Who we are and what this covers.
TabsMate is operated by Thisal Liyanaarachchi, an independent developer based in Sri Lanka. In this policy, “TabsMate,” “we,” “us” and “our” refer to the developer operating the TabsMate website, browser extension and associated account services.
The developer is responsible for deciding how personal information is processed for TabsMate. Privacy questions and requests can be sent to support@tabsmate.app.
This policy covers the marketing website and its interactive playground, the TabsMate Chrome extension, account and integration services, purchases made through the extension, and communications with support. Third-party websites and services have their own policies, which also apply when you use them.
Privacy at a glance.
- Guest essentials: your guest workspace preferences and shortcuts are stored in your browser. An account is optional for the essentials.
- Website playground: the selected theme is stored locally. The preview timer runs in memory. Its sample connected widgets do not access your Google or ClickUp account.
- Optional connections: account-based widgets use the provider information you authorize so they can show email metadata, calendar events or tasks.
- Purchases: checkout is handled by Polar. The public marketing website does not collect payment-card numbers.
- Contact: the website form sends your message to TabsMate support and saves a support ticket so we can reply.
- Control: you can clear local storage, disconnect providers, revoke provider access, or request help with your information.
Website visits and the playground.
When your browser requests a page, image, font or other resource, the hosting or delivery service receives ordinary connection information such as your IP address, request time, requested resource and browser or device information. These requests are necessary to deliver the website. Hosting providers may maintain operational or security logs under their own settings and policies.
The website implementation does not add advertising trackers, behavioral-analytics SDKs or marketing cookies. It loads fonts from Google Fonts, which creates requests to Google’s font services and exposes normal connection information to those services. System fonts are used if external fonts cannot load.
The playground stores your selected theme in your browser and keeps the current timer and interactive example state in memory. Example calendar items, task lists and layout controls are illustrative. They do not authenticate with a provider or retrieve real account data.
Submitting the playground’s web-search field sends your query to Google Search in a new tab. Opening a shortcut sends you to that destination. The search engine or destination receives your request and processes it according to its own policy.
Local storage and cookies.
| Where | What is stored | Purpose and duration |
|---|---|---|
| Website playground | tabsmate-preview-theme in localStorage | Remembers your chosen theme until you replace it or clear site data. |
| Website page memory | Timer state, carousel selection, example controls, contact-form text and email-action form state | Supports interactions during the page session. It is not intentionally saved as an account record by this website. |
| Extension guest workspace | Preferences, chosen theme, layout, shortcuts and workspace settings | Remembers your workspace across sessions until changed or removed from browser storage. |
| Account session | A backend-managed HttpOnly session cookie; non-sensitive account preferences may be stored separately in the browser. | Maintains sign-in through credentialed API requests. Session expiry and revocation are controlled by the backend. The frontend does not store login tokens in localStorage. |
Local storage is different from a cookie: it is not automatically attached to every website request. For account requests, the browser can send the backend-managed HttpOnly session cookie when credentialed API requests are made. The extension does not store its login token in localStorage. Browser features, backups or your own device-management tools may also affect stored data.
You can remove local data through your browser’s site or extension settings. Doing so may reset themes, shortcuts, layouts and sign-in. Clearing local data does not by itself delete a server-side account, revoke an integration or erase a completed purchase.
The website does not deliberately set non-essential tracking cookies. Third-party hosting, checkout, identity or destination services may use their own cookies or related storage when you interact with them.
Accounts and authentication.
If you register, TabsMate processes the name, email address and password information you provide, together with verification status, account identifiers, session information and saved account preferences. Authentication services also handle verification and password-recovery requests.
Account operations may generate security and administrative records, such as sign-in events, session revocation, account-deletion requests and access or trial-eligibility decisions. These records help operate accounts, investigate problems and prevent repeated trial abuse or unauthorized access.
The website also provides dedicated email-verification and password-reset pages. These read the single-use token from the email link’s URL fragment, remove the fragment from the address bar and retain the token only in page memory. Confirmation sends the token to the account API; password reset also sends the new password you choose. Requesting a replacement email sends your account email to the verification or recovery endpoint. These pages do not sign you in, transfer a session into the extension, or write email tokens or passwords to localStorage, sessionStorage or cookies. Reopening an email link or requesting a new link may be necessary after a refresh.
The account backend handles authentication separately from the marketing website. The website playground does not need your extension password or provider credentials. Never send passwords, session tokens or verification codes to support.
