Privacy policy

Last updated: 2026-10-29

Who is responsible (data controller)

The controller for all personal data processed by Tabio is:

Cael Rowley, trading as Clorostica
Hermannstraße 18, 12049 Berlin, Germany
clorostica@proton.me

Tabio is a sole proprietorship run by one person (see the imprint); "we" and "us" below mean Cael Rowley. We have not appointed a Data Protection Officer, as none is required for processing of this scale and nature. For all privacy matters, email the address above.

Summary

Tabio is designed so that the operator cannot read the contents of your bookmarks. Bookmark titles, URLs, and folder structure are encrypted on your device with AES-256-GCM before they are transmitted. The key that encrypts them is generated on your device and protected by a passphrase you choose. It never leaves your device in a form anyone else can use: the server stores only a copy locked with your passphrase, which we cannot open. The server only ever sees ciphertext.

End-to-end encryption

When you set a passphrase, Tabio generates a random AES-256 data key on your device and encrypts your bookmarks with it. A second key is derived from your passphrase using PBKDF2-SHA256 (600,000 iterations, per-account salt) and used to lock ("wrap") the data key. Only that wrapped copy is uploaded, so your devices can share one data key; without your passphrase it is ciphertext we cannot open. Your passphrase is never stored or sent anywhere. The unlocked data key is held in memory and in your browser's session storage, which the browser clears when it closes, and is never sent to the server.

Every bookmark record is encrypted with AES-256-GCM before being uploaded. The server, the hosting provider, and the operator of this service receive only opaque ciphertext and have no technical means to decrypt it. Even with full access to the database, the contents of your bookmarks cannot be recovered without your passphrase or your recovery code. What the server can see is limited to metadata: how many profiles you have, their colour and order, when each was last synced, and the size of each encrypted blob, which gives a rough idea of how many bookmarks it holds but nothing about what they are. Because anyone who obtained the database could try to guess weak passphrases offline, choose a long one that you do not use anywhere else, and do not reuse your account password.

When you first set a passphrase, Tabio also generates a recovery code on your device and shows it to you once. The same encryption key is wrapped a second time under that code, so either your passphrase or your recovery code can unlock your bookmarks. The code itself is never transmitted to us: we hold only the two wrapped copies of the key, both of which are ciphertext we cannot open.

This design has a trade-off: the recovery code is the only way back in if you forget your passphrase. If you lose both, your encrypted bookmarks cannot be recovered by anyone, including us. We cannot see your recovery code, reset it, or restore your data on your behalf.

What we store

The data we hold falls into two categories:

Encrypted on your device before it reaches our server:

• Bookmark titles, URLs, descriptions, and folder structure.
• Profile names you create inside the extension.

Stored in plaintext (we can read this):

• Your email address, provided when you sign in through WorkOS AuthKit.
• An opaque user identifier issued by WorkOS, used to scope your data.
• Your subscription status and billing identifiers held by Stripe.
• Timestamps recording when records were created, updated, or last synced.
• Rate-limiting counters keyed by your user id (kept only transiently, never in the database).
• Short-lived operational error logs. These record what failed, not who: our own log messages carry no email addresses, user identifiers, or request contents, and error text received from third-party providers has identifiers redacted before it is logged.

Why we process it (legal bases)

• Performing our contract with you (Art. 6(1)(b) GDPR): your email, user identifier, encrypted bookmark data, and subscription state are processed to provide sign-in, sync, and billing. Without them the service cannot work.
• Legitimate interests (Art. 6(1)(f)): rate-limiting counters and operational error logs are processed to keep the service secure and reliable. Error logs contain no identifiers. Rate-limiting counters are keyed by your account id, your IP address, or, on the sign-in and password-reset forms, a one-way hash of the email address entered; they are held for about a minute and are never written to our database.
• Preventing repeat free trials (Art. 6(1)(f)): if you delete an account that has used the free trial, we keep a one-way hash of its email address, solely so the same address cannot claim the free trial again. We retain it only while necessary for this purpose, for at most 12 months after account deletion. See "Data retention and deletion" below.
• Legal obligations (Art. 6(1)(c)): invoices for your subscription are retained by Stripe for as long as tax law requires, even after you delete your data.

For bookmark sync and account management, we do not process personal data on the basis of consent. We send no marketing and make no automated decisions about you.

