TabSidecar runs in your browser and keeps your tabs and windows on your device unless you choose a feature that sends them elsewhere, like cloud sync.
Last updated October 30, 2026
At a glance
the short version
Stays on your device
Your tabs, windows, labels and settings live in the extension’s own storage in your browser.
Local
An account is optional
Everything except cloud sync works without one.
Optional
Leaves your device only for features you use
Cloud sync if you sign in, AI window titles if you turn them on or ask for one, and the update-email list if you join it.
3 features
No ads, analytics or tracking
No advertising SDKs, behavior analytics, cross-site tracking pixels or general-purpose telemetry.
None
Doesn’t read what’s on your pages
No page contents, keystrokes, form fields, passwords or cookies.
Never
Overview
TabSidecar is a tab and window management extension. It helps you organize open tabs, restore windows, auto-park inactive tabs, save browser state, export your own backup files and, if you create an account, back up your tabs and windows to the cloud.
Most extension data stays in your browser, in the extension's own storage. Extension data leaves your device only when you turn on a feature that needs it, each described below: cloud sync if you sign in to an account, AI-generated window titles if you turn them on, and the update-email list if you join it. If you remove TabSidecar, the page that opens on our website asks why, and sends your answer only if you choose to.
Information we access
Open tabs and windows
Open tab and window information, including tab URLs, titles, favicon URLs, pinned state, tab position, tab groups and window grouping.
What you add in TabSidecar
Window metadata created inside the product, such as window names, saved windows, labels, nicknames, notes, priorities and filter rules.
Closed and auto-parked tabs
Closed-tab and auto-park history, including URLs, titles, timestamps and time-accumulation data used for tab management features.
Browsing history
Your Chrome history (addresses, titles and visit times), read to show it in TabSidecar's history views and to delete entries you choose. It is not included in cloud snapshots.
Settings and preferences
Settings and preferences you choose inside the extension.
Your account, only if you create one
If you create an account: your email address, your password (handled by our sign-in provider, never stored by the extension in readable form), and the cloud snapshots described below.
A random install ID
An install-scoped random identifier used by the AI title feature for rate limiting.
Your email, only if you ask for updates
An email address you give us for product updates, only if you choose to.
Chrome permissions
Permissions
tabs
Used to read, organize, move, create, focus, pin and close tabs.
tabGroups
Used to read the names and colors of your tab groups for Local Bridge (see below). Nothing else uses it.
windows
Used to inspect, name, restore, focus, create and remove browser windows.
alarms
Used for scheduled tasks such as auto-park checks, automatic backups, automatic cloud sync and delayed processing.
storage
Used to keep window and tab identities, recovery state and diagnostics on your device, so windows can be matched back after a restart.
unlimitedStorage
Keeps Chrome from deleting TabSidecar's data on your device when the disk runs low on space. It doesn't let TabSidecar read or send anything more.
scripting
Used to add TabSidecar's two page scripts (described below) to tabs that were already open when the extension was installed or updated, and to read two things from open tabs: TabSidecar's own IDs, and when the page started loading, which tells TabSidecar whether the browser has restarted.
history
Used to show your browser history in TabSidecar's history views and to delete the history entries you choose.
favicon
Used to display site icons for tabs and saved items.
downloads
Used to save the backup files you export, and the automatic backups you turn on, to your downloads folder.
Host permissions
http://*/* https://*/*
All websites. This also covers Local Bridge's local address (127.0.0.1), and exists for the two page scripts below.
https://api.tabsidecar.com/*
AI window titles.
https://quqhdnkypnuxvmibnzhn.supabase.co/*
Accounts, cloud sync and the update-email list.
Page scripts, which run on every page as it starts loading
identity-content.js
Stores a random TabSidecar tab and window ID in the page's session storage and navigation history state. Chrome restores these with the tab after a browser restart, which lets TabSidecar match a restored tab to its saved data. The script only reads and writes its own keys and never touches the page's other data. It tells the extension a site's origin (for example https://example.com) if that site cleared the IDs.
title-content.js
Reads the page title and adds a lock symbol to it when you lock a tab in TabSidecar.
Neither script reads page contents, keystrokes, form fields, passwords or cookies, and neither sends anything off your device. TabSidecar does not request permissions for cookies, identity, bookmarks, microphone, camera or geolocation.
How information is stored
TabSidecar stores its working data locally in the extension's own IndexedDB database and Chrome extension storage. That data may include open tabs, windows, saved windows, auto-parked tabs, closed URLs, settings, labels, nicknames, saved-for-later items and similar organization metadata. Browsing sessions that TabSidecar tracks for restoring windows stay on your device and are not included in backup files.
Local Bridge, an optional feature for tools running on your own computer, can share a snapshot of your windows, tabs and tab groups with a program listening at 127.0.0.1. It is off by default, needs a secret you paste in to turn it on, and never sends anything off your computer.
When you export backup files, the extension generates them locally and saves them through Chrome's download system. Exported settings leave out the AI install identifier and your sign-in session.
Accounts and cloud sync
An account is optional. Everything except cloud sync works without one.
Sign-in
Accounts use an email address and password through Supabase Auth, our database and sign-in provider. To sign up, we email you a one-time code to confirm the address, then you set a password. Changing your password signs out your other sessions. Sign-ups whose email is never confirmed are deleted automatically after a day.
What a cloud snapshot contains
Your open tabs (address, title, site icon and when you last used each) and windows, window names, saved, kept and closed windows, saved-for-later items, auto-parked tabs, nicknames, labels, priorities, notes, filter rules and extension settings. Each snapshot also records a device ID, a device name such as “Chrome on Windows”, and tab and window counts. Closed-tab history from Chrome and your sign-in session are not included.
