Summary
- Arbor stores its data in your browser’s local extension storage. There is no BrowserForge server and no account.
- Arbor contains no analytics, telemetry, crash reporting or advertising code.
- Arbor can make 2 kinds of network request, all optional and listed in full under Network connections.
- Arbor never sells, rents or shares your data with anyone, because it never has it.
- Uninstalling Arbor deletes all of its local data.
Scope
This policy covers the Arbor browser extension for Chrome and Edge, published by Shantanu Ojha under the BrowserForge name (“we”, “us”). It applies to every version of Arbor distributed through the Chrome Web Store, Microsoft Edge Add-ons, or built from the source at GitHub.
This website (BrowserForge pages on shantanuojha.com and its subdomains) sets no cookies, runs no analytics and loads no third-party scripts or fonts. Hosting is provided by Vercel, whose edge servers see the usual request metadata (IP address, user agent) in order to serve pages; we do not enable Vercel’s analytics products.
Data handled
To do its job, Arbor handles the following data. All of it stays on your device unless a row in the network table says otherwise.
- The URL, title and favicon of each open tab, and the structure of your windows and tab groups. This is required to draw the tree.
- Notes you write on tree nodes.
- Snapshots of the tree, kept so a session can be recovered after a crash.
- Settings, such as backup schedule and keyboard shortcuts.
- If you activate Pro: your licence key and the resulting entitlement status.
Where data lives
Arbor uses the browser’s extension storage (chrome.storage.local ) and, where noted,
IndexedDB inside the extension’s own origin. This storage is isolated from websites and from other
extensions. It is not readable by us. We operate no database, no backend and no account system.
Network connections
The complete list of destinations Arbor can contact is below. Each one is optional and off until you turn the corresponding feature on.
| Destination | When | What is sent | What is stored |
|---|---|---|---|
| Lemon Squeezy licence API (api.lemonsqueezy.com) | Only when you enter a Pro licence key, and periodically afterwards to re-validate it (at most once a day, and only if a key is stored). | The licence key you typed and a random instance identifier generated by the extension. No browsing data, no tab or rule contents, no account information. | Whether the key is valid, and the instance identifier, in local extension storage. |
| Google Drive API (www.googleapis.com), using your own Google account | Only if you turn on Drive backup (Pro) and only when a backup runs or you restore one. | Your Arbor backup file, containing your tree, notes and settings, sent directly from your browser to your Drive with an OAuth token issued by Chrome (scope drive.file). | Backups live in your Google Drive under your control. The OAuth token is held by Chrome, not by Arbor, and is revoked when you disconnect. |
- Optional Pro licence activation. When you enter a licence key, the extension sends the key and a random instance identifier to the Lemon Squeezy licence API to activate and later re-validate it. Nothing else is sent. The response (valid or not, and the licence expiry if any) is stored locally as an entitlement flag.
- Optional Google Drive backup (Pro). If you turn it on, Arbor asks Chrome for a Google OAuth token via chrome.identity with the drive.file scope. That scope only grants access to files Arbor itself creates. Backup files are uploaded directly from your browser to your own Google Drive; they never pass through a BrowserForge server, because there is none. You can disconnect at any time from the Arbor settings page or from your Google account permissions page, after which Arbor holds no token.
- No other network requests are made. Arbor does not fetch favicons from third parties; it uses the favicon Chrome already has.
Lemon Squeezy is our merchant of record for Pro licences. When you buy a licence, your payment details and email address are handled by Lemon Squeezy under its privacy policy . The extension itself never sees your payment details or your email address.
Permissions explained
Every permission in the Arbor manifest is listed here with the reason it is needed. Optional permissions are requested only when you enable the corresponding feature and can be revoked from the extension’s details page in your browser.
| Permission | Type | Why Arbor needs it |
|---|---|---|
tabs | permission | Read the URL and title of each tab and react to tabs opening, moving and closing so the tree stays current. |
tabGroups | permission | Show tab groups in the tree and keep group colours and names in saved sessions. |
sidePanel | permission | Display the tree in the browser side panel. |
storage | permission | Store the tree, notes, snapshots and settings locally. |
unlimitedStorage | permission | Large trees and snapshot histories can exceed the default storage quota. |
sessions | permission | Restore recently closed tabs and windows with their history intact. |
favicon | permission | Show the favicon Chrome has already cached for each tab, without contacting any site. |
alarms | permission | Run scheduled local backups (Pro) at the interval you choose. |
downloads | permission | Write backup files to your downloads folder when you export or when a scheduled backup runs. |
identity | optional permission | Obtain a Google OAuth token for Drive backup (Pro). Requested only when you enable Drive backup. |
https://www.googleapis.com/* | host permission | Upload backups to Google Drive (Pro). Requested only when you enable Drive backup. |
Retention and deletion
- Tree data, notes and snapshots stay in local extension storage until you delete them in Arbor or uninstall the extension. Uninstalling removes all local extension data.
- Backup files you export, or that scheduled backups write, are ordinary files on your disk or in your Google Drive and are under your control.
- The licence entitlement flag is removed when you deactivate the licence or uninstall.
- You can delete everything at once by removing the extension. Chrome and Edge delete an extension’s local storage on uninstall.
Sharing and sale
We do not sell, rent, trade or otherwise share your data with third parties, and we do not use it for advertising, profiling or training. We cannot: Arbor does not send your data to us. The only third parties that can receive data from Arbor are the ones you choose to connect in the network table above, and each of those receives only what that row describes.
Limited Use
Arbor’s use of information received from Google APIs, including Chrome extension APIs and the Google Drive API, adheres to the Chrome Web Store User Data Policy , including its Limited Use requirements. Specifically:
- Data is used only to provide or improve the user-facing features described on the Arbor listing and product page.
- Data is not transferred to anyone except as necessary to provide those features, to comply with law, or as part of a merger or acquisition with prior notice to users.
- Data is never used or transferred to serve advertisements, to determine credit-worthiness or for lending purposes.
- No human reads your data, because it never leaves your device.
Security
Extension storage is protected by the browser’s process isolation and your operating system’s user account. Backup files you export are ordinary files; protect them as you would any other document that lists the sites you visit. Network connections listed above use HTTPS. The source code is public, so anyone can check that the extension does what this policy says. If you find a discrepancy, please report it (see Contact).
Children
Arbor is a general-purpose tool and is not directed at children under 13 (or the age of digital consent in your jurisdiction). We do not knowingly collect any personal information from anyone, including children. If you believe a child has provided us with personal information by email, contact us and we will delete it.
Changes to this policy
If this policy changes, the new version is published at this address with a new effective date, and the change is noted in the Arbor release notes. If a change would let Arbor send new categories of data anywhere, we will describe it in the extension’s update notes and, where the browser supports it, ask for the new permission explicitly. The history of this document is in the website repository.
Contact
Shantanu Ojha
hello@shantanuojha.com
Security or privacy concerns can also be filed as a GitHub issue, or
by email if they should not be public.