Optional Google and ClickUp connections.
Connections are optional and require you to authorize the relevant provider. The provider’s authorization screen explains the permissions being requested. If you do not authorize a provider, its account-based widgets cannot retrieve your data.
- Google inbox widget: uses up to eight recent inbox messages' sender, subject, date, unread status and message identifiers to present an inbox preview and links back to Gmail. It does not request message bodies or attachments.
- Google Calendar widget: uses upcoming events from your primary calendar, including event titles, start dates or times, event links and identifiers, to show a calendar preview.
- ClickUp task widget: uses authorized workspace, space, list and task information to show your work and supports task completion and time tracking when you choose those actions.
- Connection records: provider identifiers, authorization credentials and connection status are processed to maintain the connection, refresh authorized access and apply account or trial eligibility.
Provider information is requested through the account backend for the feature you choose. The marketing website’s samples do not retrieve these records. Do not assume that selecting an example on the website connects an account.
Disconnecting a provider through TabsMate deletes stored connection tokens. For Google, TabsMate also attempts provider-side revocation; for ClickUp, revoke access in ClickUp's app settings. You can also revoke access directly in Google or ClickUp account settings. Removing access stops future authorized retrieval, but does not remove information held independently by the provider or erase all billing, security or eligibility records.
Shortcut icons can create separate third-party requests even without a connected account. The extension may request an icon from Google’s favicon service using the shortcut’s domain, request the destination’s icon directly, or use Chrome’s favicon API. These requests can reveal the requested domain and ordinary connection information to the service receiving them. If you choose Import bookmarks, the extension asks for optional bookmarks permission, reads your bookmark tree to let you preview and select links, and saves only the shortcuts you choose. It does not change your Chrome bookmarks or request browsing-history permission.
Google API data and Limited Use.
TabsMate uses Google user data to provide the connected inbox-metadata and calendar features you choose. Google account identifiers and email addresses identify your connection and help enforce trial eligibility. Inbox and calendar data is fetched by the account backend when you open the widgets and returned to your dashboard; the widget results are not saved as account records. Google data is not used for targeted advertising, sold to data brokers, or used to train general-purpose artificial-intelligence or machine-learning models.
TabsMate’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements. Information received through the Chrome extension is also handled in accordance with the Chrome Web Store User Data Policy, including its Limited Use requirements. Google data is processed by the Cloudflare-hosted account API to deliver the connected widgets. Encrypted Google connection tokens and the account label are stored in the Supabase-backed database. Google inbox and calendar contents are not sent to Polar, ClickUp, email delivery providers or AI services.
Human access to connected Google data is limited to circumstances permitted by that policy, such as your affirmative permission for a specific support issue, necessary security or legal purposes, or other expressly permitted uses. Contact support if you want assistance disconnecting Google or deleting information associated with your connection.
Purchases and billing.
Paid lifetime access is purchased through Polar checkout from the extension. Polar processes the payment and may collect billing details, payment information, country or tax information, and transaction-related records under its own terms and privacy policy.
TabsMate uses purchase references, account or customer identifiers, payment and refund status, and entitlement information to recognize your purchase, grant or withdraw access, answer billing questions, and prevent duplicate or fraudulent processing. Payment events may be delivered to the backend through checkout-provider webhooks.
The marketing website does not collect payment-card numbers. Account deletion or disconnecting a provider does not automatically remove records that Polar or TabsMate must retain for accounting, fraud prevention, disputes or other applicable obligations. Send purchase questions to support with your order reference, without card details.
Contact messages and support.
When you select “Send message,” the website sends your topic, name, email address and message to the TabsMate account backend. The backend stores a support ticket and emails the message to support@tabsmate.app so we can reply. You do not need an account to contact us.
The developer and the services that host the backend, support records and email delivery receive the information you submit. We use it to understand your request, reply, investigate issues and keep appropriate correspondence records. Only include the information needed for your request; leave out passwords, payment-card details and unrelated personal information.
Why we process information.
Information is used to deliver the website and extension, remember preferences, manage accounts and sessions, provide authorized integrations, recognize purchases and trials, respond to support, and protect the service against misuse.
Where applicable law requires a legal basis, processing may rely on performing or preparing to perform the service you request, your consent for optional provider access or other consent-based activities, legitimate interests in operating and securing the service, or applicable legal obligations such as accounting or lawful disclosure requirements. The basis depends on the information and the activity.
