Effective date: 26 October 2026 Product: Tab Organizer Chrome extension and, only where enabled and used, its licensing/purchase service. Controller/publisher: Artur Mukhamatkhaev, an individual trading as From Artur, Rua das Amoras 174, 2775-549 Cascais, Portugal; Portuguese tax identification number 315491051. From Artur is a trading name, not an incorporated company. Privacy contact: artur@fromartur.com
1. Scope and who is responsible
This notice describes information handled by Tab Organizer itself: the Chrome extension, its configured license-validation service, and the optional Pro application flow if that flow is enabled. It does not cover Google Chrome, the Chrome Web Store, the publisher's general website, email provider, or payment/banking services acting under their own terms. The website has a separate privacy notice.
The publisher identified above determines the purposes and means of processing for the extension and its licensing service. The shared licensing service is configured on an OVHcloud VPS behind a dedicated Caddy route at licenses.fromartur.com. Caddy access and request-body logging are disabled for that route. The service receives the client IP for its in-memory rate limiter. OVHcloud and network providers may process connection metadata to deliver and protect traffic. Infrastructure-level logging and the exact data-centre region are outside the reviewed application configuration; contact the publisher for current infrastructure details.
2. What the extension does and handles
Tab Organizer organizes eligible tabs into native Chrome tab groups. It reads the tab URL fields that Chrome exposes to the extension to determine the hostname and whether the tab matches a user-created rule. This is browsing activity and can be sensitive. It is processed only to provide the grouping and related controls requested by the user. The extension does not read page text or form contents, inject scripts, collect screenshots, use browsing history, or send visited hostnames/URLs to the publisher's licensing service.
Stored in the Chrome profile
- Chrome local storage: preferences, user-created hostname/rule patterns and exclusions, selected interface language, an opaque installation identifier, license receipt and clock/retry state when licensing is configured, and a recovery backup if the user confirms a settings reset. This is local-profile storage; the extension does not use Chrome's Sync storage API.
- Chrome session storage: temporary ownership records for extension-created groups, group/rule identity, native window/group/tab identifiers, operation recovery journal, pause/ignored state, run summaries, and up to 20 sanitized error codes with timestamps. These are needed to manage and safely reconcile groups. The extension restricts these storage areas to trusted extension contexts.
- Recovery backup: a confirmed reset saves the previous configuration locally. If session state is invalid, the backup may include that raw session value, which can contain hostnames and group/rule details. The extension offers download and deletion controls. A backup older than 30 days is removed at the next successful extension startup; this is not a guaranteed timed deletion while Chrome is not started.
- User-requested export: a configuration export contains settings and rule patterns and excludes the license receipt and session state. A recovery-backup download can contain more, as described above. Downloaded files are outside the extension's control and must be deleted by the user.
The extension does not synchronize this data to other browser profiles or devices. Chrome may remove extension data when the extension is uninstalled; uninstalling does not delete files the user exported or records retained by the license/purchase service.
License validation and Pro
In a commercial build configured for licensing, the extension contacts https://licenses.fromartur.com over HTTPS for activation, refresh, or confirmed deactivation. The request may contain the product identifier, a purchase key or signed license receipt, an opaque installation identifier, and a random request nonce. These requests do not contain tab URLs, page contents, hostnames, or browsing history. Requests are made only when the user activates/deactivates a license or the client needs to refresh a stored license. Free grouping works locally without this service. A special --free build omits the license-service host permission and endpoint.
The license service uses a purchase key to find a grant and stores a one-way hash of the key; the raw key is not intended to be stored in its database. It stores license-administration records such as the product/offer, grant state, a bound installation identifier, and activation/refresh timestamps. A signed Pro receipt may be stored locally. A permanent purchase, if offered and shown at checkout, is a permanent entitlement subject to its published license terms; its offline proof can still require renewal and is currently designed to work offline for at most seven days. A local “remove license” action deletes the local proof but does not release the server-side device binding.
Optional purchase application and fulfillment
The service has an optional manual-transfer application endpoint. If the publisher enables sales and a user submits an application, it collects the email address, chosen product/offer, consent flag, and application/idempotency identifiers. The publisher may separately communicate payment instructions. After the publisher manually verifies payment, the service can store a payment reference supplied by the publisher, verification time, and issue/binding records. The extension does not collect card or bank credentials and the service does not itself take payment through this flow. A submitted application alone does not mean payment was taken or a place reserved.
Tab Organizer Pro is not currently offered for sale on this website. The purchase application flow and an active Tab Organizer offer are not available here. We will update this notice and publish offer-specific terms before enabling a purchase flow.
3. Purposes and legal bases
For local tab organization, processing occurs on the device to provide the feature the user invokes or enables. If a Pro application flow is opened, application data will be processed to take steps requested by the user before a contract. License delivery, validation, restoration, and support are necessary to perform a purchased service. Security, rate limiting, and abuse prevention rely on the publisher's legitimate interest in protecting users and the service. Transaction records may be retained to comply with legal obligations or establish, exercise, or defend legal claims.
