-origin form actions, and dispatches ordinary input/change events without submitting. Filled credentials are necessarily available to that site and remain on the page if the vault subsequently locks. A website, browser, operating system, or another extension can have independent behavior outside this vault. The extension does not write to Google Password Manager or control Chrome’s own password-saving prompts.

Private logins are included in encrypted file backups, excluded from plain bookmark JSON/HTML exports and included in cloud backup only when its separate passwords category is explicitly selected, and kept separate between real and decoy vaults. Restoring an older bookmark-only backup preserves existing logins. Deleting a login does not delete copies in external backup files.

Queued tabs

Bulk folder opening and saved-session restore use local data-page placeholders by default. They contain an escaped title and destination address, have no scripts or remote resources, and make no requests to the destination until selected in a focused window. Destination URLs are present in browser-tab metadata, outside encrypted vault storage, and can remain visible or restorable like other open normal tabs. They are available after the vault locks, as already-open tabs are. Incognito placeholders stay in private windows and are not reopened in normal windows by the extension. The worker resolves them only into their existing tab, preserving its browsing mode. Settings can opt into immediate bulk loading. There is no mass reload of native-discarded tabs. An optional startup setting (off by default) pauses restored web tabs, including the active tab, during an initial eight-second restore window. Chrome can make requests before the worker starts; this is best effort. The optional Prepare for restart action pauses current web tabs before closing. Both actions can replace unsaved page state. Startup-paused tabs remain held until selected or their Load this tab link is used. These tab-management actions do not require unlocking because they operate on already-open browser tabs.

Tab suspension and Chrome layout

Explicit manual suspension replaces web pages with held local placeholders. Suspend all tabs preserves the active tab in every normal and Incognito window, while pausing background pinned, audio/video-playing, and loading tabs. Suspend this tab and Suspend selected can explicitly include active tabs. The extension verifies a new local replacement tab before removing the original, preserving the destination, window, mode, position, group and pin. This stops playback, changes the browser tab ID, and loses the original tab’s Back/Forward history and unsaved page state. If replacement verification or grouping fails, the original is preserved. Existing native-discarded tabs remain dormant. The current paused tab uses its Load this tab link; other paused tabs load when selected. Browser-internal tabs are skipped. Optional automatic idle suspension uses Chrome’s native tab discard API and skips active, pinned, audio-playing, loading, internal, and protected tabs. Unsaved page state can be lost; the extension does not inspect page contents to guarantee form preservation. Auto-suspension is off by default and can be enabled in Settings. Temporary activity times and tab IDs may be held in Chrome's memory-backed session storage so idle detection survives service-worker suspension. They contain no page URLs or titles.

An optional site whitelist exempts domains and their subdomains from automatic idle suspension in normal and Incognito windows. It continues working while locked. These hostnames are stored as unencrypted local preferences outside the vault; paths, query strings, fragments, and ports are not retained. Rules are matched locally without contacting those sites. Manual suspension and the separate startup suspension option do not use this idle whitelist. Removing an entry permits future automatic suspension without opening or closing any tab.

The vertical-tabs tip and Settings shortcut open Chrome's own Appearance controls. They do not transmit browsing data or change the native tab layout automatically.

Quick-save and temporary data

Toolbar saving, the browser context menu, and the keyboard shortcut read the selected page's title and address. New shortcut/context-menu saves write directly into the encrypted unlocked vault. If locked, the extension reports that saving did not occur; it does not persist a plaintext queue. For upgrades, previously queued links may be temporarily moved into memory-backed session storage until they can be secured after unlocking. They are not a background browsing-history log.

Optional encrypted cloud backup and licensing

Users with a qualifying licence can opt into encrypted cloud backup. Bookmarks are the initial category. Saved sessions (including any saved private windows), normal history, Incognito history and saved passwords/usernames are separate categories, off until explicitly selected and confirmed in Settings. Consent to local history recording does not consent to cloud upload. Decoy vaults cannot upload or restore cloud data.

Only selected categories enter the cloud-backup payload. On the device, a random data key encrypts the payload with AES-256-GCM. The data key is wrapped using the vault password and the same authenticated PBKDF2-SHA-256 portable-backup format used for encrypted file backups. The server receives ciphertext, licence key, bookmark count, version identifier, timestamps, payload sizes and ordinary connection metadata. It does not receive the vault password, plaintext passwords, titles, notes, URLs or unwrapped encryption key. Selected category names are inside the encrypted payload; category preferences and confirmation state remain local. Encryption does not hide request metadata or size. The implementation has not undergone an independent security audit.

