GridPeek Tab Privacy

Last updated: 26 October 2026

GridPeek Tab replaces your new tab page with pages of shortcuts, notes and widgets that you create. This policy explains what it stores, what (if anything) leaves your browser, and why. Questions: gridpeek.com/contact.

In short: your data stays in your browser. There are no ads, no analytics and no tracking, and your data is never sold. The only things that leave your browser are the requests listed below, each made only for a feature you chose to use.

What it stores: your pages, shortcuts, notes, checklists, countdown dates, habit check-in dates, mood-log entries, daily focus entries, text snippets, time zones and Time Converter places, countdown deadlines, your caffeine log, your Pill Tracker pills and which doses you ticked off (the last three weeks), your spoken Voice Notes, coin/dice statistics, your Rage Clicks list of things to smash and how many you have smashed, your Dino Run, Snake, Breakout, Pong, Tetris and 2048 high scores, your hourly rate (for the Work Cost widget), your Safe to Spend budget and the spends you log (the last ten weeks), the subscriptions you list, weather city and settings, plus any images you upload as tile icons, page backgrounds or photo-frame pictures.

Where it stores it: only in Chrome's own extension storage.

• Pages, shortcuts, notes and settings use chrome.storage.sync, so Chrome can sync them to your other signed-in devices. If your data grows too large to sync, it is kept in chrome.storage.local on this device instead.
• Uploaded images stay in chrome.storage.local on this device and are not synced.

What it never does: no sign-up accounts, no analytics, no telemetry, no advertising, no remote code. The extension makes no network requests of its own except for the features below that you choose to use: weather and air quality, news feeds, market prices, flights, calendar links and GridPeek Pro. The Live Embed widget also shows a page from a site you chose, but that is the page loading in a frame, not a request the extension makes. Shortcut icons come from Chrome's built-in favicon cache; when that only has a tiny one, a sharper icon is requested from Google's favicon service, which sees that shortcut's web address. When you use the search box, your query goes to the search engine you picked, exactly as if you had typed it in the address bar.

The Weather widget (opt-in): only if you add one, the extension asks Open-Meteo for a forecast. The request contains the city name you typed (to find its coordinates) and those coordinates. No account, key or identifier is sent, and nothing is requested if you have no Weather widget. The Clock widget can optionally show the current temperature next to the date; when you turn that on, it makes the same request for the city you chose. Forecasts are cached in memory for 15 minutes. The Air Quality widget works the same way: it sends Open-Meteo (air-quality-api.open-meteo.com) only the coordinates of the city you typed, for the air-quality, UV and pollen readings.

News (opt-in): only if you add a News widget. The extension fetches the RSS or Atom feed you picked or pasted (for example BBC News or a site of your own choice) directly from that site, every so often while a new tab with the widget is open. Chrome asks you to allow that one site first, and you can revoke it in Settings → Privacy & permissions. The request carries no account, key or identifier from GridPeek Tab. Headlines are cached in memory; the feed address is stored like any other widget setting. Opening a headline is an ordinary link.

Sunrise & Sunset and Moon Phase: the times and phases are worked out on your device. Sunrise & Sunset asks Open-Meteo's geocoder once, when you save, for the coordinates and time zone of the city you typed; nothing is requested after that. Moon Phase sends nothing.

Caption Check: the caption you type is stored like a note, with the platforms you picked. Counting, the "…more" folds and the limits are all worked out on the page; nothing is sent anywhere.

Market Ticker (opt-in): only if you add one, the extension asks Yahoo Finance (query1.finance.yahoo.com) for the prices of the symbols you listed, such as AAPL or BTC-USD, every two minutes while a new tab with the widget is open and visible. The request contains only the symbol and the period (day, week, month or year): no cookies, referrer, account, key or identifier. Chrome asks you to allow that one site when you save the widget, and you can revoke it in Settings → Privacy & permissions. Your symbols are stored like any other widget setting. Prices are cached in memory for one minute.