License, application, and purchase data are used to validate entitlements, prevent license misuse, fulfill a purchase, communicate about the application, maintain transaction records, and handle legal claims, on the bases described above and subject to applicable law.
4. Limited use and sharing
We use browsing-related information only to provide the extension's tab-grouping feature and its safety/recovery controls. We do not sell it, use it for advertising or profiling, or transmit it to the license service. We do not permit people to inspect browsing-related data except where the user specifically asks us to inspect a specific item for support, where necessary for security, to comply with law, or where permitted by applicable Chrome Web Store policy. The extension does not send tab URLs or page contents to a human support channel.
We may share the minimum data necessary with:
- the license-service host and infrastructure/security providers, to validate a license, fulfill a purchase, or secure and operate the service;
- the user's chosen bank/payment provider, only as part of the user's separate payment transaction; the publisher's current manual-transfer workflow may involve direct payment outside the extension;
- professional advisers, courts, regulators, or law enforcement where legally required or necessary to establish, exercise, or defend legal claims; and
- a successor in a genuine business transfer only where permitted by law and required user consent has been obtained.
We do not share extension browsing activity for targeted advertising, data brokerage, credit decisions, or unrelated purposes. The licensing endpoint is hosted on an OVHcloud VPS and uses a dedicated Caddy route, as described above. Email and network providers may process the information needed to deliver messages and network traffic; this notice will be updated if the service-provider arrangements materially change.
5. Retention
- Extension settings remain in local Chrome storage until changed/deleted by the user or removed by Chrome/uninstallation. Session records are temporary browser-session state and are not intended as a permanent history.
- Recovery backups are deleted on a subsequent successful startup when they are more than 30 days old; users may delete/download them sooner.
- The service removes pending applications strictly older than 90 days only when they have no payment, order, or grant; it also removes orphan customer email records and administrative audit entries strictly older than 90 days. Audit records may include the time, action, product identifier, optional grant identifier, and an operator-entered reason. Operators are instructed not to put purchase keys, receipts, authorization tokens, or unnecessary personal information in that reason. Paid/manual applications and related customer, order, payment, grant, and device-binding records are not removed by this cleanup. No automatic deletion period for those purchased records is implemented. The publisher retains them while needed to provide a permanent license, restoration, and support, and afterwards for applicable accounting, consumer-protection, fraud-prevention, and legal-claims periods. A verified request may still lead to deletion or restriction where no overriding contractual or legal ground applies.
- A production database backup is made daily using SQLite's consistent backup mechanism. Local snapshots on the same VPS are managed with a 30-day expiry in service-account-restricted storage. A deletion/correction is applied to the live database; existing snapshots are not edited in place and expire under the 30-day policy. If a snapshot containing affected data is restored before expiry, the deletion/correction must be reapplied before normal service resumes. We do not claim that external backups or encryption at rest are in use.
- The application disables request logging, limits request bodies to 8 KiB, and returns generic server errors. The in-memory rate limiter temporarily processes the requesting IP address. The dedicated Caddy route is configured not to write access or request-body logs and forwards the client IP to the application rate limiter. Network/infrastructure providers may still process IP address, request time, and request path.
6. International transfers and security
The license service uses HTTPS. The service runs in a restricted, non-root container; access to the database and signing-key paths is restricted to the service account. Daily SQLite backups are held in service-account-restricted storage on the same OVHcloud VPS and expire after 30 days. The available configuration does not establish the exact data-centre region or whether infrastructure providers transfer connection metadata outside the EEA. For details of a particular transfer and its safeguards, contact artur@fromartur.com. These safeguards do not eliminate all risk.
7. Your choices and rights
You can turn off automatic organization, pause it, edit/delete rules, exclude hostnames, export settings, and delete or download a recovery backup from the extension. You may also remove local license data; that does not free a server device slot. To remove all extension-local data, uninstall the extension and separately delete any exported files.
Where applicable law grants you rights, you may request access, correction, deletion, restriction, portability, or object to processing, and may withdraw consent where consent is the basis. The controller may need to verify your identity. Under the GDPR, the controller normally responds within one month and may extend that period by up to two further months for complex or numerous requests, informing you within the first month. Rights are not absolute; information may be retained where needed to perform a contract, comply with law, or handle legal claims. You may complain to Portugal's supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or another competent EEA authority for your habitual residence, workplace, or the alleged infringement. Contact the controller at artur@fromartur.com.
8. Changes and contact
We will update this notice when the product's data practices materially change and will provide any additional in-product notice or consent required by law or Chrome Web Store policy. The effective date is shown at the top.
Privacy requests and general support: artur@fromartur.com
9. Governing materials
This notice is a privacy disclosure; it is not the purchase contract or the license grant. See the Terms of Use and the current Pro availability notice.