Devices
For each device we store its random ID, device name, extension version, browser name, platform and when it last synced.
When it syncs
While you're signed in, the extension uploads a snapshot automatically (every hour by default; you can change the interval or turn it off) and whenever you sync manually.
How many are kept
For each device, the extension keeps your 12 newest snapshots and the last snapshot of each of the 8 earlier days that have one: usually 20, covering about a week, and up to 28 if you often sync by hand. It deletes older ones after each upload. The database also caps each account at 40 snapshots per device, 10 devices and 50 MB of snapshots, removing the oldest snapshots first. A new device past the tenth replaces the one that synced least recently.
Encryption and who can access your data
Encrypted in transit and at rest
Data is encrypted in transit (HTTPS) and encrypted at rest by our database provider, Supabase.
Not end-to-end encrypted
Cloud snapshots are not end-to-end encrypted. The TabSidecar operator can technically access them, and only does so when needed for support or security.
Only your account
Other users can't access your data. Database access rules restrict every row to the account that owns it.
AI window titles
AI window titles are off until you turn them on, either during setup or in Settings → Artificial Intelligence. Asking for an AI title for a single window also sends that window's request.
When they're on, the extension sends a request to api.tabsidecar.com containing an install-scoped random identifier, the window's tab titles and the site name of each tab (for example github.com, not the full address), and your existing window titles. If you're signed in, the request also carries your sign-in token so your account gets a higher daily limit. Our server passes the tab titles and site names to Google's Gemini API to generate the title and returns it to the extension.
Our server does not save tab titles or site names. It keeps each generated title in memory for up to 10 minutes, filed under a one-way fingerprint of the tabs, so the same tabs get the same title without asking Gemini again. To enforce daily limits it keeps a count of requests per day: for your account if you're signed in, otherwise (or when your sign-in can't be checked) for your install identifier and your network address (IP address). It deletes those counts after 7 days. Like most web servers, it also records each request's network address, time, the page it asked for, and your browser and operating system versions in its access logs, and deletes those logs within 5 weeks.
Update emails
If you choose to join the update-email list, the extension sends that email address to our Supabase database. We use it only to send product updates.
Uninstall feedback
When you remove TabSidecar, Chrome opens a page on tabsidecar.com that asks why. Its address carries the TabSidecar version and nothing else. Answering is optional, and nothing is sent unless you choose Send.
If you send an answer, the page sends the reasons you picked, your note if you wrote one, and the TabSidecar version to our Supabase database. We don't store your name, email address, network address, account or install ID with it, so please leave personal details out of the note. Answers are deleted after 12 months.
Like every request to our database, it passes through Supabase's servers, whose request logs record each request's network address (IP address) and time. On our current Supabase plan those logs are deleted after 1 day. The page itself is served by GitHub Pages, which hosts tabsidecar.com and logs each visitor's network address for security purposes, whether or not you send an answer.
Service providers and data sharing
TabSidecar does not sell your personal information and does not include advertising SDKs, behavior analytics, cross-site tracking pixels or general-purpose telemetry. We use five service providers:
Supabase
Hosts accounts, sign-in, cloud snapshots, devices, the update-email list and uninstall feedback, and sends account emails through Resend.
Resend
Delivers the account emails Supabase sends, such as sign-up codes and password reset links. It receives your email address and the email's contents.
DigitalOcean
Hosts our AI title server, api.tabsidecar.com. The AI title requests described above, and that server's daily counts and access logs, are processed and kept on DigitalOcean's computers.
GitHub (Pages)
Hosts this website, tabsidecar.com, including the account pages and the uninstall page. GitHub records the network address (IP address) of each visit to the site for security purposes.
Google (Gemini API)
Generates AI window titles from the tab titles and site names described above, if you turn them on.
Your choices
You can:
Use TabSidecar without an account.
Turn automatic cloud sync off or change how often it runs.
Turn AI window titles on or off (they're off unless you turn them on).
Choose whether to join the update-email list.
Export your own backup files locally.
Remove local extension data by uninstalling the extension or clearing its storage through Chrome.
Manage browser history separately through Chrome.
Data retention and deletion
Local data remains in the extension's storage until you delete it, clear the extension's data or uninstall the extension. Exported backup files remain wherever you save them.
Cloud snapshots are kept as described under “Accounts and cloud sync” until you delete your account. To delete it, open Account in the extension and choose to delete your account; you'll be asked for your password. This permanently deletes your account, its cloud snapshots and devices, and your address on the update-email list. Tabs and windows on your device are kept. On the AI server, daily counts are deleted after 7 days and access logs within 5 weeks, whether or not you have an account. Uninstall feedback is deleted after 12 months. Supabase's request logs are deleted after 1 day on our current plan, and GitHub keeps its logs of visits to this website under GitHub's privacy statement. You can also ask us to delete your data by emailing support@tabsidecar.com.
Security
Account data is protected by the encryption and per-account access rules described above. Deleting an account needs your password: the extension asks for it, and our database refuses the deletion unless your password was entered in the last 5 minutes, so a copied sign-in session can't delete the account once those 5 minutes have passed. No software can guarantee absolute security, but TabSidecar keeps most tab-management data on your device unless you use a feature that sends it to a backend service.
Children's privacy
TabSidecar is not directed to children under 13, and we do not knowingly collect personal information from children.
Changes to this policy
We update this policy when the product changes how it handles data, before or when those changes ship. The date at the top of this page shows when it was last updated.