Flight Tracker (opt-in): only if you add one. The flight numbers you typed are sent to adsbdb (api.adsbdb.com) for the airline and route, and the flight's callsign to adsb.lol (api.adsb.lol) for the plane's live position from public ADS-B receivers, about once a minute while a new tab with the widget is open and visible. Chrome asks you to allow api.adsb.lol when you save the widget. Optionally you can paste your own AeroDataBox key (from RapidAPI); the flight numbers are then also sent, with that key, to aerodatabox.p.rapidapi.com for times, terminals and gates: every 15 minutes around the flight, and every few hours before it. The key is stored only in this device's chrome.storage.local: it is not synced, exported or backed up, and the widget's settings can remove it. Routes and schedules are cached in this device's local storage so new tabs do not ask again. No cookies or referrer are sent.

Calendar subscriptions (opt-in): only if you paste a calendar link (an iCal/webcal address from Google Calendar, Apple iCloud or another provider) into a Calendar widget. Your browser then fetches that link directly from the provider, at most about every 30 minutes while a new tab is open, without cookies. Chrome asks you to allow that one site when you add the link. From the start of last month to six months ahead, each event's title and times, and the details the calendar includes (place, description, video-call link, organizer and guests with their replies, and links to attachments; never the attachments themselves), are kept in this device's chrome.storage.local so the widget can show them. Anyone who has such a link can read that calendar, so the link itself is also stored only on this device: it is not synced, exported or backed up. Removing the link (or the widget) deletes the cached events and gives back the site access. These calendars are read-only: GridPeek Tab never changes them. Events you add yourself are saved with the widget, like a note. If you turn on a calendar's reminders, the next two days of its timed events (title, times, place and call link) are copied into this device's local storage for the extension's background worker, which shows a notification and plays the sound you picked (generated on the device, in a hidden extension page) at the time you chose. Nothing about them leaves the device.

Focus Sound: the ambient sounds are generated on your device with the browser's audio engine. No audio files are loaded and nothing is sent anywhere. Rage Clicks only reacts to clicks on its own tile; its impact sounds are generated on your device, and anything you type on the tile to smash once is never saved.

AI button and Google Apps: the “AI” button in the search box opens Google’s AI Mode with your query, only when you click it. The Google Apps widget is a list of ordinary links to google.com pages; it can’t see your account or which apps you have, and stores only which shortcuts you picked and an account number.

Intro tour: the first-run tour is drawn entirely on the page, uses no network, and stores only two on/off flags (whether it is enabled and whether it has been shown). Its optional "Add a few examples" button adds ordinary links and widgets only when you press it.

Teleprompter: the script you type is stored like a note, with its speed, text size and colour settings. Scrolling, timing, full screen and the floating window all happen on your device; nothing is sent anywhere. Show in the Notch keeps a copy of the script you're reading in the extension's local storage on this device, so the Notch can show it on every tab; the websites themselves can't read it, and it's removed when you bring it back.

Travel Globe: the countries you mark as visited or as a wish, and the month you marked them, are stored like any other widget setting. The world map is drawn from outlines bundled inside the extension (Natural Earth, public domain), so nothing is downloaded and nothing is sent anywhere. The stamp sound is generated on the page.

Trend Radar: stores the platforms you picked, your watchlist of hashtags and keywords (with when you last clicked each one, so the radar knows what you checked today), the board and collection links you pinned, and which trending pages to show, like any other widget setting. Every search, board and trending page is an ordinary link that opens the platform's own page in a tab when you click it; the widget fetches nothing, reads no account and sends nothing anywhere. The platform logos are bundled inside the extension (Simple Icons, CC0).

Color Drop: stores your palette (the colour codes, and the CSS of any gradient you mixed), which format to copy them in and which colour is picked, like any other widget setting. The eyedropper is Chrome’s own: it only reads the one pixel you click, and only when you press it. Pasting a code while the pointer is over the tile reads just that paste. Copying puts the code on your clipboard; nothing is sent anywhere.

Rental Profit: stores the numbers you enter for your rental (nightly rate, occupancy, fees, cleaning costs, monthly bills, seasonality and, if you add it, the cash you put in) like any other widget setting. Every figure is worked out on your device. The save button creates a JSON file on your computer through Chrome’s normal download; loading a file reads only the one file you pick. Nothing is sent anywhere.

