Privacy

Your tabs are yours.

Last updated: May 30, 2026

The short version

Amazing Tabs is local-first. By default, everything you save lives in your browser's local storage and never leaves your machine. We can't read your tabs because they aren't on our servers.

If you create an account and turn on cloud sync (a Premium feature), a copy of your saved tabs syncs to your private account in Firebase's EU region. You can turn that off any time, and you can delete your account from your Account page at any time.

We use PostHog for product analytics on the website. We do not sell your data, ever, to anyone. We do not run advertising. We do not have a data broker pipeline. The business is funded by people who pay for Premium.

What the Chrome extension stores locally

When you use the Amazing Tabs Chrome extension, everything below is stored in your browser's IndexedDB and never transmitted unless you opt in to cloud sync:

  • Saved tabs (URLs, titles, favicons, the spaces you put them in)
  • Spaces, collections, categories, and tags you create
  • Notes attached to collections
  • Settings (theme, sidebar layout, omnibox preferences)
  • Local search history (used only to make your local ⌘K faster)

Chrome controls this storage. Clearing your browser data clears it. Uninstalling the extension clears it.

What changes when you opt in to cloud sync (Premium)

If you sign in and explicitly enable cloud sync, the extension copies your spaces, collections, cards, and tags to your private account in Firebase Firestore, hosted in the EU (europe-west) region. This is what makes your tabs available on your other devices.

What we collect when cloud sync is enabled:

  • Your account email and display name (from your sign-in provider — Google or email/password)
  • Your synced spaces, collections, cards, tags, notes
  • Subscription status and Stripe customer ID (for billing only)
  • Timestamps so we can resolve conflicts when the same data changes on two devices

We never read the contents of pages you save — only the URL and title that Chrome gives us. We don't scrape or fetch the content of pages on your behalf.

Authentication

Sign-in is handled by Firebase Authentication (Google LLC). When you sign in with Google, Google provides us with your email, name, and avatar URL. When you sign in with email and password, the password is stored as a one-way hash by Firebase — we never see the plain text.

Firebase Auth handles OAuth at auth.amazingtabs.app. Tokens are issued to your browser as short-lived JWTs.

Payments

If you upgrade to Premium or buy a Lifetime Deal, payment is processed by Stripe. We send Stripe your email and the price you selected. Stripe sends us back a customer ID, a subscription ID, and webhook events so we can grant access.

Your card details are entered into Stripe's hosted checkout — they never touch our servers. We can't see them.

Email

We send a small number of transactional emails via Resend (Resend.com): the install link you can request from your phone, payment receipts, password reset emails, and account-related notices. You can opt in to product updates when you request the install link or in your account settings; opting in is never required to use the product.

Analytics on the website

The marketing site (this page, the homepage, pricing) uses PostHog for product analytics. PostHog helps us understand which pages people read and where they drop off so we can write better copy and fix broken funnels.

We send PostHog these things from the website:

  • Pageviews (URL, referrer, language, screen size)
  • Clicks on important elements (the Add to Chrome button, pricing CTAs, FAQ open events)
  • Signed-in account ID (so we can connect a checkout to the right user — never linked back to your tabs)

We do not run PostHog inside the Chrome extension. The extension is fully telemetry-free.

PostHog stores this data on AWS infrastructure. You can opt out of analytics by enabling “Do Not Track” or a cookie/tracker blocker in your browser — the site works fine with analytics blocked.

Cookies

The website sets a small number of cookies:

  • Auth session cookies — set by Firebase after you sign in, so you stay signed in. Cleared on sign-out.
  • Stripe checkout cookies — set by Stripe during checkout for fraud prevention.
  • PostHog analytics cookies — set only after you accept (or your browser allows by default). Cleared on opt-out.
  • Cloudflare cookies — set by our CDN (Cloudflare) for security and bot mitigation.

See /cookies for the detailed cookie list.

Where data lives, and for how long

  • Local-only (no cloud sync): nothing leaves your machine. We have no copy of anything.
  • Cloud sync on (Premium): data lives in Firebase Firestore in the EU. It stays there until you delete the items, disable cloud sync, or delete your account.
  • Subscription records: kept as long as we need them for billing and tax compliance (typically 7 years for invoicing records, per EU rules), then deleted.
  • Mobile install-link emails: stored to send the email and prevent abuse. Deleted within 30 days unless you opted in to product updates.
  • PostHog analytics: rolling 12 months, then aggregated and anonymised.

Your rights (GDPR & friends)

If you're in the EU, UK, California, or another jurisdiction with a privacy law, you have the right to:

  • Ask us what data we hold about you
  • Ask us to correct it
  • Ask us to delete it (the “right to be forgotten”)
  • Export your data in a machine-readable format
  • Object to certain processing

For local-only users, there is nothing for us to delete — we don't have your data. For cloud-sync users, you can delete your account from the Account page and we will hard-delete your records within 30 days. To exercise any other right, email hello@amazingtabs.app.

Sub-processors

We use the following sub-processors to run the service:

VendorPurposeRegion
Google (Firebase)Auth, Firestore, hostingEU (europe-west)
StripePaymentsEU / US
ResendTransactional emailEU
PostHogWeb analyticsUS (AWS)
CloudflareDNS, edge, bot mitigationGlobal

We will update this list before adding a new sub-processor that processes user data.

Children

Amazing Tabs is not directed at children under 13 (or 16 where required by local law). We don't knowingly collect their data. If you believe a child has signed up, email us and we will delete the account.

Changes to this policy

If we make material changes to this policy, we'll post a notice at the top of this page and (for signed-in users) email you. The “Last updated” date at the top reflects the most recent change.

Contact

Privacy questions, deletion requests, or anything else: hello@amazingtabs.app.

Data controller: Loistava Holding Oy, Helsinki, Finland.