Privacy Policy

1. Who we are

Tab Desktop (tabdesktop.com) is operated by Siglar Development AS (“we”, “us”). Questions about this policy or about your data go to hello@tabdesktop.com.

2. What stays on your device

The desktop, its virtual machines, the files you create or clone, installed packages, databases, editor state and terminal history are stored in your browser's origin-private file system (OPFS) and local storage on the device you are using. We cannot read that storage: it is not transmitted to us, and it is not accessible to other websites. Clearing the site's data in your browser, or deleting a desktop from inside Tab Desktop, removes it.

Code runs in your browser too. Node.js, PHP, git, the package managers and the AI models you run locally execute as WebAssembly in the tab, not on a server of ours.

3. What passes through our servers, and only when you ask

Some features need the network, because a browser tab cannot reach it alone. In each case the request is initiated by an action you take, and we relay it rather than store it.

• Cloning and fetching repositories. Browsers cannot speak the git protocol to another host directly, so git traffic is relayed through our git proxy. The repository contents travel through the relay and are not retained. If you clone a private repository with a token or a signed-in git account, that credential is sent along with the request to the git host and is not kept by the relay.
• Package downloads and web requests. When a tool in your desktop downloads a package or fetches a URL that the browser would otherwise block, the request goes through our web proxy. The proxy passes the bytes through and does not keep them.
• Public URLs for your dev server (tunnels). When you expose a server running in your desktop, our signalling server pairs your browser with the visitor's. Where both sides support it, the traffic then flows directly between the two browsers over WebRTC and our server never sees it. For clients that cannot do that (command-line tools, webhooks, crawlers), the server relays the bytes between them and your browser without storing them. The public URL itself and the fact that it is active are held only while the tunnel is open.
• AI assistants. Claude Code inside Tab Desktop talks to Anthropic through our API proxy, using the Anthropic account you sign in with. The proxy forwards your requests and Anthropic's responses; it does not store prompts or code. Anthropic's own terms and privacy policy govern what happens on their side. Models you run locally (WebLLM) never leave the tab.
• Cloud drives. If you connect Google Drive, Microsoft OneDrive, Dropbox or a similar provider, your browser talks to that provider directly. The access tokens are stored in your browser's storage, not on our servers.

4. Accounts

You can use Tab Desktop without an account. If you create one, you sign in through Google or GitHub; we never see your password. From the provider we receive your name, email address and avatar, which we store to identify your account and to show it to you. A session cookie keeps you signed in on this site; it is not used for tracking.

A paid plan is billed through Stripe. Stripe processes your payment details under its own privacy policy; we receive only what we need to know which plan is active, never your card number. Syncing a desktop across devices with a paid plan uses a cloud drive that you connect and own, as described above; we do not host copies of your files.

To delete your account, write to us at the address in section 1 and we will remove the profile and subscription records we hold. That does not touch the desktops in your browsers, which remain yours to keep or clear.

5. Analytics and cookies

We use Google Analytics to understand how the site is used: which pages are visited, roughly where visitors come from, and what browsers they use. It sets its own cookies and receives a pseudonymous identifier and your IP address, which Google truncates. We do not send it anything about the contents of your desktop, your files or your code. You can block it with a content blocker or by disabling cookies for this site; the product keeps working without it.

Beyond that and the session cookie described above, the site uses browser storage only for the product itself: your desktops, settings and preferences.

6. Server logs

Like every web service, our servers keep short-lived access logs containing IP addresses, request paths, timestamps and user-agent strings. We use them to keep the service running and to investigate abuse, and they are deleted on a rolling basis. Request bodies, repository contents and proxied payloads are not logged.

7. Legal basis and your rights

Where the GDPR applies, we process account data to perform our contract with you, analytics and logs on the basis of our legitimate interest in running and improving the service, and anything else only with your consent. You have the right to access, correct, export and erase the personal data we hold about you, to object to processing based on legitimate interest, and to complain to your data protection authority. Write to us at the address in section 1 and we will respond within a month.

8. Children

Tab Desktop is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has created an account, contact us and we will remove it.

9. Changes

When this policy changes, the date at the top changes with it, and material changes are announced on the site. Continued use after a change means you accept the new policy.