Cat Companion: stores the cat's name, coat, sound setting and when it was last fed, watered and petted, like any other widget setting. The purring, meowing and every animation are made on the page; nothing is sent anywhere.

Live Embed (opt-in): for sports scores, a next-bus board or any other live page. You paste the iframe code (or link) the provider gives you, and the widget shows that page inside a sandboxed frame. The extension itself sends nothing and has no fetch or API code for it; the frame contacts the provider directly, like opening its page in a tab, but without sending a referrer. Only the https address is kept, in chrome.storage.local on this device: it is not synced and not included in Export, so an API key inside that link never leaves your browser. Synced settings keep only the provider's site name and the reload interval. Most providers refuse to be shown inside an extension page, so when you save, Chrome asks you to allow access to that one site, and the extension then removes that site's “don't frame me” headers from answers to its own frame (declarativeNetRequestWithHostAccess, optional host access for the site you pasted). It touches no other site and no other request. Removing the widget deletes the address, the rule and the site access. You can also revoke a site yourself at any time: in the widget's editor, in Settings → Embedded sites, or in Chrome's own extension details under Site access.

Route (opt-in): you type a start, a destination and how you travel, and the widget shows Google Maps' own embedded route (for transit, the lines and departure times). The places you type are kept only on this device, in the same device-only storage as the Live Embed address: never synced, never in Export. Google receives them when the frame loads, and again on each reload if you turn reloading on, so it can draw the route; the extension sends nothing itself. Like Live Embed, it asks Chrome for access to that one site (google.com), with the same rule and the same ways to revoke.

Import Chrome bookmarks (opt-in): in the New page dialog you can copy your Chrome bookmarks into pages. Chrome asks for the bookmarks permission only when you press that button. The extension reads your bookmark titles and addresses once, on your device, to build the pages; nothing is sent anywhere, and your bookmarks in Chrome are never changed. What you import is stored like any other shortcut.

Save & close tabs (opt-in): Settings → Save Tabs, off unless you switch it on. Turning it on asks Chrome for the tabs permission, so the extension can read the address and title of each tab in a window. It reads them only when you press Save now, its toolbar menu item or its keyboard shortcut, and only for that window: each website becomes a shortcut in a new folder on your pages (queued in chrome.storage.local as ht:tabbox until the new tab files it), and those tabs close. Nothing is sent anywhere. Turning it off gives the permission back.

Voice Notes: the widget stores the notes it creates, like any other note. Pressing its Speak button uses the same built-in browser speech recognition as the microphone button below, with the same caveat, and only while you have pressed it.

The other exception: the microphone button next to the search box uses your browser's built-in speech recognition to turn speech into text. Chrome may process that on-device or send the audio to its own speech service to transcribe it, the same as using voice typing anywhere else in Chrome. This only happens while you're pressing/holding that button; nothing is recorded or sent otherwise, and the extension itself never sees or stores the audio.

Dictation (opt-in): Settings → Dictation, off unless you switch it on, lets you hold a shortcut in a text field on a website (or the new tab) and speak instead of typing. While the shortcut is held, GridPeek Tab uses the microphone from its own hidden extension page, never the website's, and the same built-in browser speech recognition as the search box's microphone, with the same caveat: Chrome may send the audio to its own speech service to transcribe it. When you let go, the words are typed at your cursor. The website only receives the typed text, like any text you type yourself. Nothing is recorded, stored or sent anywhere else, and the microphone is closed as soon as you let go.

