Privacy Policy

Effective Date: June 22, 2026

This Privacy Policy explains how Tabrador ("we," "us," or "our") collects, uses, and protects your information when you use the Tabrador web application and Chrome extension (collectively, "the Service"). We take your privacy seriously and are committed to being transparent about our practices.

1. Information We Collect

Information You Provide

When you create an account or use the Service, we collect:

• Email address — used for account creation, authentication, and transactional emails (such as password resets)
• Password — stored as a hashed value; we never store your plain-text password
• Work role — collected once during onboarding to help us improve the product experience
• Workspace and resource data — the workspace names, URLs, notes, and related content you add to Tabrador

Information Collected Automatically

When you use the Service, we automatically collect limited operational data:

• Authentication tokens — to keep you logged in securely
• Timestamps — such as when workspaces were created or last opened
• Usage counts — such as the number of tabs you have opened through Tabrador (used to calculate your time-saved metric)

We do not use third-party analytics, advertising trackers, or behavioral tracking tools. We do not use cookies beyond what is strictly necessary for authentication.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and keep your account secure
• Send transactional emails such as password reset links
• Display personalized features such as your time-saved metric and recently used workspaces
• Improve and develop the Service based on aggregate usage patterns

We do not sell your personal information. We do not use your data for advertising purposes.

3. Information Sharing

We do not sell, rent, or share your personal information with third parties for their own marketing or commercial purposes.

We may share your information only in the following limited circumstances:

• Service providers: We use Railway (infrastructure hosting) and Resend (transactional email) to operate the Service. These providers process your data only as necessary to provide their services to us and are bound by appropriate data processing obligations.
• Legal requirements: We may disclose your information if required to do so by law or in response to valid legal process.
• Business transfer: In the event of a merger, acquisition, or sale of the Service, your information may be transferred as part of that transaction. We will notify you before your information is subject to a different privacy policy.

4. Data Storage and Security

Your data is stored in a PostgreSQL database hosted by Railway on infrastructure located in the United States. Railway provides encryption at rest and in transit at the infrastructure level.

All communication between your browser or extension and our servers is encrypted using HTTPS/TLS.

We implement reasonable technical and organizational security measures to protect your data. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

5. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within a reasonable period, except where we are required to retain it for legal or operational reasons.

6. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal data, including:

• Access: You may request a copy of the personal data we hold about you
• Correction: You may update your account information at any time through account settings
• Deletion: You may request deletion of your account and associated data
• Portability: You may request an export of your workspace and resource data

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

7. Children's Privacy

The Service is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us and we will delete it promptly.

8. International Users

Tabrador is operated from the United States. If you access the Service from outside the United States, please be aware that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR, including the right to lodge a complaint with your local supervisory authority. Our lawful basis for processing your data is the performance of our contract with you (providing the Service) and our legitimate interests in operating and improving the Service.

9. Chrome Extension

The Tabrador Chrome extension operates with the following permissions:

• Tab access — to read the URL and title of your current tab so you can save it to a workspace
• All tabs access — to enable the Capture Session feature, which snapshots all open tabs in your current window

The extension does not read page content, form data, passwords, or browsing history. It does not transmit any tab information without your explicit action (such as clicking Add Resource or Capture Session).

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice in the application. The effective date at the top of this page indicates when the policy was last updated.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy, please contact us at:

Email: [email protected]

We will respond to your inquiry within 30 days.