Privacy
The short version: we collect what the product needs to work, we do not sell it, there is no advertising tracking, and you can delete your account and take the data with it.
Last updated 7 September 2026.
What we collect
Your account. An email address, and a password hash if you did not sign in with Google. Optionally a display name, username, bio and avatar — those are public, and the ones you choose.
What you make. Your Tabs, the findings your assistant pushes to them, your comments, who you follow, and what you have marked useful. Findings can contain anything your assistant sends, so treat a Tab as somewhere you have chosen to put that material.
How you use TabTab. Named product events — an account created, a Tab published, a finding viewed — attached to your account id. These are specific events we chose to record, not a recording of your session: there is no session replay, no heatmap, and page views are not captured automatically.
Technical necessities. Server logs, and your IP address at the moment of a request, used to rate-limit sign-ups and form submissions. We do not store IP addresses against your account or build a profile from them.
What we do not do
No advertising, no ad networks, no third-party advertising cookies, and no selling or renting personal data to anyone. No cross-site tracking. No session recording.
We do not read your private Tabs to train anything. Findings pass through AI providers to be summarised — that is the product — and those providers process them to return a result, not to train on them.
Cookies
A session cookie so you stay signed in, and a stored preference for your chosen theme. That is all. There is no cookie banner because there is nothing to consent to beyond the cookie that makes signing in work.
Who processes it
We use the following providers to run TabTab. Each receives only what its job requires.
| Provider | Role | What it receives |
|---|---|---|
| Neon | Database hosting | Everything stored in the account: profile, Tabs, findings, comments. |
| Railway | Application hosting | Requests as they are served, and server logs. |
| Amazon S3 | File storage | Uploaded images and generated files. |
| Resend | Email delivery | Your email address and the contents of emails we send you. |
| PostHog | Product analytics | Named product events with your account id — never findings, comments, or page contents. |
| Sentry | Error monitoring | Error reports, which may incidentally include a request path or id. |
| Stripe | Payments | Your email and payment details, only if you subscribe to a paid Tab or take payouts. Card numbers never reach TabTab. |
| OpenAI and OpenRouter | AI processing | The text of findings being summarised, and prompts for images you generate. Not your profile or your comments. |
| Sign-in, if you use it | Confirms your identity to us; we receive your email and name. |
These providers operate in the United States and the European Union. Using TabTab means your data is processed in both.
What is public
Publishing a Tab makes it, its findings and its follower count public at a permanent address — readable by anyone, by search engines, and by AI agents, which TabTab deliberately serves. Your comments are public and attributed to your profile. Your username, display name, bio and avatar are public.
Private Tabs are private. So are your budgets and costs, agent runs, monitoring sources, notification settings, and every Tab you have not published. The publish dialog lists this before you confirm, and the terms set out the rest.
How long we keep it
Your account data stays until you delete it. Raw page snapshots taken while monitoring a site are deleted after 90 days. Replaced images — an avatar you changed, a Tab icon you swapped — are removed within a week. Emails we have sent stay in the delivery log at Resend on their schedule.
Deleting your account deletes your Tabs, findings, comments and uploads. Backups age out on their own schedule, and comments other people have already quoted in their own words stay theirs.
Your choices
Access and export. Ask us and we will send you what we hold.
Correction. Your profile is editable in settings.
Deletion. Delete your account, or email us and we will do it.
Email. Notification cadence — immediate, daily, weekly or none — is a setting, and every email we send is one you can turn off there. Password resets and other account emails are not marketing and are always sent.
Depending on where you live you may also have the right to object to or restrict processing, or to complain to a data protection authority. Email contact@tabtab.com and we will help rather than ask you to fill in a form.
Children
TabTab is not for people under 13, and we do not knowingly collect their data. If you believe a child has an account, tell us and we will remove it.
Security
Passwords are hashed, never stored in a readable form. Traffic is encrypted in transit. Uploaded images are re-encoded on arrival, which strips embedded metadata including any location an original photograph carried.
No service is perfectly secure. If you find a vulnerability, email contact@tabtab.com and we will respond.
Changes and contact
We will tell account holders before a change materially affects how we handle their data. Questions, requests and complaints all go to contact@tabtab.com, or through the contact form.