TABCREW
Release candidate 0.9.8 / updated 11 September 2026 / TabCrew for Chrome
This policy describes the TabCrew private beta and its capability gateway. TabCrew proposes groups for open Chrome tabs. It does not move a tab until the user approves the plan.
Grouping after your agreement
After you select Agree and organize, TabCrew reads eligible HTTP(S) tabs across all open windows. It sends the browser locale, tab titles, URL scheme, host and path, and current group names and collapsed state to its gateway and the disclosed AI services. Sequential tab references and a snapshot hash identify the request; the provider receives the references and tab fields, not Chrome tab IDs.
Query strings, fragments and URL credentials are removed. Titles are limited to 180 characters, URLs to 240 and existing group names to 40. Non-HTTP(S) tabs, extension pages and incognito tabs are excluded. Collapsed groups can be excluded with the scope control. Titles and paths may still contain personal or sensitive information; removing a query string does not anonymize a URL.
My stats records only the time, action type, tab count and group count for plans created, edits saved and plans applied. Saving statistics is off until you choose it. With your separate opt-in, these counts are sent to the TabCrew gateway with a random event identifier and associated with your installation identifier. The gateway timestamps and stores them to show your organization activity. They are not sent to AI providers. Statistics do not include browsing content. Optional session contributions are described below; there is no background navigation tracking.
The extension does not inspect page contents, DOM data, HTML metadata, forms or cookies. It does not send local files, data URLs or browser pages. It changes Chrome groups only after you review a plan and confirm Apply.
A separate, optional choice
From the organizer, you may choose Share a reviewed example. No tabs are selected by default. Select 2 to 100 titles, edit titles and grouping labels, remove private information, review the exact text, then explicitly agree to storage, developer review and use solely to improve TabCrew’s grouping feature, including future training of a smaller grouping model. Organizing tabs never depends on contributing.
Without automatic contributions enabled, the optional “What are you working on?” field stays in the organizer page until it closes unless you share it in an example. It does not change grouping or go to the AI model. To save it with an example, review it in the sharing dialog; you can edit or clear it before agreeing. Leaving it blank never prevents organizing.
The contribution contains the reviewed titles and labels, optional workspace context you choose to include, an example identifier, the contribution-consent version and your explicit review agreement. The gateway links it to your installation and records the acceptance time, expiry and entry count. It does not add URLs, paths, tab/window IDs, current-group state, prompts or raw model answers. A reviewed label may originate in the AI proposal. Free-text fields can still contain personal information; remove it before sharing. This is not automatic browsing-history collection.
TabCrew stores example content encrypted with AES-256-GCM using a separate server key. The TabCrew developer may read an example under your specific agreement. Examples are not sent back to OpenRouter or CoreWeave, sold, used for ads, or used to train unrelated or general-purpose models. No training job or bulk export is enabled in this release.
Each example expires after 90 days. The gateway excludes expired examples immediately on access and physically deletes rows on access, startup and hourly cleanup; cleanup may follow expiry by up to an hour while running. Sharing is limited to 10 examples per day and 50 retained examples per installation. View receipts and delete individual or all examples in My stats & privacy using this installation’s signed credentials. Deletion removes active examples and prevents their future use; it does not claim to untrain a model. Any future training pipeline requires a separate operational and privacy review.
Uninstalling or withdrawing AI-processing consent does not delete contributions already shared. Delete them first while the gateway is reachable, wait for expiry or contact support. The 90-day limit describes active application records. Database journals and infrastructure backups can retain encrypted bytes; TabCrew does not promise immediate deletion from every backup. Example keys must be held separately, and restored storage must run expiry cleanup before serving requests.
One initial choice, automatic session contributions
When the gateway supports this feature, you can enable Help improve TabCrew at the initial AI disclosure or in My stats & privacy. It starts unchecked. After you accept, later grouping sessions contribute automatically until you pause; you do not need to share each one. Organizing remains available without contributing.
Each successful grouping proposal saves the eligible tab titles, minimized URL scheme/host/path, current groups, locale, sequential references, snapshot hash, optional workspace context and the validated named AI proposal. Successful Apply adds the final names, colors and assignments, closed-tab exclusions, Apply time and any updated context. The record includes extension and provider/model metadata and is linked to the installation's versioned agreement. Workspace context is not sent to the inference provider. Failed inference does not create a record; a proposal may remain without a final Apply.
These records support automated evaluation, curation and future training of TabCrew's tab-organization classifier on our infrastructure. This agreement does not authorize general human access. Specific reviewed examples use the separate agreement above. Automatic records are not sent back to the current inference provider, sold, used for ads, published as a customer dataset or used for unrelated models. No training job runs in this release. A private operator export supports automated preparation; dataset builds must check the current source for deletion and expiry.
Content is encrypted with AES-256-GCM, using a key kept outside the database. At most 500 sessions per installation remain active for 90 days from the proposal; Apply does not extend expiry. Expired rows are excluded and purged on access, startup and hourly cleanup. Minimal agreement receipts remain. This retention is separate from any inference-provider ZDR routing.
Apply does not wait for the final upload. A local queue holds at most 20 pending final arrangements, with retries on subsequent use for up to 24 hours; expired entries are removed on the next use. An unused browser can retain those local bytes until it runs again. My stats & privacy shows receipts and sync status, allows pause, and deletes individual or all records. Pause disables new local contributions and clears pending uploads immediately; remote revocation requires a connection. An already received request may complete before that revocation arrives. Deletion prevents late Apply uploads from recreating records. Deleting records does not pause future contributions.