Pages bar on websites (opt-in): Settings → Pages bar → Every website adds a slim handle to the edge of the websites you visit, which opens your pages and their shortcuts. Chrome asks you to allow GridPeek Tab on all sites first; turning the option off gives that access back. The bar is drawn in a sealed-off layer of each page: it reads nothing from the sites you visit and sends nothing anywhere. It shows a copy of your page names and links (plus the start time of any running Timer or Pomodoro, for the Notch look) that the new tab keeps in chrome.storage.local on this device; shortcut icons come from Chrome's own favicon cache. "Add this site" files the current page's address and title into GridPeek Tab, like the toolbar button. The Spotlight look listens only for two presses of Shift to open; what you type in it stays in the page and is only sent to your search engine if you pick "Search the web". The Notch's Watcher and Cat companions follow where the mouse pointer is on screen to move their eyes; that position is used on the spot and never stored or sent. The Copycat companion types along when you press a key: it is told only whether the key was a letter, Backspace or Enter, never which key or what you typed, and nothing is stored or sent. The Now Playing companion shows what a tab is playing: only while it is picked, and only for the tab Chrome marks as making sound, the extension reads the title, artist and artwork that site hands the browser for its media keys (or the tab's title if it gives none). It keeps that one track in chrome.storage.local on this device (ht:media) for the notch to show, shrinks the artwork to a small picture there, and sends nothing anywhere. Picking it asks Chrome for access to websites if GridPeek Tab doesn't have it yet; without it, the notch only shows that something is playing. Its player can also pop the video out into Chrome's own Picture-in-Picture window when you press that button (Settings can switch the button off); the video stays in its tab and nothing is copied or sent. If you pick your own GIF for its indicator, that picture is kept in chrome.storage.local on this device (ht:musicgif) and never sent anywhere; Remove deletes it. The Now Playing widget reads the same track the same way, only while one is on a page; a GIF picked for it is kept with your other uploaded images on this device. The Floating vinyl (Settings → Floating vinyl, off unless you switch it on) shows that same track as a small record on the websites you visit, in the same sealed-off layer; where you drag it is kept on this device (ht:vinylspot), and it reads nothing from those sites.

Other tools on websites (opt-in): each of these is off until you switch it on in Settings, uses the same "every website" access as the pages bar, runs in a sealed-off layer of the page, and sends nothing anywhere.

• Floating snippets shows your Text Snippets on websites; clicking one types it where your cursor is. Snippets you add or change there are queued on this device (ht:snipbox) until the new tab files them. Where you drag the button is kept on this device.
• Typing sounds and the words-per-minute pill play a key sound as you type on websites. They are told only what kind of key it was (a letter, a big key such as Enter, or another key) and when, never which key or what you typed. The typing speed is counted on the spot and not stored.
• Clip to Notes (the button by selected text, or the right-click menu) copies the text you selected, with the page's title and address, into the note you pick, only when you click. Which note you clipped to last is kept on this device (ht:cliplast).
• Site Limits counts how long each site you listed is on screen today (ht:focususe, this device only, starting over at midnight), so it can cover the page when your limit is reached. With "Every site", each site's time today is counted the same way. Nothing about your browsing is kept beyond that day's totals per site name, and nothing is sent anywhere.
• Eye Care reminds you to rest your eyes every 20 minutes (only the timing is kept, ht:eyes). Night mode tints or darkens pages between the hours you pick.
• Video Speed changes the playback speed of videos on the page with the S, D and R keys (only outside text fields). With "Remember per site" on, each site's last speed is kept on this device (ht:speeds).

Page Watcher (opt-in): you pick a page, or one part of it, from the toolbar button's menu, and how often to check it (from every 5 minutes to daily). Chrome asks you to allow that one site, and the notifications and alarms permissions, first. While Chrome runs, the extension's background worker loads that page on your schedule, as you, with your cookies, so pages behind your own login work, and compares the watched part's text with the last check. Pages that build themselves with scripts are opened in a background tab for a few seconds instead, then closed. When the text changes you get a Chrome notification. The address, the part you picked, its last text and a short history of changes are kept only in this device's chrome.storage.local (ht:watch). Nothing is sent anywhere except the page request to that site itself. Removing a watch deletes it.

Highlighter (opt-in): highlights and notes you add on websites, with each page's address and title, are kept only on this device (ht:hl: keys in chrome.storage.local), so they come back when you return to the page. Settings → Highlighter lists them to search, edit, copy or export. Snapshots (off unless you switch them on) save a picture of the highlight and the words around it, in the extension's own storage on this device; Chrome only lets an extension take that picture with access to all sites (<all_urls>), so Chrome asks for that separately. Nothing is sent anywhere.

