Privacy Policy

NexTab ("NexTab", "we", "us") is operated by Maria de Gracia Marin Munoz, an individual self-employed professional ("autónoma") based in Spain, who is the data controller responsible for the personal data described in this policy.

Questions, requests, or complaints about your data can be sent to hello@nextab.app.

NexTab is a bookmark and browser-tab-session manager. You sign in with your Google account, and NexTab stores your bookmarks, spaces, sessions, and tags in a folder named "NexTab" inside your own Google Drive — not on our servers. A companion Chrome extension lets you save the current tab, or every open tab, into NexTab.

Account information, from Google Sign-In. When you sign in, Google shares your email address, name, profile picture, and a stable account identifier with us. We use the identifier, not your email, as your permanent account key, because email addresses can change hands.

Your NexTab content, in your own Google Drive. Bookmarks, spaces, sessions, and tags are stored as files in a "NexTab" folder in your Google Drive, under a Drive permission scope ("drive.file") that only lets NexTab access files it created itself — not your other Drive files. This is user-owned storage: your content stays in your account and you can inspect, export, or delete it there directly. It is not zero-knowledge storage — our server reads and writes those files on your behalf whenever the app loads or saves your data, the same way any cloud app that stores data in your Drive does.

Account and connection data we store ourselves. We keep a small database record per account: your email, name, profile picture, plan (free or lifetime), your browser's language setting (so our emails reach you in your language), and an encrypted version of the Google access token that lets us read and write your NexTab Drive folder. This token is encrypted at rest and only decrypted when a request needs it. We also store a short-lived, hashed login-session token — not the token itself — so a copy of our database on its own cannot be used to sign in as you.

A session cookie. One cookie (nextab_session) keeps you signed in for up to 30 days. It is essential to the service and is not used for advertising or cross-site tracking. If you choose a language yourself, a second cookie (nt_lang) remembers that choice; it holds only the language code. NexTab sets no other cookies, and uses no advertising or cross-site tracking scripts of any kind.

Privacy-friendly website analytics. We use Cloudflare Web Analytics to count page views and see which sites link to us. It sets no cookies, stores no identifier for you, and does not fingerprint your device or browser, so it cannot follow you between visits or across other websites. It records only aggregate information: the page requested, the referring site, a coarse country, browser and device type, and page-loading performance. There is no profile of you to request, export, or delete, and because no data is stored on your device we do not ask for consent to it.

Website previews for your bookmarks. When you save a link, our server makes a request to that page to read its public title, icon, and preview image, so your bookmark shows something more useful than a bare URL. That request is made by our server, not your browser, and only fetches information the site already makes publicly available to any visitor.

The Chrome extension. The extension can read your currently open tabs' URLs and titles, but only at the moment you actively choose to save the current tab or capture a session — it does not run in the background, and it does not monitor or record your general browsing activity.

Payment information, if you upgrade. If you purchase a paid plan, your payment details (card number, billing address, etc.) are collected and processed directly by our payment provider. NexTab does not receive or store your full payment card details. Our payment provider acts as an independent data controller for billing, tax, and fraud-prevention purposes under its own privacy policy.

Email. When you create an account we send you one welcome email, and we may email you about your account or the service itself, for example a security issue or a change to these terms. Separately, if you turn on "Stay in the loop" (in the settings menu or in Settings), we record that you agreed, when, and the wording you agreed to, and we may email you about NexTab updates and other things we make. That is off unless you turn it on, and you can turn it off there or with the unsubscribe link in any of those emails.

• To create and secure your account, and keep you signed in.
• To read and save your bookmarks, spaces, sessions, and tags in your own Drive.
• To enforce free-plan limits and lifetime-plan features.
• To fetch preview information for links you save.
• To process payments, if you choose to upgrade.
• To maintain the security of the service, including detecting abuse.
• To respond to support requests you send us.
• To send you the welcome email and messages about your account or the service, and, only if you opted in, news about NexTab and other things we make.

We do not sell your personal information, and we do not use your data for advertising.

• Performance of a contract — most processing exists to provide the service you signed up for: storing your bookmarks, keeping you signed in, enforcing plan limits.
• Consent — granting Google Drive access happens through Google's own consent screen, which you can revoke at any time from your Google Account settings. Update emails are also sent only with your consent, which you can withdraw at any time from Settings or from any of those emails.
• Legitimate interests — securing the service against abuse, and fixing bugs, in ways that do not override your own rights and interests.

Google. Your account and content data necessarily pass through Google, since sign-in is via Google and your content lives in your Google Drive. Google's own privacy policy governs its handling of your Google Account.

Cloudflare. NexTab runs on Cloudflare's infrastructure (Workers and D1 database), which hosts our application and the account data described above, and provides the cookieless website analytics described above.

Paddle, our payment provider and merchant of record, if and when you upgrade to a paid plan, to process your payment.

Resend, which delivers our emails. It receives your email address and first name to send you the welcome email and any account messages, and, if you opted in to updates, keeps you on our list together with your subscription status.

We do not share your information with any other third party, and we do not sell it.

Google, Cloudflare and Resend operate infrastructure in multiple countries, including the United States, and Paddle is based in the United Kingdom, so your information may be processed outside the country you live in. Where that involves transferring personal data out of the EEA or UK, we rely on the safeguards those providers make available, such as Standard Contractual Clauses.

• Your NexTab content stays in your own Google Drive until you delete it there.
• Login sessions expire automatically after 30 days of inactivity.
• Account and connection records are kept while your account is active, and deleted when you delete your account or disconnect Google Drive and request deletion.
• Temporary sign-in state used during the login process is deleted automatically within minutes.
• The record of your email opt-in choices is kept while your account exists, as proof of consent, and deleted with your account.
• If you opted in to updates, you are removed from our email list when you unsubscribe or delete your account.

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent at any time. You can disconnect NexTab's access to your Google account at any time from your Google Account permissions, which immediately revokes our access to your Drive.

To exercise any of these rights, email hello@nextab.app. If you are in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD).

Access tokens for your Google Drive connection are encrypted at rest. All traffic to NexTab is encrypted in transit (HTTPS), and your login session is stored in a cookie that is not accessible to page scripts. No method of storage or transmission is perfectly secure, and we cannot guarantee absolute security.

NexTab's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

NexTab is not directed at children, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.

If we make a material change to this policy, we will update the date at the top of this page. If you have an account, we may also notify you directly for significant changes.

Maria de Gracia Marin Munoz — hello@nextab.app