Privacy Policy
Last updated: 2026-11-03
The short version
- Weaver works without an account, and an account is optional. Your Spaces, bookmarks and notes are not uploaded to our servers unless you sign in and turn on Sync.
- Separately, to show site icons your browser may contact third-party servers, including Google, which may receive the hostnames of the sites involved when a request is sent (see “Site icons” below). This can happen even without an account, and requests may be served from cache.
- We collect only what we need to run Sync and your subscription. AI features are planned, not yet available, and are not covered by this policy; no AI features are included in any current plan.
- We don’t show ads or sell your data. We don’t use your bookmarks or browsing history for advertising.
- You can export your bookmarks and clear the data stored on your device at any time. You can delete a cloud account from the extension if it has no checkout or billing history; if it does, you may need to contact support (see “Your choices and rights”).
Who we are
Weaver (“we”, “us”) is a browser extension and online service built and run by a single independent developer — it is not operated by a company, and the developer is based in mainland China. For the purposes of data protection law, that developer is the controller of the personal data described in this policy. There is no separate data protection officer; you can reach us about anything in this policy, including any right described below, at support@weavertab.work. That is a role address that forwards to the developer — no personal mailbox or home address is published.
Data stored on your device
Your Spaces, folders, bookmarks, sticky notes and settings are stored in Chrome’s extension storage on your computer. The list of your open tabs and your browsing history (the last 60 days) are read locally by the extension to show them on your new tab; they are not part of what Sync uploads. If you save a page as a bookmark, it becomes bookmark data like any other. Showing the Recent list may also trigger icon requests to Google, described under “Site icons” below.
Signing in on our website. If you sign in on our website (for example, the account page), the website keeps its sign-in session in your browser’s local storage, under a key separate from the extension’s own storage. The website uses that key to decide whether to show you as signed in, and signing out on the website removes it. The website session is separate from the extension session.
Data we process when you use online features
| Feature | What we process | Why |
|---|---|---|
| Account | Email address, name and avatar from your sign-in provider (Google, GitHub or email), sign-in timestamps, device names you register | To identify you and secure your account |
| Weaver Sync (Pro) | Your Spaces, folders, bookmarks (titles, URLs and the icon address stored with each bookmark), sticky notes (text and layout), a small set of display preferences, your device identifier and device name, named restore points and an automatic recovery history | To keep your devices in sync and let you restore earlier versions |
| Subscription | Plan, status, renewal dates and an order reference. Card details are handled by our payment partner and never reach us. | To provide Weaver Pro |
| Weaver Pro trial | That the 14-day trial was started, its start and end dates, and the plan it applied to | To provide the trial and decide whether a trial is still available for the account |
| Auto-renewal consent | When you start a paid checkout: the version of the subscription disclosure you accepted, the plan, its price, currency and the seller named at checkout, and the time you gave consent | To keep a record that automatic renewal was disclosed and accepted before charging |
| Service logs | Request metadata such as timestamps, error codes and coarse region, without bookmark contents | Security, abuse prevention and debugging |
Site icons (requests to third parties)
Weaver shows a small icon next to links. These icons are loaded by your browser directly from third-party servers, without an account and whether or not Sync is on. These requests do not pass through our servers and we do not receive them. Your browser or the third party may serve a request from cache, so not every displayed icon causes a new network request.
- Google. In some places Weaver builds an icon address of the form
https://www.google.com/s2/favicons?sz=…&domain=<hostname>and your browser may request it. The address contains only the site’s hostname (for exampleexample.com), not the full page address. When a request is sent, Google receives that hostname together with the technical information any web request carries, such as your IP address and other standard request metadata. Google’s own privacy policy applies to what it does with it.- Recent list: while the Recent (recently visited) list in the sidebar is shown, the browser requests (or reuses from cache) an icon for each visible entry, so the hostnames of those pages from your browsing history (last 60 days) may be sent to Google. This list is on by default and can be turned off in Settings (“Show recently visited”).
- Links you add by hand or paste, and Recent entries you drag into a folder: the Google icon address is saved with the bookmark and requested (or reused from cache) when the bookmark is displayed. If Sync is on, that saved address is uploaded to us with the bookmark. Weaver currently has no setting to turn off this icon loading.
- The sites themselves. For open tabs, and for bookmarks you saved from open tabs, the icon address is the one your browser reports for that page. Displaying it may contact whichever server hosts that icon, which is typically the site you visited or a service it uses. We do not control those servers.
Service providers
We rely on a small number of providers. Some process data on our behalf under contract; others act as independent controllers for their own part of the service:
- Supabase — authentication, database and server functions (account, sync and billing data). It hosts this data for us as a processor; see the note on international transfers below.
- Waffo Pancake — payment processing as merchant of record; it is the seller of record for your subscription and handles tax. For payment data it acts as an independent controller: see Waffo’s privacy policy.
- Resend — delivers sign-in codes and service email. It processes your email address as our processor, only to send those messages.
- Cloudflare — hosting for our website, and forwarding of email sent to our support address.
Google’s icon service is not one of these providers: your browser contacts it directly, as described under “Site icons”.
Data may be processed in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.
Retention
- Sync data: kept while your account is active. Named restore points are kept until you delete them (up to 50). When Sync saves a new version, the automatic recovery history is pruned: it keeps the 20 most recent versions and the last version for each day in the preceding 30 days. The 20 most recent versions can be older than 30 days; pruning takes place when a new version is saved.
- Account data: when an account is deleted from the extension, its account and sync data are deleted from the live database. Residual copies may remain in our hosting provider’s encrypted backups until those backups expire, which is normally within 30 days. For accounts with checkout or billing history that need support’s help, we do not state a deletion time here.
- Billing records: kept for as long as applicable tax and accounting law requires, and while needed to avoid duplicate or incorrect charges and to resolve payment disputes.
- Trial and consent records: the trial record and the auto-renewal consent record described above are kept while your account exists. If you delete your account, the consent record is kept in an anonymous form that is no longer linked to you, as evidence that the required disclosure was made and accepted.
- Service logs: kept for a short operational period so we can secure the service and debug problems. They are not used for advertising or to build profiles.
Your choices and rights
- Export — export your bookmarks at any time from Settings (JSON or HTML), and request a copy of your account data.
- Clear local data — you can clear the data stored on a device from Settings in the extension, at any time and without an account. Deleting your cloud account does not delete the bookmarks stored on your devices.
- Delete your account — an account with no checkout or billing history can be deleted from the extension’s account settings. If the account has checkout or billing history, or the extension cannot confirm it is safe to delete, the extension may be unable to delete it; contact support@weavertab.work. We do not promise the outcome or timing of such requests here, and billing records may be retained as described under Retention. This does not limit any deletion rights you have by law.
- Correct or object — contact us to correct your data or object to processing.
- Depending on where you live (for example the EU, UK or California), you may have additional rights, including the right to complain to your data protection authority.
Chrome Web Store Limited Use
Weaver’s use of information received from Chrome APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use this data only to provide the features you see in Weaver; we do not transfer it for advertising, credit-worthiness or any purpose unrelated to Weaver’s single purpose, and humans do not read it except with your permission, for security, or as required by law.
Security
Data in transit is protected with TLS. Sync data is stored in access-controlled databases where each account can read only its own rows. No system is perfectly secure; we will notify you of a breach affecting your data as required by law.
Children
Weaver is not directed to children under 13 (or 16 where local law requires), and we do not knowingly collect their data.
Changes
If we make material changes we will update the date above and notify you in the extension or by email before they take effect.