Tab Lens Privacy Policy
Last updated: 2026-07-30
Tab Lens processes browsing activity only to let the user search locally for literal text on HTTP(S) websites they explicitly authorize through one Chrome permission prompt and return to the matching Chrome page. Users who do not grant website access can still search titles, URLs, and user-created labels.
Data processed
- Open-tab metadata: page title, full URL, origin, window identifier, recent access time, and tab state.
- Chrome recently-closed metadata: session identifier, title, URL, and close time for up to Chrome's current 25 returned session entries. The Pilot restores only an individual tab that Chrome still exposes and for which either a fresh, complete local body-text capture or a matching user-created label exists.
- After the user chooses the optional all-HTTP(S)-sites authorization action and accepts Chrome's prompt: currently rendered text from an active, non-discarded, non-incognito page covered by that grant.
- Capture provenance: capture time and whether extraction was complete or partial.
- User-created search labels attached either to an exact hostname or to one full page identity. Labels can be searched without website access.
Tab Lens reads rendered text through the page DOM. It does not deliberately read password or input values, cookies, hidden DOM text, network requests, Canvas pixels, or inaccessible cross-origin frames. A page that cannot be read completely is not marked covered. Tab Lens does not create screenshots. When a legacy index is read, schema v3 removes screenshot preview data created by older development builds.
Result favicons come from Chrome's local favicon cache through the required `favicon` permission. Tab Lens does not make a separate request to the corresponding website to obtain an icon.
To preserve the current search when the user returns from a result, the query is kept only in that Tab Lens tab's `sessionStorage`. It is not written to the body-text index and is removed when that tab session ends.
Permission and collection boundaries
Tab Lens does not include `<all_urls>` or `activeTab` in required permissions. It declares HTTP(S) host access only as an optional runtime permission. On first use, the user may click “Agree and authorize all websites once”, which asks Chrome for `http://*/*` and `https://*/*` in one native confirmation. The user may instead keep title/URL-only mode without website text access. Website access is never granted silently.
Collection occurs incrementally when an authorized page is active. Permission is checked before extraction and again before local storage. Searching does not activate, refresh, reload, or wake background tabs and does not require disabling Chrome Memory Saver.
Revoking website access through Chrome removes captured body text no longer covered by any remaining grant while retaining user-created labels. Residual body text is excluded from search whenever the live Chrome permission is absent. Removing the extension through Chrome removes its local extension storage.
Storage and retention
All indexed text and user-created labels stay in the current Chrome profile through `chrome.storage.local`. There is no account, backend, cloud sync, remote content upload, or URL-bearing analytics.
The local index is schema-versioned and limited to 80 page records. Full-page labels share those page records. Hostname labels use a separate versioned store limited to 200 hostnames. Captured text expires 30 days after its own capture time; later page access does not extend old text retention. User-created labels remain until the user edits them, their bounded page record is evicted, or the extension is removed. Cleanup runs daily and at browser or extension startup. Corrupt records are discarded individually so they cannot break the interface.
Sharing and monetization
Tab Lens does not sell browsing data, share it with third parties, use it for advertising, or use it to train models.
Browser actions
Selecting an open result focuses that existing tab and window. Before restoring a recently closed result, Tab Lens checks for an already-open page with the same Page Key and focuses it instead of creating a duplicate. The Pilot does not group, close, discard, or automatically reload tabs.