← Back

Privacy policy

Last updated: 2026-09-16

Who is responsible (data controller)

The controller for all personal data processed by Tabio is:

Cael Rowley, trading as Clorostica
Hermannstraße 18, 12049 Berlin, Germany
clorostica@proton.me

Tabio is a sole proprietorship run by one person (see the imprint); "we" and "us" below mean Cael Rowley. We have not appointed a Data Protection Officer, as none is required for processing of this scale and nature. For all privacy matters, email the address above.

Summary

Tabio is designed so that the operator cannot read the contents of your bookmarks. Bookmark titles, URLs, and folder structure are encrypted on your device with AES-256-GCM before they are transmitted. The encryption key is derived from a passphrase you choose and never leaves your device. The server only ever sees ciphertext.

End-to-end encryption

When you set a passphrase, Tabio derives an AES-256 encryption key from it using PBKDF2-SHA256 with a per-account salt. That key, and the passphrase it is derived from, are held only in memory on your device and are never sent to the server.

Every bookmark record is encrypted with AES-256-GCM before being uploaded. The server, the hosting provider, and the operator of this service receive only opaque ciphertext and have no technical means to decrypt it. Even with full access to the database, the contents of your bookmarks cannot be recovered without your passphrase.

This design has a trade-off: if you lose your passphrase, your encrypted bookmarks cannot be recovered by anyone, including us. There is no recovery mechanism by design.

What we store

The data we hold falls into two categories:

Encrypted on your device before it reaches our server:

• Bookmark titles, URLs, descriptions, and folder structure.
• Profile names you create inside the extension.

Stored in plaintext (we can read this):

• Your email address, provided when you sign in through WorkOS AuthKit.
• An opaque user identifier issued by WorkOS, used to scope your data.
• Your subscription status and billing identifiers held by Stripe.
• Timestamps recording when records were created, updated, or last synced.
• Rate-limiting counters keyed by your user id (kept only transiently, never in the database).
• Short-lived operational error logs. These record what failed, not who: our own log messages carry no email addresses, user identifiers, or request contents, and error text received from third-party providers has identifiers redacted before it is logged.

Why we process it (legal bases)

• Performing our contract with you (Art. 6(1)(b) GDPR): your email, user identifier, encrypted bookmark data, and subscription state are processed to provide sign-in, sync, and billing. Without them the service cannot work.
• Legitimate interests (Art. 6(1)(f)): rate-limiting counters and operational error logs are processed to keep the service secure and reliable. They are minimal, short-lived, and contain no identifiers.
• Legal obligations (Art. 6(1)(c)): invoices for your subscription are retained by Stripe for as long as tax law requires, even after you delete your data.

We do not process any personal data on the basis of consent, we send no marketing, and we make no automated decisions about you.

What we do NOT store

• Your passphrase or any key derived from it.
• Bookmark contents in any form we can decrypt.
• Your browsing history. Tabio only handles bookmarks. Pages you visit but do not bookmark are never sent to our servers.
• Page contents, screenshots, cookies, or session tokens from sites you visit.
• Advertising identifiers, cross-site tracking data, or behavioural analytics.

Permissions used only on your device

Two browser permissions are used purely on your device and never result in data being sent to our servers:

• History: Tabio reads the last-visit time of pages you have already bookmarked to power the optional "forgotten bookmarks" reminder, which surfaces bookmarks you haven't opened in a long time. This lookup happens locally; your browsing history is never stored or transmitted.
• Favicons: site icons shown next to your bookmarks are read from the browser's local favicon cache for sites you have bookmarked.

Data kept on your own device

The extension keeps some data in your browser's local storage. It never leaves your device, but on a shared computer anyone using the same browser profile could read it, so we list it here:

• Preferences (theme, language, reminder settings): kept across sign-out so your appearance choices survive.
• Recovery snapshots: before Tabio ever overwrites your browser bookmarks (for example when switching accounts or choosing "replace" at sign-in), it saves an unencrypted local copy so nothing is silently lost. These snapshots deliberately survive sign-out so a previous account's bookmarks stay recoverable; you can view, export, or delete them under Settings → Security → Bookmark recovery, and they are removed when you delete your account from the extension.
• Favicon cache: icons for bookmarked sites, stored locally for fast display. Cleared automatically when you sign out, reset your data, or delete your account.
• Last-used profile marker: an opaque account/profile identifier kept across sign-out so a returning device lands on the right profile. It contains no readable personal information.
• Web account portal: signing in at tabio.clorostica.com stores your session token in that browser's local storage (strictly necessary; no cookies, no trackers).