The Cloudflare service retains up to five versions, each limited to 14 MiB of encrypted data. A new version after the fifth removes the oldest. The latest version is not guaranteed to contain changes that have not been successfully uploaded. Automatic backup is optional and off by default. When enabled, it checks after changes across WeeTabs and periodically while the main vault is unlocked, with at most one upload per five minutes. While locked, local history may continue recording, but cloud upload waits until unlocking. Password or category changes during preparation cancel that upload. Unreadable/pending recovery archives are not uploaded; selecting history blocks an upload if unresolved recovery records remain. Keep an encrypted file backup for those records.

A separate revision check prevents stale devices from replacing newer cloud backups. After a conflict, review and refresh versions before retrying. Restoring requires an active Pro plan, licence key and the password used for the chosen version. Older versions may need an older password. Settings previews the included category names before replacing those local categories; unselected categories remain. Initial setup also confirms the backup categories before creating the vault. Restore reopens no websites automatically. Forgetting the encryption password cannot be remedied by the developer. A download is not proof that the ciphertext is decryptable; wrong passwords or damaged payloads fail without replacing local data.

Changing backup categories affects future uploads and does not erase earlier versions. Use Delete Cloud Vault in Settings to delete all retained versions and any independent legacy bookmark-only backup; local data remains. Storage-layer recovery/operational retention is not a guarantee of immediate forensic erasure. Legacy bookmark-only backups remain readable. Cloud backup is versioned snapshot upload/restore, not conflict-safe live device synchronisation. Cloud access requires an active subscription; cancelling does not lock local data or local file exports.

Licence checks send the licence key to the configured Cloudflare service. Stripe handles checkout under its own privacy terms; we do not receive card numbers from the extension.

Permissions

• storage: encrypted vault/session persistence, preferences, licensing, and temporary unlocked session state.
• tabs / activeTab: page titles and addresses for user-triggered saves and session/history capture, and tab suspension; no automatic page-content scraping. Explicit private-login filling is described above.
• sidePanel: display the vault alongside browsing.
• contextMenus: provide the save-page/link action.
• bookmarks: read existing Chrome bookmarks when you request an import.
• favicon: display icons through Chrome's local favicon service; vault rendering does not load remote icon-provider URLs.
• alarms: enforce inactivity locking, schedule history checkpoints, and check optional automatic suspension while the popup is closed.
• scripting (optional): explicitly fill a saved login, or attach the optional save-prompt observer to an approved Incognito HTTPS top document while the main vault is unlocked.
• HTTPS sites (optional_host_permissions): the manifest permits requesting HTTPS hosts at runtime; only a specific host is requested when you approve a site for save prompts. No all-sites grant is requested. Exact-origin settings and Incognito/session checks further restrict observation.
• tabGroups (optional): save and restore tab-group names, colours, and collapsed state after you enable that feature.
• API host permission: optional cloud-backup, license verification, and checkout requests to our configured licensing service.

Analytics, sharing, and contact

The extension contains no advertising SDK or usage-analytics telemetry. We do not sell bookmark or session contents. Service providers receive the encrypted data, licensing/payment information, or request metadata described above as needed to operate the features you use. Operational server settings and payment-provider retention are separate from deleting your local browser vault.

The use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. For support and privacy questions, email [email protected]. Contact links open a draft in your chosen email app with a generic subject. The extension does not send email itself or automatically include vault data, browsing details, saved passwords, or diagnostic logs. Information you choose to send is processed by the email providers used for support.

Free local access and the full library

Local features do not expire and require no subscription. Optional paid encrypted cloud backup retains its license/billing flow; cancelling it does not lock local data. The full library reads encrypted bookmark data only after unlocking. Favourites and creation dates remain inside the encrypted collection. Undo holds one collection snapshot in memory and clears it with editor contents and visible records on lock or vault change. Search, filters and category suggestions run locally. Suspension jobs store counts and timing in memory-backed storage.session, without page URLs or titles. The cryptographic implementation has not undergone an independent audit.

Optional support tips

Support WeeTabs opens a Stripe-hosted, one-time payment page only when clicked. The link does not include bookmarks, history, sessions, saved passwords, vault keys, or a licence identifier. Stripe and the hosting provider receive the usual connection information when you visit. Stripe handles payment information under its own terms; tips do not enable Cloud Pro. No payment request is made merely by opening the extension.

This website

The WeeTabs website does not include analytics, advertising scripts, external fonts, contact forms or cookie storage. Its hosting and network providers process ordinary connection information such as IP addresses to serve the site. The website does not read your extension vault or browser history.

Email links open your chosen email application; only information you choose to send is shared with support and the email providers. Optional support links take you to Stripe, whose own privacy terms apply. Clicking a download requests the preview ZIP from the website host.