What we do NOT store

• Your passphrase, your recovery code, or any key derived from either of them.
• Bookmark contents in any form we can decrypt.
• Your browsing history. Tabio only handles bookmarks. Pages you visit but do not bookmark are never sent to our servers.
• Page contents, screenshots, cookies, or session tokens from sites you visit.
• Advertising identifiers, cross-site tracking data, or behavioural analytics.

Permissions used only on your device

Two browser permissions are used purely on your device and never result in data being sent to our servers:

• History (only if you turn it on): Tabio reads the last-visit time of pages you have already bookmarked to power the optional stale-bookmarks check, which surfaces bookmarks you haven't opened in a long time. The check is off by default, and your browser asks for this permission when you switch it on (versions before 0.2.6 requested it at install). This lookup happens locally; your browsing history is never stored or transmitted.
• Favicons: site icons shown next to your bookmarks are read from the browser's local favicon cache for sites you have bookmarked.

Data kept on your own device

The extension keeps some data in your browser's local storage. It never leaves your device, but on a shared computer anyone using the same browser profile could read it, so we list it here:

• Preferences (theme, language, reminder settings): kept across sign-out so your appearance choices survive.
• Recovery snapshots: before Tabio ever overwrites your browser bookmarks (for example when switching accounts or choosing "replace" at sign-in), it saves an unencrypted local copy (bookmark titles, URLs and folders, plus the profile name; at most the five most recent) so nothing is silently lost. These snapshots deliberately survive sign-out so a previous account's bookmarks stay recoverable; you can view, export, or delete them under Settings → Security → Bookmark recovery, and they are removed when you delete your account from the extension.
• Favicon cache: icons for bookmarked sites, stored locally for fast display. Cleared automatically when you sign out, reset your data, or delete your account.
• Last-used profile marker: an opaque account/profile identifier kept across sign-out so a returning device lands on the right profile. It contains no readable personal information.
• Web account portal: signing in at tabio.clorostica.com stores your session token in that browser's local storage (strictly necessary; no cookies, no trackers).

Third parties

The service runs on the following providers. Each one only sees the data it strictly needs.

• Cloudflare: hosts the API (Workers), the ciphertext database (D1), and these pages (Pages), and delivers our transactional email. It sees only encrypted bookmark data, plus the address and contents of any email we send you.
• WorkOS: handles authentication (email and password, optional OAuth). Holds your email address and authentication metadata.
• Stripe: processes subscription payments as merchant of record through its Link service, which is why receipts and invoices come from Link and the charge reads LINK.COM*. Stripe holds your billing details (card or bank information, billing address, and any Link account you create) directly under its own privacy policy; Tabio receives only the customer and subscription identifiers, never your payment instrument.

The Tabio extension and account portal do not load third-party analytics, advertising, or tracking scripts. No personal data is sold or shared for marketing purposes.

Homepage video

The homepage embeds a video using YouTube's privacy-enhanced player. When you visit the homepage, your browser connects to YouTube, which receives your IP address, browser information, and this website's origin. The video does not play automatically. YouTube may store data on your device when you use the player. See Google's privacy policy.

Where your data is stored, and international transfers

Encrypted bookmark data is stored in a Cloudflare D1 database. Cloudflare may replicate data across regions for availability; the ciphertext design means the storage region does not affect the confidentiality of your bookmarks. WorkOS and Stripe each operate their own regional infrastructure as described in their respective privacy policies.

Cloudflare, WorkOS, and Stripe are US-headquartered companies, so the plaintext data they process for us (your email, authentication metadata, and billing details, never your bookmark contents) may be transferred to the United States. These transfers are protected by each provider's certification under the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses incorporated in their data processing agreements.

Data retention and deletion

Except for the limited retention described below, we keep your data only while your account exists. You can delete individual bookmarks and profiles from inside the extension at any time; deletions are removed from our database immediately. Deleted rows can persist for up to 30 days in Cloudflare's automatic database backups (used solely for disaster recovery, ciphertext only) before ageing out. Operational error logs are short-lived and contain no identifiers.

