Privacy policy

Tabcake is a Chrome extension and a web dashboard that turn the pages you read into a personal knowledge base you can search and ask questions. It is run by Abhishek Santosh Gupta (“we”, “us”). For anything in this policy, write to abhishek@tabcake.com.

We only collect what Tabcake needs to work. Here is what we keep.

• Account

  Examples

  Email address; your name, a short line about yourself and an avatar if you add them, or the name and picture Google or GitHub share if you sign in with them; your password, stored only as a hash; your Google or GitHub account ID

  Why

  To sign you in and identify your account

  Kept until

  You delete your account

• Sign-in

  Examples

  Sign-in cookies set by the dashboard; sign-in tokens kept by the extension in your browser

  Why

  To keep you signed in

  Kept until

  You sign out, or they expire

• Pages you read

  Examples

  The page address (with tracking parameters removed), title and readable text, up to 120,000 characters; when and how often you visited

  Why

  This is your knowledge base: what you search and ask

  Kept until

  You forget the page, or delete your account

• What we make from them

  Examples

  A short summary and tags for each page; a search index of the text (embeddings)

  Why

  To find pages by meaning and answer questions

  Kept until

  The page is forgotten

• Video transcripts

  Examples

  The transcript of a YouTube video, only when you press its Remember button

  Why

  To add the video to your knowledge base

  Kept until

  You forget it

• Chat

  Examples

  Your questions and the answers, with the pages they cite

  Why

  To show your conversations

  Kept until

  You delete the conversation or your account

• Settings

  Examples

  Sites you block; sites you allow anyway, with the browser they were allowed from (for example “Chrome on Windows”)

  Why

  To read only what you want read

  Kept until

  You change them, or delete your account

• Usage

  Examples

  How many questions you asked each month, and how many video transcripts you remembered

  Why

  To apply your plan's limit

  Kept until

  You delete your account

• Billing

  Examples

  Your plan and subscription status. Card and payment details stay with Lemon Squeezy and never reach us

  Why

  To give you the plan you paid for

  Kept until

  You delete your account. Lemon Squeezy keeps its own payment records (see below)

The extension reads a page only after it has been visible in your browser for 15 seconds. It then sends the page's address, title and readable text to your account.

It never reads:

• Incognito windows. The extension does not run there at all.
• Sites you block. Some webmail, chat, social, banking and health sites are blocked from the start.
• Anything while you have paused it.
• Pages that are not HTTPS, local or private network addresses, search results pages, very short pages, form-heavy pages, error pages and PDFs.

Before any text leaves your browser, the extension masks email addresses, phone numbers, card numbers, bank account numbers (IBAN), access keys and tokens, and long runs of digits in it. This is pattern matching: it does not catch everything, such as names or addresses written out in a sentence. The page address and title are sent as they are.

The extension asks Chrome only for the storage and alarms permissions, and runs on web pages so it can read them as described above.

We may switch on an optional privacy check. When it is on, a page's address, title and headings (not its text) are sent to an AI model first, to decide whether the page looks private, such as a sign-in or account page. Pages it judges private are not kept. Its decisions are kept for a week, and a site judged private three times is no longer read; you can undo that from the dashboard.

To run Tabcake for you: to keep your pages, search them, write summaries and tags, and answer your questions from them.

• We do not sell your data.
• We do not use your data to train AI models, and we ask our AI provider not to keep it.
• We do not show ads or use advertising trackers.
• We send email only to sign you in, verify your address or reset your password, to reply to you, and to tell you about changes to your plan, its price or these policies.

We use a small number of providers, each only for the job listed.

• Convex

  What it does

  Our database and backend

  What it receives

  Everything in your account

• OpenRouter

  What it does

  Routes requests to the AI models that index pages, write summaries and answer questions. Every request asks for zero data retention

  What it receives

  Page titles and text, your questions and the passages that answer them

• Resend

  What it does

  Sends sign-in, password reset and verification codes

  What it receives

  Your email address

• Lemon Squeezy

  What it does

  Payments, billing and order fulfillment, as our Merchant of Record

  What it receives

  What you enter at checkout

• Google, GitHub

  What it does

  Sign-in, only if you choose it

  What it receives

  What you approve on their sign-in screen

• Langfuse

  What it does

  Monitors the quality and cost of AI answers, only while we have monitoring switched on

  What it receives

  A coded account ID (not your email) and short excerpts, up to 120 characters, of page text, questions and answers

• Vercel

  What it does

  Hosts this website and the dashboard

  What it receives

  Standard request logs

We use Lemon Squeezy for payment processing, billing, and order fulfillment. Lemon Squeezy acts as our Merchant of Record and handles user transaction data securely in compliance with global standards.

We keep your data until you remove it. You can:

• Forget a page, a whole site, a range of dates, or everything. The page, its text and its search index are deleted. Old answers that cited it no longer name or quote it, but the answer's own words stay until you delete that conversation.
• Delete your account. This is permanent. It deletes your profile, your pages, their index, your conversations, your settings and your usage, and signs out every device within an hour. Monitoring records (see Langfuse above) are deleted too.

Lemon Squeezy keeps its own records of payments for as long as tax law requires them.

From your dashboard you can, at any time and on every plan:

• see the exact text kept for any page;
• export all your pages as JSON or Markdown, and any conversation as Markdown;
• update your name and avatar;
• block or allow sites, and pause the extension;
• forget pages, sites or dates, or delete your account.

For anything else, such as a copy of your data in another form, a correction, or an objection, write to abhishek@tabcake.com from the email address on your account. Depending on where you live, you may also have the right to complain to your data protection authority.

Data moves between your browser, the extension and our servers over encrypted connections (HTTPS and secure WebSockets). Secrets in page text are masked in your browser before sending. The extension is linked to your account with a single-use code that expires after two minutes. Deleting your account needs a recent sign-in. No system is perfectly secure, and Tabcake does not offer end-to-end encryption: our servers can read your pages so they can search them and answer questions.

This website sets no cookies and runs no analytics. The dashboard sets cookies only to keep you signed in.

Tabcake is not meant for children under 16, and we do not knowingly collect their data. If you think a child has given us data, write to abhishek@tabcake.com and we will delete it.

If we change what we collect or who processes it, we will update this page and its date, and for significant changes tell you by email before they apply.

Abhishek Santosh Gupta

Email: abhishek@tabcake.com

Post: Abhishek Santosh Gupta B 411, Kashidham Apt, Bolinj-Sopara Road Near Max Valley, Bolinj, Virar West Palghar, Thane, Maharashtra 401303 IN

Or see the contact page.