Privacy Policy — Tab Share

Last updated: 2026-09-02

Tab Share is built so that there is nothing to collect. The extension and the viewer have no server, no account, no analytics, and no tracking. The one part with a server is the optional URL shortener, off by default and described below.

What the extension accesses

• Open tabs in the current window — their URLs, titles and icons. Read only at the moment you click Create share link (or an "add tabs" button), only for the window you triggered it from, and only to build the list you choose from. Tab icons are shown in the popup, never uploaded.
• Tab groups — names and colours, and (on import) the ability to create a group. Used for the "Tab group" source and the "open as a tab group" action.
• Local extension storage — your viewer address, your setup choices, and up to 50 links you recently generated, stored on your device via storage.local. Never synced, never transmitted. Clear all or individual entries any time from the options page.
• The viewer page only — one content script runs on the slideshow viewer page. It reads the collection from that page's URL fragment so it can offer to open the pages with the extension instead of the web view. It ships enabled only for the packaged viewer address; if you point the extension at your own viewer (including localhost for testing), the options page asks you to approve that one host before the script runs there. It runs on no other site.

What can make a network request

Two things, both optional. If site icons are left on, the viewer requests one icon per domain in the link from icons.duckduckgo.com when the link is opened — those domain names go to DuckDuckGo's icon service and nowhere else. If you turn on a URL shortener in the extension, creating a link sends that one generated URL to the service you chose (the first-party s.kaikay.de, da.gd, TinyURL, or a custom endpoint). With site icons and Auto-load live previews both off (both viewer settings), and no shortener set up, neither the viewer nor the extension makes a network request of its own. A page loads only when you open or preview one yourself.

The Tab Share shortener (s.kaikay.de)

s.kaikay.de is a small service run by the Tab Share author, and is also self-hostable. It only does anything if you opt in by choosing Tab Share shortener in the extension's options and turning it on.

When you create a short link, the one full share link is sent to s.kaikay.de and stored so the short link can redirect to it. That long URL holds every page URL and title in the collection (in its # fragment). Any shortener has to store its links' destinations, so the operator can read them; the admin panel shows only the target host until a destination is deliberately revealed, and an instance where the operator genuinely cannot read them is on the roadmap.

When someone opens a short link, the server keeps aggregate day-level counters only: a per-link hit count, a tally of the host that referred the click (e.g. news.ycombinator.com), and a tally of the visitor's browser family and major version (e.g. Firefox 130) reduced from the User-Agent. It does not keep your IP address, geolocation, the full referring URL or page path, the full User-Agent or device, any cookie, or any per-visitor identifier. Kept about 365 days, visible only to the operator through a password-gated admin page. The operator can also, on request, see an aggregate histogram of the domains people bundle (reddit.com, never the specific page) -- computed on the spot, stored nowhere. There is no third-party analytics, advertising or tracking code, and none of it is ever sold or shared. On a self-hosted instance all of this can be switched off.

Password-protected links

When the sender sets a password, the collection is encrypted in the sender's browser (PBKDF2-SHA-256 → AES-256-GCM) before it goes in the link. The password is never stored or transmitted; you type it here to decrypt locally. A lost password means the link can't be opened — there is no recovery.

The share link

When you create a link, the selected page URLs and titles are compressed and placed in the fragment of the link — the part after the #. Per web standards, browsers do not send the fragment to any server. The link is readable by anyone you give it to (and by anyone they forward it to), so treat it like the list of pages it contains.

The viewer page

The recipient opens the link in a normal browser tab. The viewer page is a static file (no backend). It reads the collection from the fragment in the recipient's browser and renders it. It loads no third-party scripts, fonts, or images and sends no data anywhere. "Open all" and "live preview" simply navigate to, or embed, the pages you chose — the same as clicking the links yourself.

If the recipient also has Tab Share installed, the content script described above adds an "Open with Tab Share" button to the viewer's toolbar, offering to open the collection into a window or a tab group, or to save it to the recipient's own on-device history. That choice, and the pages opened, never leave the recipient's device.

Contact

Open an issue at github.com/kaikayy/multi-link-share/issues.