Legal
Privacy Policy
LomuTab is a browser extension that runs primarily on your device. We do not collect analytics and do not have access to your personal data. A small number of Pro features use our backend infrastructure (document sharing, AI step descriptions) — these are described in detail below. This policy explains what data is stored locally, what leaves your device, and under what circumstances.
1. Data stored on your device
All extension data is stored in Chrome's local storage (chrome.storage.local or chrome.storage.session). It never leaves your browser unless explicitly described in sections 3 or 4.
| Data | Where stored | When cleared |
|---|---|---|
| Widget layout and settings | local | When you clear extension data or uninstall |
| Notes content | local | When you delete a note or uninstall |
| Docs content (including embedded step screenshots) | local | When you delete the doc or uninstall |
| Clipboard history | local (max 50 entries) | When you clear history or uninstall |
| Color palettes | local | When you delete or uninstall |
| Bookmarks (cached) | local | Synced from Chrome; clears on uninstall |
| API keys (weather, stocks) | local | When you remove them or uninstall |
| Screenshots (Screenshot widget only) | session (RAM only) | When the browser closes |
To delete all data: go to chrome://extensions, click "Details" on LomuTab, then "Clear site data". Uninstalling also removes all stored data.
2. Permissions used and why
| Permission | Purpose |
|---|---|
storage | Saves your settings and widget data locally |
geolocation | Auto-detects your location for the Weather widget, only when you enable it |
bookmarks | Reads and writes your Chrome bookmarks for the Bookmarks widget |
notifications | Shows browser notifications when the Pomodoro timer ends |
tabs + activeTab | Identifies the current tab to take screenshots and open the side panel |
scripting | Injects the screenshot overlay into the active tab after a capture |
sidePanel | Opens the LomuTab side panel |
system.cpu + system.memory | Reads anonymous system stats for the System Stats widget |
3. Clipboard access — important disclosure
LomuTab includes a Clipboard History feature. When active, a content script running on all websites captures text you copy (copy event) and stores it locally. Up to 50 entries are kept. This text never leaves your device.
The content script also sets a data-lomu-id attribute on visited pages solely so the lomutab.com share page can detect that the extension is installed. No page content is read or transmitted.
You can disable clipboard capture at any time in the extension settings. Clearing the history wipes all saved entries immediately.
4. Data that leaves your device
The following data is sent to third-party services only when you have enabled the relevant widget and configured it:
When the Weather widget is active, your city name or GPS coordinates plus your personal OpenWeatherMap API key are sent to their API to retrieve weather data. LomuTab never receives or stores this request — it goes directly from your browser to OpenWeatherMap. Their privacy policy applies: openweather.co.uk/privacy-policy.
When the Stocks widget is active, the stock ticker symbols you add plus your personal Finnhub API key are sent to their API. LomuTab never receives or stores this request. Their privacy policy applies: finnhub.io/privacy.
If you add RSS feed URLs, the background service worker fetches those URLs directly. The feed provider's server receives a standard HTTP request (your IP address, browser user-agent). No other data is sent.
When you click "Share" on a note, the note's content is URL-encoded and embedded in a lomutab.com/share link. The content travels via URL parameter — it is not stored on any server. Anyone who receives the link can read the note content. You control whether you share the link.
When you click "Share" on a document, the document's HTML content is uploaded to our Supabase database. A short URL (lomutab.com/share?s=…) is generated and copied to your clipboard. The content is stored on Supabase's servers (AWS us-east-1) for up to 90 days.
Only the content you explicitly click "Share" on is uploaded. Documents you never share are never sent anywhere. You can delete a shared document at any time using the "Unshare" button in the extension — this permanently removes the content from our servers. If you reinstall the extension or use a different device, the ownership token needed to delete the share is no longer available and the share will expire automatically after 90 days.
We do not access shared document content except for routine infrastructure operations (backups, security monitoring). Your IP address is logged temporarily by Supabase's infrastructure. Supabase privacy policy: supabase.com/privacy.
When the AI Step Descriptions feature is active (Pro plan only), screenshots taken during Auto-doc or Capture & Annotate sessions are sent to our Supabase Edge Function, which forwards them to Anthropic's API to generate a short text description of the action performed. The image is transmitted in memory and is not stored on our servers or by Anthropic beyond the duration of the API call. Only Pro users who have activated this feature are affected. The description returned (plain text) is stored locally in your document. Anthropic's privacy policy applies: anthropic.com/privacy.
To disable this feature, downgrade to the Free plan or remove your license key from Settings.
When you activate a Pro license key, the extension sends the key to Lemon Squeezy's API to verify its validity and retrieve the associated plan. The license key and the validation result are stored locally. No personal information beyond the key itself is transmitted. Lemon Squeezy's privacy policy applies: lemonsqueezy.com/privacy.
The lomutab.com website (not the extension) loads Inter and JetBrains Mono from Google Fonts. Google may log the request. The extension itself does not contact Google Fonts.
5. Screenshots
The Screenshot widget captures the visible area of the current tab using the Chrome captureVisibleTab API. The image is stored in chrome.storage.session (in-memory only) and is automatically deleted when the browser closes. You can download, copy to clipboard, or discard it. The overlay UI is injected into the active tab only at the moment of capture and is removed as soon as you dismiss it.
The Auto-doc and Capture & Annotate features also use captureVisibleTab to capture a screenshot for each documented step. These screenshots are embedded as base64 images inside the doc's HTML content and stored in chrome.storage.local as part of the doc. They remain local unless you explicitly share the doc — at which point they travel to Supabase as part of the document payload (see section 4, "Document sharing").
6. No analytics or telemetry
LomuTab collects zero analytics, crash reports, or usage telemetry. We have no visibility into how you use the extension, which widgets you enable, or how often you open a new tab.
7. Children's privacy
LomuTab is not directed at children under 13 years of age. We do not knowingly collect any personal information from children. If you believe a child has provided personal information, contact us and we will address it promptly.
8. Your rights (GDPR / CCPA)
Because all data is stored locally on your device, you retain full control at all times:
- Access: All local data is readable directly in the extension UI or via
chrome.storageDevTools. Shared documents are stored server-side and accessible via the share URL. - Deletion: Clear extension data from
chrome://extensionsor uninstall. Clipboard history can be cleared from the side panel. Notes can be deleted individually. Shared documents can be permanently deleted using "Unshare" in the extension. - Portability: Notes and documents can be exported locally. Shared documents expire automatically after 90 days.
For residents of California (CCPA) or the European Union (GDPR): we do not sell, rent, or share your personal data with third parties for commercial purposes. The only server-side data we hold is the content of documents you have explicitly chosen to share — which you can delete at any time via "Unshare".
9. Third-party API keys
The Weather and Stocks widgets require you to supply your own API keys from OpenWeatherMap and Finnhub respectively. These keys are stored exclusively in your local Chrome storage. LomuTab never transmits your API keys to any server under our control. You are responsible for complying with the respective providers' terms of service.
10. Changes to this policy
If we make material changes, we will update the effective date at the top of this page and, where appropriate, notify users via the Chrome Web Store listing. Continued use of the extension after changes constitutes acceptance.
11. Contact
Questions about this policy? Email us at hello@lomutab.com.