Privacy policy

1. Who this covers

This policy covers the Tabsend browser extension (Chrome, Edge, Brave and other Chromium browsers, and Firefox), the Tabsend apps for Android and iPhone, the web console, this website, and the hosted Tabsend service. Tabsend is made and run by Zinnia Drive LLC, in the United States. In this policy, "we" means Zinnia Drive LLC.

Tabsend needs a server to pass links along. We call it the relay. There are three ways to use one:

• Your own server. You, or someone you trust, run the relay. We never receive what is on it. This policy then covers only what the Tabsend apps do. Whoever runs the server is responsible for what it keeps. If someone else runs yours, ask them for their policy.
• The hosted service we run. Everything here about "our server" applies. The hosted service is not open yet. Parts of this policy that apply only to it are marked "hosted service", and nothing there is in effect until it opens.
• A server run by someone else. Their policy applies to that server. This one still covers the Tabsend apps.

2. What Tabsend handles

This is the full list. In the table, "your server" means whichever relay your devices are paired with.

Data that leaves your device

What	Why	Where it goes	How long
The links you sendThe web address, page title and page icon of each tab you choose to send	It is the thing you asked Tabsend to deliver.	Locked on your device first. The locked copy goes to your server and on to the device you picked. A second locked copy, for your history, can be opened by your own devices.	A waiting link is erased when the other device confirms it arrived, or after 7 days. The history copy is erased after 30 days. Whoever runs a server can change these numbers on it.
Your devicesThe name you give each one, its type (for example Chrome on Windows), its public encryption key, and a fingerprint of its secret device token	To show your device list, send to the right device, and recognize each device.	Your devices and your server. The server can read these; they are not locked.	Until you remove the device or the group is deleted.
Delivery recordsWhich device sent to which, when, and whether it arrived	To deliver the link and to show your history.	Your server. While it holds a locked message, it also sees how big it is.	Up to 30 days.
Wake-up addressesAn address your browser's push service or your phone's system gives Tabsend	So a link opens right away, instead of when the device next checks in.	Your server. For iPhones, and for Android phones that use Google push, also our wake-up service (section 5). The wake-up message is empty and carries no link.	Until you remove the device or the address stops working.
Network detailsThe IP address your devices connect from, the time, and the address requested	To deliver links, limit abuse and fix problems.	Your server's request logs and short rate-limit counters.	Hosted service: logs for 30 days. Counters are dropped when their time window ends, which is minutes. On your own server, whoever runs it decides.
Your account (hosted service only)Your email address, when your trial or subscription starts and ends, and a Stripe customer number	To send sign-in links and notices, start your trial and bill you.	Our account system, our email delivery service and Stripe. We never see your card number, and the free trial doesn't ask for a card.	While your account exists. Then it is deleted (section 7).
Waiting-list email (this website)The email address you type into the "Get notified" box on tabsend.org	To send you one email when the free trial opens.	A list kept with Cloudflare, which runs this website. Only we can read it. Nothing is sent to you until the trial opens.	Until we send that one email, or until you ask us to delete it.
Messages you send usSupport emails, and anything you put in them	To answer you.	Our email inbox.	Until you ask us to delete them.

What stays on your device

The extension and the apps keep some things on your device only: your encryption keys, your pairing details, your settings, a list of links you recently sent and received (readable, with their addresses and titles), and links waiting to be sent while your server is offline. In a browser, this lives in the extension's own storage. Tabsend adds no encryption of its own there, so it has the same protection as the rest of your browser profile. Removing the extension deletes it.

What Tabsend does not collect

No names, passwords, contacts or location. No page contents, cookies, form entries or saved logins. The extension does not read your browsing history; it reads only the tabs you choose to send. There are no analytics, no advertising identifiers, no crash reports and no fingerprinting, in the extension, the apps or this website. This website sets no cookies and loads nothing from other sites. Like any website, it notes the address, time and IP address of each request. Cloudflare, which serves the site, does this for us.

3. What the extension can reach

Browsers make an extension ask for permissions up front. These are Tabsend's, and what each is for.

Permissions the extension asks for

Permission	What it is for
Tabs	Reads the address, title and icon of the tab you choose to send, and opens tabs that arrive from your other devices.
Storage	Keeps your pairing, keys, settings and tabs waiting to be sent.
Context menus	Adds "Send tab to" and "Send link to" to the right-click menu.
Alarms	Checks your server for arriving tabs on a schedule, and retries sends that were waiting on an offline server.
Offscreen documents	Holds the live connection to your server, so arriving tabs open right away.
Scripting	Shows a short "Sent to" note on the page you sent from. It runs only after you send, only on that tab, and reads nothing from the page.
Notifications	Shows a notice when a tab arrives from another device. It is on by default and you can switch it off in settings. The notice appears on your own screen only.
Access to websites (http and https)	You type the address of your own Tabsend server, and it can be any address, including one on your home network. The extension contacts only that address. The same access lets the "Sent to" note appear on whichever page you sent from.

The extension runs no remote code. Everything it runs is in the package you installed from the store. It loads no scripts or fonts from other sites. When you receive a page, your browser may load that page's icon from the page's own website, as it does when you visit the site.

