Privacy

What leaves your browser

When you open a website that OkayTab hasn't checked in the last 24 hours, it sends a short summary to our server:

• the address, without anything after the "?" or the "#"
• the title and the description
• the headings
• the links on the page and their texts

It never sends the text of the page, what you type, passwords, cookies or screenshots. Email addresses and phone numbers are removed from the summary before it is sent.

Many sites are never sent at all. Well-known sites are on a list that skips the check, sites you chose to always allow are skipped too, and a site checked in the last 24 hours is answered from your browser's memory.

What we keep

We keep no list of the websites you visit.

Who else gets data

• Hetzner (Germany) runs our server and database.
• OpenRouter (USA) passes the site summary to the AI model that rates it. It gets the summary, not who you are. We tell OpenRouter to use only providers that don't collect the data.
• Resend (USA) sends the email with your sign-in code.
• Polar (USA) sells the plan and takes the payment. Your card or bank details go to Polar, never to us.
• Google, only if you sign in with Google.

What we don't do

• No ads, and we don't sell data.
• No tracking cookies. The website only sets the cookies it needs to keep you signed in.
• Our visitor count runs on our own server, uses no cookies and keeps no IP addresses.
• No fonts, scripts or images from other companies on this website.

Your choices

• Delete your account. You can do it on your account page, and everything tied to you is deleted. While a plan runs, cancel it first.
• Disconnect a browser. Also on your account page. That browser stops checking and sends nothing more.
• Remove OkayTab. Uninstall it from your browser, and what it kept there goes with it.
• Ask us. Write to privacy@okaytab.app to find out what we keep about you, or to have it deleted.

The legal text

1. Who is responsible

The operator named in our imprint. Email: privacy@okaytab.app

2. Visiting the website

When you open okaytab.app, our server receives your IP address, the time, the page you asked for and your browser type. It needs them to send you the page. The server keeps them in a log for 14 days to find errors and misuse, then deletes them. Legal basis: Art. 6(1)(f) GDPR. Our interest is running the website securely.

We use your IP address to show prices in euros or US dollars. We don't store it for this.

We count visits with Umami, which runs on our own server. It uses no cookies and doesn't store IP addresses. It counts page views and steps such as "started checkout". Legal basis: Art. 6(1)(f) GDPR. Our interest is knowing which pages help.

The website loads fonts and all other files from our own server.

3. Your account

To sign in, you give us your email address, and we send a 6-digit code to it. If you sign in with Google, Google sends us your name, email address and profile picture, and we store the sign-in data Google returns for your account.

While you are signed in, a cookie keeps your session. We store the session with your IP address and browser type for 7 days. The cookie is needed for the service you asked for (§ 25(2) no. 2 TDDDG). Legal basis for the account data: Art. 6(1)(b) GDPR.

4. The extension

For each website you open, the extension first looks at the list of sites that skip the check, the sites you always allow and its own memory of sites checked in the last 24 hours. All of this stays in your browser, together with the key that links the extension to your account and the counts of the day.

If none of these answers, the extension sends the summary described above to our server. The summary can contain personal data if a website shows it in its address, title, headings or links, for example your name on a page you are signed in to. The extension removes email addresses, phone numbers, bank account numbers and long numbers from the summary before sending it.

On our server we keep:

• the answer for each site (the site's name, the answer, how sure the model was and when), for up to 24 hours, shared by all users and not tied to anyone
• per site, how often it was checked, without users, to keep costs down and to add frequent sites to the list that skips the check, kept for 12 months after the site was last checked
• when you open a stopped site anyway: your account, the site's name, the answer and the time, so OkayTab doesn't stop the site for you again and we can find wrong answers, deleted after 12 months
• the sites you always allow, until you remove them or delete your account
• per browser and day, how many sites were stopped, not sure or checked, without site names

Legal basis: Art. 6(1)(b) GDPR. Checking websites is the service you pay for.

5. The AI check

Our server sends the site summary to OpenRouter, Inc., USA, which passes it to an AI model provider. The request contains no account, IP address or browser data. We tell OpenRouter to use only providers that don't collect the data. OpenRouter does not use it to train models.

The model answers "okay", "not sure" or "not okay". The answer is about the website, not about you, and you can always open a website anyway. There is no automated decision about you in the sense of Art. 22 GDPR.

6. Payment

Polar Software Inc., 3500 South DuPont Highway, Dover, DE 19901, USA, sells the plan as merchant of record and handles the payment. Card details are collected by Stripe for Polar and never reach us. Polar's privacy policy applies to the checkout. Polar tells us which plan you have, whether it is paid and until when. When you start a checkout, we pass your IP address to Polar so it can show the right currency and tax. Your invoices are fetched from Polar when you open them; we don't store them. Legal basis: Art. 6(1)(b) GDPR.

7. Emails

Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) sends the email with your sign-in code on our behalf. It processes your email address and the email itself. We send no newsletters.

8. Hosting

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, runs our server and database in Germany. Hetzner processes the data on our behalf under a data processing agreement (Art. 28 GDPR).

9. Data outside the EU

OpenRouter, Polar and Resend are in the USA. For Resend the transfer relies on the EU-US Data Privacy Framework. For OpenRouter and Polar it relies on the EU standard contractual clauses (Art. 46(2)(c) GDPR).

10. Browser stores

You install OkayTab from the Chrome Web Store, Microsoft Edge Add-ons or Firefox Add-ons. Google, Microsoft and Mozilla handle the install and updates under their own privacy policies.

11. Your rights

You can ask us what data we have about you (Art. 15 GDPR), have it corrected (Art. 16), deleted (Art. 17) or its use limited (Art. 18), get it in a common format (Art. 20) and object to uses based on our interests (Art. 21). Write to privacy@okaytab.app. You can also complain to a data protection authority, for example the one where you live.

12. Changes

When we change what OkayTab sends or keeps, we update this page and the date at the top. If the change affects your account, we tell you by email first.