Last updated: 22 October 2026

Privacy policy

TaboraX is built by ZilFox Technologies Pvt. Ltd. This page explains, in plain language, what the TaboraX extension and this website do and don't do with your information.

The short version

  • You can use TaboraX without an account, and then your setup stays in your browser.
  • If you sign in, we keep an end-to-end encrypted copy of your setup on our servers so it can sync between your devices. It's encrypted in your browser with a key from your password, so we can't read it.
  • We don't sell your data, show ads, or use analytics or advertising trackers.
  • You can delete your account yourself, at any time, from your profile.

What stays on your device

Without an account, your shortcuts, folders, icons, notes, to-do items, saved tab sessions, wallpaper choice and every other setting are stored only in your browser's local storage. We never receive them and cannot read them. The only things that leave your device are described in the sections below: the address of a shortcut, or of a web address you type into the search bar, when it's checked for safety, your location if you turn on weather, requests for site icons, a group you choose to share, a once-a-day check of whether plans can be bought, and — for copies installed from our website — a once-a-day check for a newer version. Neither check sends anything about you.

Some things never leave your device, even when you're signed in: the daily tally behind Your week (how many focus sessions and minutes, and how many to-dos you finished, per day — kept for 70 days), and the family PIN, of which only a scrambled (hashed) form is kept, on that computer alone.

Restore points — copies of your setup that TaboraX keeps so a mistake can be undone (once a day, after each update, and before anything replaces your setup) — are stored in your browser on that device, never uploaded, and deleted along with everything else when you choose Log out and remove my data from this browser. A file you import from another app (bookmarks, Pocket, OneTab and the like) is read in your browser and isn't sent anywhere.

If you create an account

Signing in is optional. It lets your setup follow you to other devices. If you create an account:

  • We store your email address, your first and last name, and a securely hashed version of your password. We never store the password itself.
  • Your settings, shortcuts, folders, notes, to-do items, saved tab sessions and profile photo are saved to your account on our servers so they can sync. They're encrypted in your browser before they're sent (AES-GCM, with a key made from your password on your device), so we only hold a copy we can't open. On X Flux, a wallpaper photo you upload is synced the same way, encrypted first.
  • Because we never have your password or that key, we can't recover synced data for you: if you reset a forgotten password, what was synced before can't be decrypted, and the copy on the device you reset from becomes your synced copy.
  • We also keep a record of which TaboraX plan your account is on, when it started or ends, and when you last opened TaboraX while signed in.
  • For each device you're signed in on, we keep the browser and system it reported (for example "Chrome on Windows"), when it signed in and when it was last used, so you can see your signed-in devices and sign any of them out.
  • Each account has its own invite code. If you sign up with a friend's code, or a friend uses yours, we record which account invited which, so both of you get the reward.
  • We only email you about your account — for example one-time security codes and confirmation that your account was deleted. We don't send marketing email.
  • If you forget your password, we email you a one-time code that expires after 10 minutes.
  • You stay signed in for up to 30 days on each device, or until you log out. A sign-in on TaboraX on the web lasts 12 hours at most, and ends sooner — when you close or leave that page, sign out, or do nothing for 30 minutes.

Your account data is stored on servers provided by our web hosting company and is kept for as long as your account exists.

Deleting your account

You can delete your account from the extension: open your profile, choose Delete account, and enter the one-time code we email to you to confirm. As soon as you confirm:

  • Your account, and everything synced to it — settings, shortcuts, folders, notes, to-do items, profile photo, wallpaper photo and invite code — is permanently removed from our servers.
  • You're signed out on every device.
  • What's already stored in your browser stays there, so you can keep using TaboraX without an account.

Deleted data may remain in our hosting provider's routine backups for a short time before those backups are replaced. If you can no longer get into your account or your email, write to connect@taborax.com and we'll help.

Two things are kept after deletion, without your email, name or anything else that identifies you: a note that an account was deleted (the date, and the plan it was on), and a record of any plans it bought or codes it redeemed (the plan, price, dates and order or code), which we need for our accounts. Friends who joined with your invite code keep a note that they used an invite, no longer linked to you.

TaboraX on the web

On X Flux you can see your synced shortcuts, notes, to-dos and saved tabs at taborax.com/app.html, on any computer. You sign in there with your email and password; the page makes the decryption key from your password in that browser and opens your encrypted copy there — the password and the key are never sent to us, as with sync. The page shows your data without changing it, keeps nothing on that computer (no cookies, nothing in its storage), and forgets everything when you close it, reload it or sign out.

Sharing a group

If you share a group, the extension locks its shortcut names and addresses with a new random key and sends us only the locked copy. The key is part of the link you share (after the #, which browsers never send to a server), so we store something we can't read. Anyone you give the link to can see the group's sites on taborax.com/share.html, which unlocks it in their browser. We count how many times a shared link is opened, but not by whom. Choosing Stop sharing deletes the locked copy from our server, and the link stops working. To limit misuse, the number of new shares from one internet address is capped; that address is kept for a day at most.

Paid plans

All TaboraX plans are free until 31 December 2026, and we may extend this promotion. If we do, the new end date will be shown on our pricing page.

You can buy a paid plan in the extension, or activate one with a code, while signed in. For each purchase or code we store the plan, the price, the dates it runs and the order or code, linked to your account, so we can show your plan and handle refunds.

