This document is provided in several languages for convenience. If there is any discrepancy between versions, the English version prevails.
Mos Tab (“we”, “us”) is a browser extension that turns your new tab into an organized dashboard. This policy explains what data we handle and how. Mos Tab is local-first: the app works entirely on your device, and most of your data never leaves it. You only share data with us when you choose to create an account and enable cloud sync.
1. Data we handle
On-device data (default). Your spaces, collections, sections, saved tabs, notes and settings are stored locally in your browser. We do not receive this data unless you enable cloud sync.
Account identifier. To sign in you provide an email address and confirm a one-time code. We store your email only as a one-way hash (SHA-256) used as your account ID — we do not store your email address in readable form on our servers.
Synced data (Pro). If you enable cloud sync, your dashboard content — space/collection/section titles, saved tab URLs and titles, sticky notes, and profile display name/emoji — is stored on our servers so it can sync across your devices.
Payment data. Payments are processed by our reseller Paddle (see below). We never receive or store your card or payment details.
Technical data. Like any web service, our servers process standard request metadata (e.g. IP address, timestamps) transiently for security, abuse-prevention and operation.
We do not use advertising, cross-site tracking, or third-party analytics, and we do not sell your data.
2. How we use data
To provide the service: authentication, cloud sync, public space sharing, and billing.
To keep the service secure and prevent abuse.
To communicate with you about your account (e.g. sign-in codes, essential service notices).
3. Service providers
We use a small number of processors to run the service:
Cloudflare — hosting, storage and delivery of synced data.
Paddle — our Merchant of Record for payments and subscriptions. Paddle handles your payment information and billing communications under Paddle’s privacy policy.
Email delivery — a transactional email provider sends your sign-in and account emails.
Favicon icons — on public share pages, site icons may be requested from a third-party icon service using only the website’s host name.
4. Data retention
On-device data remains on your device until you delete it.
Synced data is kept while your account is active. If you cancel Pro, your synced data may be retained for up to 90 days and then removed.
Account deletion. You can permanently delete your cloud data at any time from the app (Settings → Account). We then keep only a minimal deletion record — a hashed account ID and a timestamp — to help prevent fraud and resolve disputes. Data stored locally on your devices is not affected.
5. Security
Data in transit is protected with TLS, and data at rest is stored with our infrastructure provider’s encryption. Your email is stored only as a hash, and sign-in uses one-time codes rather than passwords.
6. Your rights
Depending on where you live (e.g. under GDPR or CCPA/CPRA), you may have rights to access, correct, export or delete your data. You can export or delete your data directly in the app, or contact us for help. For payment-related data, Paddle acts as controller — see Paddle’s privacy policy.
7. Children
Mos Tab is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data.
8. International transfers
Because our service providers (such as Cloudflare and Paddle) operate globally, your personal data may be stored and processed on servers located outside your country of residence, including outside the Republic of Korea. Where required, those providers apply appropriate safeguards for such transfers.
9. Changes
We may update this policy from time to time. Material changes will be reflected by updating the “Last updated” date above.
10. Contact
Questions about privacy? Email [email protected]. Our Privacy Officer, responsible for personal-data protection, is Euiyoung Jung, reachable at the same address.