Last updated: 2026-05-24
Tabio is designed so that the operator cannot read the contents of your bookmarks. Bookmark titles, URLs, and folder structure are encrypted on your device with AES-256-GCM before they are transmitted. The encryption key is derived from a passphrase you choose and never leaves your device. The server only ever sees ciphertext.
When you set a passphrase, Tabio derives an AES-256 encryption key from it using PBKDF2-SHA256 with 600,000 iterations and a per-account salt. That key, and the passphrase it is derived from, are held only in memory on your device and are never sent to the server.
Every bookmark record is encrypted with AES-256-GCM before being uploaded. The server, the hosting provider, and the operator of this service receive only opaque ciphertext and have no technical means to decrypt it. Even with full access to the database, the contents of your bookmarks cannot be recovered without your passphrase.
This design has a trade-off: if you lose your passphrase, your encrypted bookmarks cannot be recovered by anyone, including us. There is no recovery mechanism by design.
The data we hold falls into two categories:
Encrypted on your device before it reaches our server:
Stored in plaintext (we can read this):
The service runs on the following providers. Each one only sees the data it strictly needs.
Tabio does not load third-party analytics, advertising, or tracking scripts. No personal data is sold or shared for marketing purposes.
Encrypted bookmark data is stored in a Cloudflare D1 database. Cloudflare may replicate data across regions for availability; the ciphertext design means the storage region does not affect the confidentiality of your bookmarks. WorkOS and Stripe each operate their own regional infrastructure as described in their respective privacy policies.
You can delete individual bookmarks and profiles from inside the extension at any time; deletions are removed from our database immediately. To delete your entire account, including all profiles, bookmarks, and your user record, email privacy@tabio.app. We process deletion requests within 14 days. Authentication records held by WorkOS and billing records held by Stripe are deleted according to their respective retention policies.
Under the GDPR you have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict its processing. Contact privacy@tabio.app to exercise any of these rights. You may also lodge a complaint with the data protection authority in your country of residence; in Germany this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
If we change this policy in a way that materially affects how we handle your data, we will notify users by email before the change takes effect.
For any privacy question, contact privacy@tabio.app.