Privacy Policy

Without an account, the extension stores everything locally using Chrome's storage and never sends it to us:

• Your settings, blocklist, allowlist, schedules, site limits and profiles.
• Focus sessions, tasks, intentions, tags, streaks and stats.
• Your browsing log. To block sites and show how long you spend on them, the extension sees the address of the tabs you open. That information is used on your device only and is never uploaded, even when you sign in.
• Songs you add to My music. They are saved in your browser and played from there; they are never uploaded.
• Your weekly report, which is generated and shown as a notification on your device.

Uninstalling the extension deletes this local data.

An account is optional. You sign in with your Google account. When you do, we store:

• Account details: your email address, and the username and display name if you choose to set them.
• Devices: a random device ID, your browser's user-agent string (which tells us the browser and operating system, for example "Chrome on Windows"), when it was last seen, and, if you use the device protection check, whether that device passed.
• Daily totals: for each day, your focus minutes, number of sessions, number of blocked visits, tasks completed and minutes per tag. These power your streak and the web dashboard. Which sites you blocked or visited is not included.

If you have Pro, including during the free trial, these also sync so they match across your browsers:

• Your session history (start and end time, length, mode, intention, tag and linked task).
• Your tasks.
• Your settings, blocklist, allowlist, schedules, site limits and profiles.

Pro purchases are handled by Dodo Payments, who act as the merchant of record. You enter your card or payment details on their checkout, and we never see or store them.

After a purchase, Dodo Payments tells us the payment ID, your email, your customer ID, the product, amount, currency and whether it was paid or refunded. We use this to unlock Pro on your account. We keep these purchase records even if you delete your account, so a refund or a new account with the same email still works, and because we may need them for tax and accounting.

If you activate Pro with a license key instead, the extension sends the key and your device's name to Dodo Payments to check that it is valid.

Your profile is private unless you turn on the public profile in your dashboard. If you do, anyone with the link zentab.live/u/your-username can see your username, display name, whether you have Pro, when you joined, your total focus time and your daily focus minutes for the past year. Nothing else is shown. You can turn it off at any time.

zentab.live has no analytics, ad or tracking scripts. The only cookies are the ones that keep you signed in. Our hosting provider keeps standard server logs, like IP addresses and request times, to run and protect the service.

The Protect every device page checks whether an adult-content filter is active by trying to load a few small icons from adult sites in your browser. Nothing from those sites is shown, and the result is only saved if you are signed in and choose to register the device. The page recommends CleanBrowsing, a third-party DNS service. If you set it up, your device's DNS lookups go to CleanBrowsing under their own privacy policy, not to us.

When the extension blocks a site in an Incognito window, it opens zentab.live/blocked with the block reason and the matched rule in the address, so the page can explain the block. We don't store it.

We use a small number of services to run ZenTab. Each one only gets what it needs:

• Supabase: sign-in and the database for synced data.
• Vercel: hosting for zentab.live.
• Dodo Payments: checkout, payments and license keys.
• Google: sign-in, only if you create an account. We receive your email address and basic profile from Google.

These services may store data outside your country, including in the United States. We don't share your data with anyone else unless the law requires it.

• Use it without an account. Every free feature works signed out.
• Export. Download everything synced to your account as JSON from the dashboard.
• Delete. Delete your account from the dashboard. Your synced data is deleted straight away; purchase records stay, as explained above.
• Sign out. Signing out of the extension stops syncing. Your local data stays on your device.

Depending on where you live, you may have the right to access, correct, delete or move your data, or to object to how we use it. To make any request, email hello@zentab.live. We'll reply within 30 days.

Data is sent over HTTPS. Every table in our database uses row-level security, so a signed-in account can only read and change its own rows. We keep synced data until you delete it or your account. No system is perfectly secure, but if we learn of a breach that affects you, we will let you know.

ZenTab accounts are not meant for children under 13, and we don't knowingly collect their data. Using the extension without an account sends us nothing. If you believe a child has created an account, contact us and we'll delete it.

If we change this policy, we'll update the date at the top. For significant changes, we'll also tell signed-in users by email or in the extension. For any privacy question, email hello@zentab.live.