Card and PayPal payments are made on Paddle's checkout (Paddle.com is our reseller and merchant of record), and Nepali payments on Khalti's. You type your payment details into their pages, never into TaboraX, and we never see them: from Paddle or Khalti we only learn that an order was paid. They process the payment under their own privacy policies — Paddle, Khalti. The checkout page on taborax.com loads Paddle's own script, only on that page.

Link safety checks

When you add or edit a shortcut, or type a web address (rather than a search) into the new tab's search bar, that address is sent to our server and checked with Google Cloud Web Risk, a service that identifies suspected phishing, malware and unwanted software. Only that address is sent, whether or not you are signed in, and we do not store it. Ordinary searches are never sent to us. The result is shown right in the search bar, and a flagged address isn't opened unless you choose to open it anyway. Google processes the address under the Google Cloud Privacy Notice.

Short links (from bit.ly, tinyurl.com and other well-known link shorteners) are followed by our server to see where they lead: it asks only the shortener for its redirect, never opens the destination, and checks the final address the same way. Neither address is stored.

Look-alike checks — addresses made to resemble a well-known site, such as paypa1.com — happen entirely in the extension, against a built-in list of popular sites and your own shortcuts. Nothing is sent for them.

No protection is perfect. Google works to provide accurate, up-to-date information about unsafe sites, but it cannot guarantee that information is complete and error-free: some risky sites may not be flagged, and some safe sites may be flagged by mistake.

What we do not collect

  • Your browsing history or the pages you visit
  • The content of the websites you visit, which the extension cannot read
  • Your search queries — these go straight to the search engine you chose (a web address typed in the search bar is only checked for safety, as described above, and not stored)
  • Analytics, advertising IDs or tracking cookies, in the extension or on this website

We don't sell, rent or share your information with anyone for advertising.

Weather and location

The weather widget asks your browser for permission to use your location. If you allow it, your coordinates are sent to Open-Meteo (open-meteo.com) to get the current conditions, and only the resulting temperature and weather are kept on your device. Turning the widget off, or declining the permission, stops this entirely.

Site icons and fonts

To show sharp icons for your shortcuts, the extension asks Google's favicon service for each shortcut's icon, which shares that site's address with Google. If that request fails, it uses the icons your browser has already saved. The new tab page's fonts are part of the extension, so no font is downloaded.

Wallpapers

The built-in live sky and art backgrounds are drawn by the extension itself, so nothing is downloaded for them. A wallpaper photo you upload stays on your device, unless you're signed in on X Flux: then it syncs to your other devices, encrypted in your browser first like the rest of your synced data.

This website

taborax.com doesn't use cookies, analytics or advertising trackers. The shared-group and web pages draw each site's icon themselves, so the addresses on them aren't sent to anyone for icons. If you switch between the light and dark theme, that choice is remembered in your own browser, and if you arrive through a friend's invite link, the invite code is kept in your browser for that visit only, so we can show it to you. The website's fonts are served from taborax.com itself.

If you remove the extension, your browser opens a short page asking why. Answering is optional; an answer is stored with only the reason you picked, any comment you write and the extension version — not with your account, email or IP address.

When you contact us

The contact form opens your own email app with your message filled in; nothing is sent until you send the email yourself. We keep your message and email address only for as long as it takes to help you, and we don't add you to any marketing list.

Permissions we request

Besides replacing the new tab page, the extension asks for three permissions: your browser's saved site icons (to show shortcut icons), your default search engine (so the search bar can use it), and your location (used only by the weather widget). It does not request access to read the content of the websites you visit.

If you choose to import your bookmarks bar or your most-visited sites, the extension asks for that one extra permission at that moment, reads the list once on your device to create shortcuts, and gives the permission straight back. Nothing from it is sent to us.

TaboraX also keeps its restore points in browser storage that the browser won't clear on its own ("unlimited storage"); browsers don't ask about this one, and it lets nothing leave your device.

Two features ask for a permission the first time you use them, and not before:

  • Tabs asks to read your tabs — when you first save a window's tabs or choose Show my open tabs. With it, TaboraX reads the addresses and titles of your open tabs, and when each was last looked at, only while a new tab or the Tabs pane is open: to list and search them, close duplicates or tabs you pick, count the tabs you haven't opened for 3 days, and keep a few copies of what was open in case the browser closes unexpectedly. Nothing about your tabs is sent to us. Saved sessions stay on your device, or sync encrypted if you're signed in; archived tabs and those copies stay on your device only, and are deleted by Log out and remove my data from this browser.
  • Blocking sites while you focus asks to block or redirect pages on just the sites you list. During a focus session the browser shows TaboraX's reminder instead of those sites; the extension never reads their pages, and the rule is removed when the session ends.

You can take either permission back at any time in your browser's extension settings.

Children

TaboraX is a general-purpose tool and is not directed at children under 13. The family lock lets a parent lock the settings on a shared computer and keep SafeSearch on; it doesn't collect anything about the people using that computer.

Changes to this policy

If this policy changes, we'll update the date at the top of this page. If a change affects how we use information we already hold about you, we'll also tell you by email or in the extension before it takes effect.

Contact

Questions about privacy can go to connect@taborax.com, or to ZilFox Technologies Pvt. Ltd., Kathmandu, Nepal.