What ReadyTab can see, and what it never does with it.

The short version

• Local by default. Your boards live in the browser's extension storage. Nothing is uploaded until you turn on sync or share a board.
• Encrypted before upload. Sync, shared and public boards are encrypted in your browser with AES-256-GCM. The server stores blobs it cannot read.
• No analytics in the extension. No telemetry, no tracking pixels, no ads. The only analytics are on this marketing site.
• No accounts. Viewers and editors of a team board need the extension and a token or key, not a login. Nobody's email address is collected to join a board.
• Hosted in Germany. The backend runs on managed hosting in the EU. ReadyTab is developed and operated by one person in Switzerland, and support is handled in a public repository.

Every permission, one line each

A permission is access, not collection. In every row below the data is read inside your browser, used for the action you asked for, and never sent to us.

About the "all websites" warning

When you install ReadyTab, the store says it can "read and change all your data on all websites". Every browser shows that sentence for any extension that registers a content script on all sites, whatever the script does. ReadyTab needs one because the spotlight search opens on any page with a keyboard shortcut, and the launcher overlay does the same. Those scripts draw a panel on top of the page. They do not read the page, and they do nothing until you press the shortcut.

If you would rather not grant that, Chrome and Edge let you restrict the extension to "on click" under the extension's site access settings. The new tab, boards, sync and sharing keep working. Only the in-page spotlight stops.

What leaves your browser, and when

Most of ReadyTab never talks to a server. The table lists every network request the extension can make, what triggers it, and who receives it.

How the encryption works

ReadyTab uses the browser's built-in Web Crypto API, not a bundled library. Sync and share payloads are encrypted with AES-256-GCM before they leave the browser, with a fresh random nonce for each upload.

• Password-protected workspaces derive their key from your passphrase with PBKDF2, 100,000 iterations of SHA-256 and a random salt. The passphrase never leaves your device, and a locked workspace stays unreadable on disk.
• Public boards carry their decryption secret in the URL fragment after the #. Browsers do not send the fragment with a request, so the server can serve the blob without ever being able to open it. Anyone with the full link can read the board, so treat the link like a password and add a board password when it matters.
• Managed boards are opened with a read token and an optional password. Editing needs an edit key the owner creates. The server stores a hash of each key, so a database leak would not hand out edit rights.
• In transit everything to the backend and to Lemon Squeezy goes over TLS.

If you are the one approving this for a team

The questions IT usually asks, answered in order.

• What does the vendor hold? Encrypted board blobs, license and plan identifiers, edit-key hashes, board management metadata and short-lived server logs. No board contents in the clear, no browsing data, no email addresses for viewers or editors.
• Where? Managed hosting in Germany, inside the EU. ReadyTab is developed and operated by one person in Switzerland, which the European Commission recognises as providing adequate data protection.
• Who else sees anything? Lemon Squeezy, the merchant of record, handles checkout and license validation. Google Analytics runs on this website only, never inside the extension.
• Can we get our data out? Every workspace exports to JSON from Settings at any time, on every plan, and imports back the same way.
• Can we revoke access? Each edit key is named and can be replaced or revoked on its own. Public links expire after 30 days unless you extend them or set them to never expire, and deleting one removes it from the backend so the link stops resolving.
• Does it need Group Policy or an MDM? No. A team board is joined with a token, so it works for the small business that has no device management. How that works in practice.
• Can we read the code? The store package is the code the browser runs. Unpack it and read it; there is no server-side logic hidden behind it beyond the sync and sharing API. Questions go to support@readytab.cloud or the public support repository.

Security questions

Does ReadyTab read the pages I visit?

No. The content scripts on every page do one thing: draw the spotlight or quick launcher overlay when you press the shortcut. They do not read, log or transmit the page you are on. The only time ReadyTab fetches a page is when you save a link, to read its title and preview image.

Why does the store warn that ReadyTab can read and change data on all websites?

Because the spotlight search works on any page, the extension has to register a content script for all sites, and every browser shows the same warning for any extension that does. The warning describes what the permission would allow, not what ReadyTab does with it.

Can ReadyTab staff read my boards?

No. Cloud sync, shared boards and public boards are encrypted in your browser before upload. The server stores the encrypted blob and the identifiers it needs to serve it. For a public board the decryption secret lives in the link fragment, which browsers never send to the server.

Do my coworkers need accounts?

No. ReadyTab has no user accounts. Viewers join a board with its read token and optional password. Editors add an edit key the owner hands out and can revoke at any time. The server stores a hash of each edit key, not the key itself.

What happens to my data when I uninstall?

Local workspaces are removed with the extension, so export them to JSON first if you want to keep them. Cloud data stays until you delete it from Settings or it expires. The uninstall survey page the browser opens carries only the version and plan type, never a license key, a board or an identifier.

How do I report a security issue?

Email support@readytab.cloud with the steps to reproduce. Please do not open a public issue for a vulnerability until it is fixed. You will get a reply from the person who wrote the code.