Screen Time (opt-in): Settings → Screen Time, off unless you switch it on, counts how long each website is on screen, by site name, day and hour, on this device only (ht:screentime), for the last 35 days. Older days are deleted automatically. No addresses beyond the site name, no page content and nothing else about your browsing is kept, and nothing is sent anywhere.

Copy / Save as Markdown (opt-in): Settings → Markdown adds right-click items that turn the page, or the text you selected, into Markdown, only when you click one. The result goes to your clipboard or into a file saved through Chrome's normal download. Nothing is stored or sent anywhere.

Convert Wheel (opt-in): Settings → Convert Wheel lets you drag a picture off a website to convert it to another format. Only the picture you dragged is fetched (from the site it is on, as your browser would load it) and converted on your device; the result is saved through Chrome's normal download or copied to your clipboard. Nothing is sent anywhere else.

Text docs and PIN lock: text docs you write in folders, and text files you bring in, are stored like notes. If you set a PIN, only a salted hash of it is kept (PBKDF2), never the PIN itself, and which locked pages are open right now lives in Chrome's session storage, which websites can't read. The lock hides pages from people using your computer; it is not encryption. Backups can leave locked docs out (Settings).

Auto-backup (opt-in): you pick one file on your computer once, and the extension writes your data to it (the same format as Export) a little after each change, using the browser's own file access. The file stays where you put it; if that folder is synced (iCloud Drive, Dropbox), that service syncs it like any other file. The extension sends it nowhere.

Share pictures: the Travel Globe's and the Fridge's share cards are drawn on your device from the widget's settings. Nothing leaves your device until you download or copy the picture yourself.

GridPeek Pro (optional, paid): all of GridPeek Tab works without it, and nothing below happens unless you start a free trial, buy Pro or enter a licence key.

• The free trial is recorded only in your browser (ht:trial, the date it started). Nothing is sent anywhere.
• Paying happens on Stripe's own checkout page, opened in a tab. Stripe collects your email, payment details and billing country, and handles them under Stripe's privacy policy. GridPeek Tab never sees your card details.
• The licence server (gridpeek-pro.gridpeek.workers.dev, run by GridPeek on Cloudflare) creates your licence key and checks it. The extension contacts it only when you buy, enter a key, open "Manage billing", or, if you have Pro, about once a week to confirm the licence is still valid (for example, that a subscription was renewed or cancelled). Each request contains only your licence key (or the checkout's reference number) and a random browser ID that GridPeek Tab makes up on install. The ID identifies the browser, not you; it exists so one key can be used on up to three browsers.
• What the server keeps, per licence key: the plan, Stripe's reference numbers for the customer and the payment or subscription, the browser IDs using the key (at most three), and when it was created. It keeps no names, emails, browsing data or anything else from your new tab, and it does not log IP addresses. GridPeek can see the email and name you gave Stripe in Stripe's dashboard, and uses them only to help you find a lost key, handle refunds and answer billing questions.
• In your browser: the signed licence is saved in chrome.storage.sync (ht:pro) so Pro follows you to your other signed-in browsers; the browser ID (ht:browser), when the licence was last checked (ht:procheck) and an unfinished checkout (ht:checkout) stay in this device's chrome.storage.local.
• Your licence key is also printed on your Stripe receipts, and you can see it any time in Settings → GridPeek Pro.

How your data is used and shared: data stays in your browser and is used only to run the features you use. The only data that leaves it is what the sections above describe, sent only to the service named there and only so that feature can work. GridPeek does not sell or rent your data, does not use it for advertising, and does not use or transfer it to work out creditworthiness or for lending. Nobody at GridPeek reads it, except your licence and Stripe billing details when you ask for help, or when required by law. The use of information received from Google APIs follows the Chrome Web Store User Data Policy, including the Limited Use requirements.

