Short, because there is not much to describe.
OpenTabs has no account, no analytics and no telemetry. Your configuration — every group, every source, every to-do — is stored in your own browser profile and is never sent anywhere. There is no server holding it, which is why there is no server that could lose it.
The extension makes network requests only to fill the groups you turned on, and it asks for a site's permission at the moment it first needs it rather than at install. A group you never enable never asks for a site and never makes a request.
| What it reaches | Why, and only when |
|---|---|
opentabs.app | The apps catalogue and the trending list, as two static files. Only if one of those groups is on. |
market.opentabs.app | The pack marketplace. Only when you open it. |
auth.opentabs.app | Sign-in, for the two things that need an account. Only if you choose to sign in. |
| Sites you added | A feed, a weather API, a calendar address, a market quote — whatever the groups you configured need. You granted each one. |
Your open tabs are read by the extension and never leave the browser. They are the page's content, not data collected about you.
An account is optional and buys two things: publishing a pack to the marketplace, and liking one. It is never used to store your settings, and nothing about your configuration is uploaded when you sign in.
The session lives in memory for the browser session and is never written to disk or synced between devices.
Browsing and installing need no account and set no cookie. Install counts are a number on the pack, incremented anonymously — nothing identifies who fetched it.
A like does need an account, and here the design is worth stating precisely.
A like is stored as
HMAC-SHA256(server secret, account id ‖ pack id) and the account id
itself is not stored beside it. The likes table has no user column, so the question
"what has this account liked" has no query that answers it — the server can
check whether you liked this pack, because it can recompute that one
digest, and it cannot enumerate anything. That is a property of the schema, asserted
by a test that reads the table's columns, rather than a promise about how the data
is used.
A pack you publish is public by definition: its name, description, tags, the author handle you typed and the sources it contains. Your API keys, calendar addresses, coordinates and card sizes are stripped out before it leaves your browser, and stripped again on the server — the second time is not redundancy, it is where the boundary actually is.
OpenTabs charges for nothing, so there are none.
If this ever describes something more than it does today, the change lands in the public repository first, and the extension asks before doing anything new that needs a permission it does not already hold.