Self-service options are available to remove larger sets of data:

• Cancel subscription: stops your billing. Your sign-in and your encrypted bookmarks are kept; you can resubscribe at any time. German law requires us to confirm a cancellation in text form. For the public form we record your declaration, email its receipt to the address of the matching Tabio account (only if that account has a subscription), and process the contract using the original receipt time. We keep the declaration and delivery records as described below.
• Delete billing data: deletes your customer record at Stripe (your email and payment method held there) and ends any subscription, while keeping your account, sign-in, and bookmarks. Stripe retains past invoices only for as long as tax law requires.
• Reset bookmarks: wipes every bookmark, profile, and the encryption key bundle held on your behalf. Your account and subscription are kept. Useful if you have lost your passphrase and want to start fresh.
• Delete account: irreversibly ends any subscription (including one you have just paid for but that has not yet been linked to your account) and deletes your Stripe customer record (past invoices are retained by Stripe only as required by tax law), every bookmark and encryption key we hold for you, and your WorkOS sign-in record. If the sign-in removal step ever fails, we tell you immediately and running "Delete account" again finishes the job.

Trial eligibility after account deletion. If the deleted account had used the free trial, we keep a one-way hash of its email address and the date it was stored, and nothing else: no name, bookmarks, billing details, or account identifier. We cannot read the address back out of the hash, but it can be matched against an address someone already knows, so we treat it as personal data. Its only use is to recognise that address if it signs up again, to prevent repeat free trials. This is based on our legitimate interest (Art. 6(1)(f) GDPR) in preventing trial abuse. We retain the hash and its storage date because otherwise deleting an account and signing up again with the same address would allow repeated free trials without paying for the service. Keeping this limited record lets us prevent that without retaining your deleted account or requiring a payment method to try Tabio. We use it only while necessary for this purpose. Automatic cleanup starts at 11 months and 25 days after account deletion, ahead of our maximum retention of 12 months. We delete the record sooner, without undue delay, if it is no longer needed, including if Tabio stops offering free trials. Once the record is deleted, it no longer prevents that address from claiming a free trial if one is offered.

Cancellation and withdrawal declarations. When you submit either public form, we store the declaration, your name if supplied, account email, the subscription you selected, cancellation type, requested termination date and cause where applicable, receipt time, and email-delivery and resolution status. If the account email belongs to a Tabio account, we email the receipt to that account address and store the identifier of the account's latest subscription, if any, and, for a cancellation, the date your contract ends. We never email an address that has no Tabio account. These records are separate from your account and survive its deletion. We use them to process your declaration and provide the legally required receipt (Art. 6(1)(b) and (c) GDPR), and to document how it was handled and defend legal claims (Art. 6(1)(f)). Resolved records are automatically deleted after the end of the year of receipt plus three years; unresolved declarations are kept while handling is necessary. We review requests for earlier erasure individually. The consumer receipt and operator notification are sent by our email provider; delivery failures are retried automatically.

Pro-rata refunds. When we refund the unused part of a renewed yearly subscription, we keep a record of the Stripe subscription and invoice identifiers, the amount and currency, and when it was made, so that a payment is never refunded twice and we can show what we paid back (Art. 6(1)(c) and (f) GDPR). It contains no name, email or payment details, survives account deletion, and is deleted after the end of the year of the refund plus three years.

Deleting billing data, resetting bookmarks, and deleting your account require you to confirm it's really you, by re-entering your account password or, if you signed in with Google or another external provider, by re-authenticating with that provider. Cancelling a subscription does not require password re-entry; you can also use the cancellation page without signing in or opening an emailed link. The withdrawal form also needs no sign-in. Neither form automatically changes billing based solely on a submitted email address. None of these actions require your encryption passphrase. Account management is available from two surfaces, whether or not the extension is installed:

• From the extension: open Tabio, then Settings → Account. The same actions are also surfaced if you are locked out of your vault or if your subscription has expired.
• From the web: sign in at tabio.clorostica.com/account with your Tabio email and password. No extension required.

If neither path works for any reason, email clorostica@proton.me and we will process the request within one month.

Your rights (EU/UK users)

Under the GDPR you have the right to access, correct, or delete the personal data we hold about you, the right to receive it in a portable format, and the right to object to or restrict its processing. Bookmark export (Settings → Export bookmarks) gives you your data as a standard HTML file any browser can import; the deletion rights are self-service as described above. For anything else, or if a self-service path fails, contact clorostica@proton.me and we will respond within one month. You may also lodge a complaint with the data protection authority in your country of residence; in Germany this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Changes to this policy

If we change this policy in a way that materially affects how we handle your data, we will notify users by email before the change takes effect.

Contact

For any privacy question, contact clorostica@proton.me. We do our best to reply within one month, and usually much sooner. For general help, see the support page; the controller's full details are in the imprint.