Third parties

The service runs on the following providers. Each one only sees the data it strictly needs.

• Cloudflare: hosts the API (Workers), the ciphertext database (D1), and these pages (Pages). Sees only encrypted bookmark data.
• WorkOS: handles authentication (email and password, optional OAuth). Holds your email address and authentication metadata.
• Stripe: processes subscription payments as merchant of record through its Link service, which is why receipts and invoices come from Link and the charge reads LINK.COM*. Stripe holds your billing details (card or bank information, billing address, and any Link account you create) directly under its own privacy policy; Tabio receives only the customer and subscription identifiers, never your payment instrument.

Tabio does not load third-party analytics, advertising, or tracking scripts. No personal data is sold or shared for marketing purposes.

Where your data is stored, and international transfers

Encrypted bookmark data is stored in a Cloudflare D1 database. Cloudflare may replicate data across regions for availability; the ciphertext design means the storage region does not affect the confidentiality of your bookmarks. WorkOS and Stripe each operate their own regional infrastructure as described in their respective privacy policies.

Cloudflare, WorkOS, and Stripe are US-headquartered companies, so the plaintext data they process for us (your email, authentication metadata, and billing details, never your bookmark contents) may be transferred to the United States. These transfers are protected by each provider's certification under the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses incorporated in their data processing agreements.

Data retention and deletion

We keep your data only while your account exists. You can delete individual bookmarks and profiles from inside the extension at any time; deletions are removed from our database immediately. Deleted rows can persist for up to 30 days in Cloudflare's automatic database backups (used solely for disaster recovery, ciphertext only) before ageing out. Operational error logs are short-lived and contain no identifiers.

Self-service options are available to remove larger sets of data:

• Cancel subscription: stops your billing. Your sign-in and your encrypted bookmarks are kept; you can resubscribe at any time.
• Delete billing data: deletes your customer record at Stripe (your email and payment method held there) and ends any subscription, while keeping your account, sign-in, and bookmarks. Stripe retains past invoices only for as long as tax law requires.
• Reset bookmarks: wipes every bookmark, profile, and the encryption key bundle held on your behalf. Your account and subscription are kept. Useful if you have lost your passphrase and want to start fresh.
• Delete account: irreversibly ends any subscription (including one you have just paid for but that has not yet been linked to your account) and deletes your Stripe customer record (past invoices are retained by Stripe only as required by tax law), every bookmark and encryption key we hold for you, and your WorkOS sign-in record. If the sign-in removal step ever fails, we tell you immediately and running "Delete account" again finishes the job.

Each action requires you to confirm it's really you, by re-entering your account password or, if you signed in with Google or another external provider, by re-authenticating with that provider. None of them require your encryption passphrase. All of these actions are reachable from two surfaces, so they remain accessible whether or not the extension is currently installed:

• From the extension: open Tabio, then Settings → Account. The same actions are also surfaced if you are locked out of your vault or if your subscription has expired.
• From the web: sign in at tabio.clorostica.com/account with your Tabio email and password. No extension required.

If neither path works for any reason, email clorostica@proton.me and we will process the request within one month.

Your rights (EU/UK users)

Under the GDPR you have the right to access, correct, or delete the personal data we hold about you, the right to receive it in a portable format, and the right to object to or restrict its processing. Bookmark export (Settings → Export bookmarks) gives you your data as a standard HTML file any browser can import; the deletion rights are self-service as described above. For anything else, or if a self-service path fails, contact clorostica@proton.me and we will respond within one month. You may also lodge a complaint with the data protection authority in your country of residence; in Germany this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Changes to this policy

If we change this policy in a way that materially affects how we handle your data, we will notify users by email before the change takes effect.

Contact

For any privacy question, contact clorostica@proton.me. We do our best to reply within one month, and usually much sooner. For general help, see the support page; the controller's full details are in the imprint.