1. Data stored in the browser

API keys can be kept only in chrome.storage.session or persisted in chrome.storage.local, depending on your choice. Provider settings, quick actions, interface preferences, and imported Skills are stored in chrome.storage.local. Page snapshots, edited source text, page-scoped conversations, model selections, and context state are stored in local IndexedDB, with local storage as a possible fallback.

This data is not synced to a TabTell server. TabTell does not add application-level encryption, so the protections of the browser profile, operating-system account, and device still matter.

Configuration backups contain provider and model selections, quick actions, Skills, and interface preferences. They do not contain API keys, webpage text, or conversations. Custom provider names and endpoints, quick-action prompts, Skill instructions, and readable text resources are included and may contain sensitive information. Review a backup before sharing or storing it.

2. When data leaves the browser

On first use, TabTell shows an in-product data disclosure and waits for confirmation before reading a webpage. You can grant optional website access so TabTell follows ordinary webpages while the side panel is open. If that permission is declined, TabTell limits itself to pages explicitly authorized by the browser where possible. Reading and saving a page does not automatically send its content to a model. Data is transmitted only after you send a question, choose a quick action, test a provider connection, or explicitly start another AI operation.

• A request may include the page title, URL, text, image links, and source text you edited.
• It may include your question, current conversation, quick-action or Skill instructions, model name, and generation parameters.
• Your API key is sent directly to the selected provider or custom endpoint only when you test that connection or make an AI request through it, and only for authentication. It is not sent to the TabTell developer.

Pages and conversations may contain personal, confidential, or sensitive information. Confirm that you may process the content and that the provider and account plan meet your requirements before sending it.

3. Automatic Skill selection

Automatic Skill routing runs only after you start an AI request. Third-party Skills are manual-only when imported unless you later enable automatic matching. TabTell may first send the current question, page title, and candidate Skill names and descriptions to the selected model. If a Skill is selected, its text instructions and a limited set of readable text resources may enter the main request.

TabTell does not execute scripts, shell commands, MCP declarations, or platform-specific permissions found in imported Skill packages. You can select a Skill manually or disable Skills for the next message.

4. Reading a URL you enter

When you ask TabTell to read an explicitly entered URL, the browser connects directly to that website and may use the current browser session. TabTell does not read or retain raw cookie values, but the destination may receive the IP address, ordinary browser request information, and existing session credentials automatically attached by the browser. The destination handles the request under its own policies.

5. Third-party model providers

Retention, human review, model training, and international transfers can differ by provider, region, API product, and account plan. The applicable API terms, privacy notice, data-processing terms, console settings, and account plan govern each provider's actual handling.

• Zhipu AI / BigModel
• DeepSeek
• OpenAI
• Google Gemini
• Anthropic
• Alibaba Cloud Qwen
• Kimi / Moonshot AI
• OpenRouter
• SiliconFlow
• Volcengine Ark

You choose any custom endpoint and are responsible for checking its operator, hosting location, and privacy practices. TabTell cannot control or delete data already received by a third party.

6. What TabTell does not do

TabTell's use of information obtained through Chrome extension permissions complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

The current version has no TabTell backend or cloud account. It contains no advertising, product analytics, behavioral tracking, advertising trackers, or crash reporting. It does not sell, rent, or trade user data, use pages, conversations, or API keys to train a TabTell model, process payment information, or complete purchases inside the extension.

Voluntary support payments are handled directly by the external support service selected by the user or by the developer. Google is not the seller or payment processor for these payments. Support does not unlock features or affect the product experience, updates, or reviews.

7. Retention, export, and deletion

Page conversations and snapshots remain locally without automatic expiration. You can copy content, download Markdown, or use configuration backup to move provider and model selections, quick actions, Skills, and interface preferences between devices. Configuration backups do not contain API keys, webpage text, or conversations.

You can also delete the current page record, delete all page records, or clear API keys, provider settings, quick actions, imported Skills, and all local TabTell data from settings.

You can also remove TabTell from chrome://extensions. Export anything you want to keep first. The developer cannot remotely view, recover, or erase data stored only on your device. Uninstalling does not delete data already sent to a third party.

8. Security and international processing

Built-in remote endpoints use HTTPS, and remote custom endpoints must also use HTTPS. HTTP is accepted only for the local loopback addresses localhost, 127.0.0.1, and [::1]. TabTell does not send an API key over local HTTP. Providers or custom endpoints may process data outside your jurisdiction.

No storage or transmission method is completely secure. Limit API-key permissions, rotate keys when appropriate, and revoke a key in the provider console if misuse is suspected.

9. Minors, changes, and contact

TabTell is not directed to children below the age at which they may independently consent under applicable law. Minors should use it only with a parent or guardian's permission and guidance and must also meet the selected provider's age requirements.

This policy will be updated when TabTell's data handling changes. Changes to data categories, purposes, or recipients will also be disclosed in the extension or release notes.

• Email: iamzhzhang@gmail.com
• Website: TabTell