4. How we use it

We use what is listed in section 2 to move your links between your devices and to run the service that does it. In detail:

• delivering links and showing your history
• keeping the service secure and stopping abuse
• billing you and sending account notices (hosted service)
• answering you when you write to us

We don't use it for advertising, profiling, or credit or lending decisions, and we don't use it to train AI models. We don't sell it. We hold no key to read your links. A person looks at device lists, delivery records or logs only to fix a problem you report, to look into abuse or a security issue, or when the law requires it.

Tabsend's use and transfer of information received through browser extension APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements.

5. Who else gets it

We don't sell or rent your data, and we don't share it for advertising. These are the only others who touch it:

• The operator of your server. That is you if you run it yourself, and us for the hosted service.
• Your browser's push service. To wake the extension, Tabsend signs your browser up with the push service of the company behind it, such as Google for Chrome or Mozilla for Firefox. The wake-up message is empty. That service sees that your browser got a wake-up, and when. It never gets a link.
• Our wake-up service, plus Apple and Google, for phones. A phone can't be woken without Apple's or Google's push service, and those accept requests only from a key we hold. So your server tells our wake-up service to ring your phone, and it asks Apple or Google. This applies to iPhones and to Android phones that use Google push, even when you run your own server. The wake-up service learns that a device got something, and when. It does not learn what, or who sent it. It keeps, for each phone, Apple's or Google's address for it (encrypted), a fingerprint of the phone's token, when it was last rung and how many times. It keeps no record of individual messages.
• The websites you send. When a link opens, your browser loads the page from its site as usual. Tabsend is not part of that visit.
• Cloudflare, for this website. Cloudflare serves tabsend.org and keeps the waiting list. It sees the IP address and request of everyone who visits the site, and the email address of anyone who joins the list.
• Service providers, hosted service. Google Cloud hosts our servers in South Carolina, US. Stripe takes payments. An email delivery service sends sign-in links and notices. Each handles your data only to do that job for us.
• Legal demands. If a valid legal demand arrives, we give only what we hold, which is the list in section 2, and we tell you when we can, unless the law forbids it.
• A sale or handover. If Tabsend is ever sold or handed to someone else, your data moves only if you agree first.

6. Security and its limits

• Links are locked on your device. We use libsodium: X25519 key exchange and XSalsa20-Poly1305 encryption. Each link is locked once for each device that receives it, plus one history copy for your group's devices.
• The hosted service uses HTTPS only. The extension also accepts plain http addresses, so people can use a server on their home network. Links stay locked either way, but device names and delivery details cross a plain http connection in the open. Use https unless the server is on a network you trust.
• The server keeps your device list, and nothing signs it. Someone who broke into the server could add a device to your group. That device could read the links your devices send while it is there, and the last 30 days of history. It would show up in your device list, and each of your other devices checks the list against the one it last saw and shows a notice when a new device appears. We don't read your links, but we can't promise nobody ever could.
• No independent audit. Nobody outside the project has audited Tabsend's security.
• Your devices matter. Anyone who can use your unlocked browser or phone can see its recent links and send from it.

If you find a security problem, please email info@zinniadrive.com with "Tabsend security" in the subject line.

7. Keeping and deleting

• How long things stay is in the table in section 2. Backups of the hosted database roll off after 30 days.
• Remove one device from the device list in any Tabsend app. That removes it from your group, and its wake-up address with it.
• Remove the extension and the browser deletes everything the extension kept. Your server still lists the device until you remove it from the device list.
• Delete your hosted account from your account page, or by email. We then remove your account, your group and everything on the server. Backups roll off within 30 days. Stripe keeps payment records as the law requires.
• If a trial or subscription ends unpaid, the account pauses. Nothing is deleted at first, and your devices stay paired. We email you, and if there is still no payment 90 days later, we delete the account.
• On your own server, you hold everything and you delete it.

8. Your rights

Wherever you live, you can ask us to tell you what we hold about you, correct it, delete it, or send you a copy. Email us. We answer within 30 days. We may ask you to write from your account's email address, so we know the request is yours.

Laws in California and some other US states give these rights too; we apply them to everyone. We don't sell or share personal information as those laws define it. We don't track you across sites, so a "Do Not Track" signal changes nothing. If you think we handled your data wrongly, you can also complain to your local data protection authority.

9. Children

Tabsend is not for children under 13, and we don't knowingly collect their data. A hosted account needs you to be 13 or older. If a child's data reached us, email us and we will delete it.

10. Where data lives

On the hosted service, in the United States, on servers in South Carolina. If you use it from another country, your data goes to the US. On your own server, it lives wherever you run it. This website and its waiting list run on Cloudflare's network, which spreads copies across many countries.

11. Changes

When this policy changes, we change the date at the top. If a change matters, we email hosted-service users first. If a change would alter what the extension handles, we update the store listing before the new version ships.

12. Contact

Zinnia Drive LLC. Questions, requests, or a complaint: info@zinniadrive.com. One person reads it, so replies can take a few days. See also the terms of service.