Permissions and why:

• bookmarks (optional): only for the bookmark import above.
• tabs (optional): only for Save & close tabs above, once you switch it on.
• storage: save your data as described above.
• unlimitedStorage: lets your uploaded images, snapshots and widget data on this device grow past Chrome's default 10 MB limit. It sends nothing anywhere.
• favicon: show each site's icon on its tile.
• contextMenus: the "Add to GridPeek Tab" right-click item, which adds the page or clips the selected text.
• activeTab: read the address and title of the page you are adding, only when you click "Add to GridPeek Tab" or the toolbar button.
• notifications and alarms (optional): only for Life Admin's desktop reminders and Calendar reminders (see above), once you switch them on. Turning them off gives them back.
• offscreen: a hidden extension page that plays a Calendar reminder's sound (a background worker can't play audio). It loads nothing from the web.
• declarativeNetRequestWithHostAccess and optional access to https://*/*: only for the Live Embed and Route widgets (see above), and the one feed, price, flight-position or calendar site a News, Market Ticker, Flight Tracker or Calendar widget fetches from, and the GridPeek Pro licence server (which needs no permission). Nothing is granted at install; Chrome asks for one named site at a time, and you can revoke each.
• scripting and optional access to all https:// and http:// sites: only for the pages bar, Dictation, Now Playing, Highlighter, Page Watcher, Screen Time, Markdown, Convert Wheel and the other tools on websites (see above), and only once you switch one on. <all_urls> (optional) is asked for only by Highlighter snapshots.

Your data, your control: Settings → Privacy & permissions lists every permission GridPeek Tab holds or can ask for, what uses it and why, its live state, and where data can leave your browser; each optional one can be given back there, or all at once. Settings → Export downloads everything as a JSON file; Import restores it. Removing the extension deletes the data stored in your browser. To have your licence record deleted from the licence server, contact us; a subscription has to be cancelled first, and your payment records stay with Stripe as the law requires.

Safe to Spend: stores your budget, pay cycle, categories and the spends you type (amount, time, category and your note), keeping only the last ten weeks, like any other widget setting. Every number is worked out on your device. “Download spends (CSV)” creates a file on your computer through Chrome’s normal download. Nothing is sent anywhere.

Subscriptions: stores the plans you list (name, price, how often it renews, the next charge date, a colour and an optional link to its account page) like any other widget setting. Renewal dates and totals are worked out on your device. The icons of the common services in Quick add (Netflix, Spotify and the rest) ship with the extension. For any other plan with a link, its icon is looked up from Google’s favicon service (which sees the site’s address) or Chrome’s built-in favicon cache; a plan's link only opens when you click it. Nothing is sent anywhere.

Life Admin: stores the things you list (name, kind, date, optional time, amount, how often it repeats, which occurrence you last marked done, and a note) like any other widget setting. When "Show their renewals here" is on, it reads the plans of your Subscriptions tiles on your device; nothing is copied or sent. It remembers the day it last nudged you (ht:adminSeen, this device only). Desktop reminders are opt-in: turning them on asks Chrome for the notifications and alarms permissions. The new tab then keeps a short list of what is coming up in the next 60 days (names, dates and times only, in local storage as ht:adminDue), and the extension's background worker checks it every 30 minutes and shows a Chrome notification from each item's warning day, once (what it has shown is remembered in ht:adminNotified). Turning reminders off removes both permissions. Nothing is sent anywhere.

Label Printer: stores the label's text, size, code settings and next number like any other widget setting. QR codes and barcodes are made on your device. Printing goes through Chrome's own print dialog; nothing is sent anywhere except to the printer you choose there.

Date Ticket: stores what you write on the ticket and how it looks like any other widget setting. The image is drawn on your device; Download saves a PNG to your downloads folder and Copy puts it on your clipboard only when you click them. Nothing is sent anywhere.

Flag Quiz and Know This: the flags (flag-icons, MIT licence) and the cards ship with the extension; nothing is fetched. Flag Quiz stores your best score and how many rounds you played; Know This stores which topics you picked, which cards you marked and your streak. Nothing is sent anywhere.

Children: GridPeek Tab is not aimed at children under 13 and does not knowingly collect anything from them.

Changes: if this policy changes, the date at the top changes too, and anything new that leaves your browser will be described here before an update ships.

Contact: gridpeek.com/contact.