GTab Privacy Policy

Last updated: April 30, 2026

GTab ("the Extension") is a Chrome browser extension that provides a customizable new tab page. This policy explains in detail what Google user data is accessed, how it is used, and how it is protected, in compliance with the Google API Services User Data Policy.

Summary: GTab does not operate any servers. All Google user data stays on your device and is used exclusively to display information in your new tab page. We do not share, sell, or transmit your data to any third party.

1. Google User Data Accessed

GTab accesses the following Google user data only when you explicitly enable the corresponding widget. All access is opt-in and disabled by default.

Widget	OAuth Scope	Data Accessed	Data NOT Accessed
Gmail Widget	`gmail.metadata`	Sender name, sender email address, subject line, received date	Email body, attachments, content, labels, drafts
Calendar Widget	`calendar.readonly`	Event title, start/end time, location	Attendee lists, meeting links, private calendar descriptions
Tasks Widget	`tasks`	Task titles, due dates, completion status	Notes fields, deleted tasks, task history

User identity data (openid, email, profile) is accessed solely to display your name and profile picture in the extension header.

2. How We Use Google User Data

Gmail metadata (sender, subject, date): Displayed in the Gmail widget so you can see recent emails at a glance. Rendered locally, never processed beyond display.
Calendar events: Displayed in the Calendar widget to show your upcoming schedule.
Tasks: Displayed and managed in the Tasks widget. Completions are written back to Google Tasks via the Tasks API.
Identity: Shown in the extension UI for personalization only.

GTab does not use any Google user data for advertising, analytics, profiling, or training AI/ML models. GTab's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Data Sharing

GTab does not share Google user data with any third party. Specifically:

No Google user data is sent to GTab's developer or any server controlled by GTab.
No Google user data is sold, rented, or licensed to any party.
No Google user data is used for advertising, remarketing, or audience building.
No analytics or crash-reporting services receive Google user data.

The only parties that receive your Google data are Google's own APIs (googleapis.com), when the Extension makes API calls on your behalf.

4. Data Storage and Protection

Local storage only: All data is stored on your device using Chrome's sandboxed chrome.storage.local API, isolated to the GTab extension.
OAuth tokens: Stored in chrome.storage.local and used exclusively to make authenticated API requests. Never transmitted to any server other than Google's OAuth endpoints.
No remote servers: GTab has no backend infrastructure — no databases, cloud functions, or servers that store or process your data.
Cache: API responses may be cached locally (e.g., weather data for 30 minutes) to reduce API calls. Cached data expires automatically.

5. Data Retention and Deletion

Retention

Google user data is held in local browser storage only for as long as you use the Extension. Cached data expires automatically (typically within 30 minutes to 1 hour).

Deletion

You can delete all locally stored GTab data at any time:

Within the Extension: Settings → Account → Sign Out. Clears the OAuth token and all cached Google data.
Uninstall: Uninstalling GTab from Chrome automatically deletes all associated chrome.storage.local data.
Browser settings: Chrome → Settings → Privacy and security → Clear browsing data → Site data.

Revoking Google Access

Visit Google Account Permissions and remove GTab to revoke access at any time.

6. Third-Party Services (Non-Google)

GTab communicates with the following additional services. None receive Google user data:

Open-Meteo (api.open-meteo.com) – Weather data. Only approximate GPS coordinates sent. No personal identifiers.
Nominatim / OpenStreetMap (nominatim.openstreetmap.org) – Reverse geocoding. No personal identifiers.
Yahoo Finance / Alpha Vantage – Stock price data. Only ticker symbols sent.
Spotify API – If you configure the Spotify widget with your own Developer App credentials, the Extension communicates directly with Spotify's API. Your Spotify token is stored locally and only sent to Spotify's official endpoints.

7. Chrome Permissions Justification

storage – Saves widget layout, shortcuts, and preferences locally.
identity – Authenticates with Google for Calendar, Gmail, and Tasks widgets.
activeTab, tabs – Opens shortcuts and manages tab navigation. No tab content is read or transmitted.
contextMenus – Adds a right-click option to save shortcuts from any page.

8. Children's Privacy

GTab is not directed at children under 13 and does not knowingly collect data from children.

9. Changes to This Policy

We may update this policy to reflect changes in the Extension's functionality or updated requirements. The "Last updated" date at the top will reflect any changes.

10. Contact

For questions or to request data deletion assistance, contact: goktugturhan74@gmail.com