You can withdraw an optional connection by disconnecting it or revoking access with the provider. Withdrawal affects future consent-based processing and does not make earlier permitted processing unlawful or remove separate record-keeping obligations.
Retention and account deletion.
Local preferences remain on your device until replaced, reset or cleared. Page-session state normally ends when the page is closed or reloaded. Browser backups and open sessions may retain separate copies under your control or the relevant provider’s settings. Support tickets and their email copies are kept as needed to answer requests and maintain appropriate correspondence records.
Account information is retained while needed to provide the account and its features, and afterward only where needed for an appropriate purpose such as a support request, a transaction, security, eligibility enforcement or a legal obligation. Retention is assessed according to the purpose of each record, the need to resolve outstanding matters and applicable requirements. Contact the developer for information about the records associated with your account.
In the extension’s Account & Privacy area, account deletion is described as removing your profile, saved server-side preferences and provider tokens, revoking sessions and ending account access, including associated lifetime access. This action does not necessarily clear separate guest preferences in your browser.
Google inbox and calendar widget results are not stored as account records. Disconnecting Google removes the stored connection credentials and stops future retrieval. Account deletion also removes provider connections. Minimized billing and audit records, together with provider-identity fingerprints used for eligibility or abuse prevention, may remain after deletion. Security events are retained for 90 days; the trial ledger, billing and audit records are retained for the service lifetime. A fingerprint is a derived identifier and should not be assumed to be anonymous merely because it is not the original provider identifier.
Copies in service-provider backups or records held independently by payment, email or integration providers may follow separate deletion schedules or legal requirements. To ask which records remain in your particular case, contact the developer. Deleting your TabsMate account does not delete your Google, ClickUp or payment-provider account.
Your choices and privacy rights.
- Use guest features without creating an account or connecting a provider.
- Change or clear website and extension storage through browser settings.
- Sign out to remove the extension’s local session credential.
- Disconnect a provider in TabsMate and revoke its permission directly in the provider’s settings.
- Use Account & Privacy to review account settings or request account deletion.
- Contact the developer to ask about access, correction, deletion, a copy of your information, or a concern about processing.
Depending on the law applicable to you, you may also have rights to restrict or object to certain processing, withdraw consent, receive portable information, or complain to a competent data-protection authority. These rights can have limits, including legal retention duties and protecting other people’s information.
Send requests from your account email where possible. The developer may ask for proportionate verification before disclosing or deleting account information. Do not send a password or identity document unless a necessary, secure verification method has first been explained. Requests are handled subject to applicable requirements and time limits; the exact outcome depends on the request and the records involved.
Security.
TabsMate’s account architecture uses authenticated requests, session controls and separately configured backend infrastructure. Access to account and connected-service functions depends on authorization checks. Provider tokens are encrypted at rest by the backend. Production requests use HTTPS, and session cookies are HttpOnly. Browser storage and downloaded files also depend on the security of your own device.
No online service or local device can guarantee absolute security. Protect your browser profile, use a unique password, keep your browser current and revoke sessions or provider access if you suspect misuse. Report suspected security issues to the developer without including live credentials in your initial message.
International processing.
The developer is based in Sri Lanka. Hosting, database, payment, email and integration providers may process information in other countries according to their infrastructure and service arrangements. Your information may therefore be processed outside your home country.
Applicable safeguards and transfer requirements depend on the service, your location and the law involved. This policy does not claim that every record stays in Sri Lanka or in a single region. Contact the developer if you need further information about the providers or processing locations relevant to your use.
Children and young users.
TabsMate is a general productivity tool and is not designed as a service directed at children. If you are below the age at which you can authorize personal-data processing or create an account under the rules applicable to you, seek a parent or guardian’s involvement before providing information.
If you believe a child has provided personal information without the authorization required by applicable law, contact the developer so the circumstances can be reviewed and appropriate action taken.
Changes to this policy.
This policy may be updated when features, providers or data practices change. The effective and last-updated dates appear at the top. Material changes will be explained through an appropriate website, extension or account notice, and additional consent will be requested where required before new consent-based uses begin.
A policy update does not silently expand permissions you have granted to Google or ClickUp. Optional provider access remains controlled by the provider authorization and revocation mechanisms.
Contact the developer.
Use “TabsMate privacy request” as your subject and describe what you would like to know or change. For account-related requests, include your account email and relevant context without passwords, verification codes or payment-card details.
Open the contact page