Withdrawing AI consent also pauses contributions. Uninstall does not delete server records. Delete them first while the gateway is reachable, let them expire or contact support. The active-record limit does not promise immediate erasure from database journals, infrastructure backups or earlier private exports; those require expiry and deletion handling before reuse. Deletion does not promise to reverse any already trained model.
Device state and service records
Chrome extension storage holds the installation session, consent receipt, preferences and recent plans or reports. A recent plan can include tab titles, minimized URLs and group names. It remains until replaced, cleared by withdrawing consent, or the extension is removed. A non-extractable signing key is held separately in IndexedDB. These records are not Chrome Sync data.
Optional statistics are available for up to 90 days, capped at the latest 10,000 actions. The gateway excludes records at 90 days and deletes expired rows on access, startup and hourly cleanup while running; physical cleanup may follow expiry by up to an hour during normal operation. My stats offers 7, 30 and 90-day views, pause and delete controls. Pausing stops new records; deleting clears existing statistics but does not change the save setting.
The gateway processes tab fields and the provider answer in memory. Without automatic contributions, organization requests do not save tab titles, URLs, group names, raw prompts or model answers in the database. Opted-in session contributions store the minimized input and validated named proposal, followed by the final arrangement after successful Apply, as described below. Neither route writes browsing content to application logs. Separately reviewed contributions save their selected titles, labels and optional workspace context as described above. It also stores optional organization statistics and the save setting. It stores the installation public key and identifier, creation and last-seen times, consent version and acceptance time, activation codes, anti-replay records, current-day quota counters and short concurrency leases. Installation and consent records remain until removed following a support request. Expired security and quota records are cleaned during the related gateway operations.
Application logs contain route, status, duration, tab count, request identifier and a keyed installation pseudonym. Provider-failure diagnostics can include provider host, model and bounded error identifiers. Gateway application logs currently use host-managed size-based rotation at 50 MB, retaining up to five rotated files plus the active file. This is not a fixed time-based expiry. Hosting and security systems receive network addresses and may keep access and abuse-prevention logs under their own retention rules. The 90-day statistics limit is not a retention promise for those services.
Recipients and allowed uses
The extension shows the names, privacy-policy links and retention descriptions of every configured AI recipient before you agree. The gateway supplies this list from its reviewed deployment configuration. The current recipient register publishes the same names, policy links and retention terms. The 0.9.3 deployment profile selects OpenRouter and CoreWeave’s coreweave/fp4 endpoint running Google Gemma 4 31B. Google supplies the model weights and is not the inference host on this route. The live register is authoritative; do not assume this profile is active before the coordinated release. Changes to that route, its model or the disclosure require agreement again. If the recipient review is not configured, grouping is unavailable.
TabCrew does not train on ordinary organization requests or statistics. Only separately reviewed optional examples may be used for future training limited to TabCrew grouping. No data is sold or used for ads or unrelated studies. Deployment requires review of every recipient’s training, logging, retention and human-access practices. OpenRouter requests prohibit routing to providers that train on input and restrict routing to the disclosed provider list. The Gemma profile requires zero-data-retention routing and excludes undisclosed fallbacks; it is not a blanket promise that every service retains no data. Review the recipient-specific terms shown before consent. OpenRouter’s own optional logging and input-use settings must also be checked by the operator.
Cloudflare receives the browser and network information needed to check installation activation. Passing this check does not grant consent to AI processing. See Cloudflare’s privacy policy.
TabCrew’s use and transfer of information received through Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only to provide, secure, maintain and improve the disclosed tab-organization feature. It is not sold or used for advertising, credit decisions or unrelated products. Human access is limited to the exceptions allowed by that policy, such as the specific reviewed-example agreement, support consent, security investigations or legal obligations. See the Limited Use policy.
Agree, review, pause or delete
Select Agree and organize inside the extension to accept the displayed data practices. You can decline. The gateway records a versioned consent receipt after installation activation, before processing a plan. AI consent and the later Apply confirmation are separate actions.
View gateway organization counts for this installation and choose whether to save them. Delete gateway statistics at any time while the service is reachable. If a save or deletion fails, the extension shows an error; failed metric uploads are not queued or replayed later. Withdraw AI consent to stop future plan requests, pause statistics and automatic contributions, and clear cached plans and pending uploads. Withdrawing does not undo existing Chrome groups, erase your statistics, retract requests already sent or delete the installation session. A privacy change is blocked while an organization or Apply operation is running; finish that operation and retry.
Removing the extension stops future extension activity and removes its local storage. It does not delete gateway statistics, automatic contributions or reviewed examples: delete them in My stats first, let them expire, or contact support. For gateway installation-record questions or deletion requests, contact contact@th3nolo.com. Include the installation identifier if available. Do not email browsing history, API keys or authentication tokens. Provider-held records are subject to the recipient terms shown before consent.
The website stores your language choice locally. Its interactive example uses sample data and cannot read or modify Chrome tabs. If you email beta or support requests, your email address and message are used to respond. The developer-only native-host checkout has a separate operator-configured provider route; these release disclosures describe the packaged managed-gateway extension.