ExtLab Sessions privacy policy

ExtLab Sessions reads the titles and URLs of your open tabs and keeps them in your browser, so that it can save and back them up. We do not collect them, and we do not collect the content of pages, your name or your email address. Your data stays in your browser unless a section below says otherwise.

Permissions

• tabs: Reads the titles and URLs of your open tabs to save and back them up, and opens and closes tabs when you restore or save and close.
• tabGroups: Saves the name, colour and collapsed state of your tab groups, and restores them.
• storage: Keeps your sessions, backups and settings in your browser.
• unlimitedStorage: Lets large sessions and the backup history grow past the browser default of 10 MB, on your computer.
• alarms: Takes a backup snapshot every few minutes, runs one daily check of your license, and syncs with Pro.
• favicon: Shows each site's icon next to saved tabs, from Chrome's own icon cache. Nothing is downloaded.

Your tabs

Saved sessions and automatic backups hold the title and URL of each tab, whether it is pinned, its tab group's name, colour and collapsed state, and the size and place of each window. They are stored in your browser with chrome.storage.local. The extension does not read what is on the pages, and it does not read your browsing history list. Incognito windows are never backed up.

Backups go back 7 days, or 90 days with Pro. A deleted session stays in the trash for 30 days. Chrome deletes all of this data when you remove the extension, so export your sessions first if you want to keep them.

Anonymous usage statistics

The extension sends install, update, uninstall and daily activity events, plus error reports with URLs and file paths removed. Each event holds a random install id, the extension version, your browser language and whether Pro is active. We delete events after 90 days. Turn this off at any time in the extension's options page.

License keys

Gumroad handles payment and is the merchant of record. ExtLab never sees your card. When you activate a key, the extension sends it to https://api.extlab.app, and we check it with Gumroad. We store a hash of the key, its plan and expiry, and the random install ids using it.

Synced data

Sync is off until you turn it on with a passphrase, and it needs an active Pro license. It sends saved sessions, never backups. Before a session leaves your device, it is compressed and encrypted with AES-256-GCM under a key made from your passphrase with PBKDF2-SHA-256. The passphrase never leaves your device, and the key is kept in your browser. Our servers store the encrypted text tied to the hash of your license key, with each session's random id, the time of each change and its size. We cannot read your sessions, and nobody can recover them if the passphrase is lost. You can turn sync off and delete the server copies in the extension.

Sharing

We do not sell data. Gumroad handles payments and license checks. Cloudflare runs our API and Turso hosts our database, and both process data only to provide those services. See the ExtLab privacy policy for details and your rights.

Contact

Questions or a deletion request: [email protected].