Privacy Policy

Account Data

When you sign in with Google, we receive your email address, display name, and profile photo from Google OAuth via Firebase Authentication.

Spaces & Tabs Data

When cloud sync is enabled (Pro plan), your saved spaces, saved tab URLs and titles, folder structure, pinned tabs, and settings are synced to our server. Only explicitly saved tabs are synced — current (unsaved) browser tabs never leave your device.

Feedback Data

If you submit feedback through the Contact Us form, we store your email, feedback category, and message.

Analytics Data

We collect anonymous, aggregated usage events (e.g., "space created", "tab pinned") via Google Analytics 4 and PostHog. We never collect tab URLs, page titles, browsing history, or any personally identifiable information through analytics.

• Current (unsaved) browser tabs — these stay in local storage on your device
• Chrome tab IDs (chromeTabId) — local runtime data only
• Browsing history, passwords, cookies, or form data
• Data from other extensions
• Keystrokes or screen content

• Cloud Sync: To synchronize your saved spaces, tabs, and settings across devices
• Authentication: To verify your identity and manage your account
• Analytics: To understand aggregate usage patterns and improve the product (no PII)
• Feedback: To respond to your support requests and bug reports

• Locally: chrome.storage.local on your device
• Server: Neon PostgreSQL (encrypted at rest)
• Authentication: Firebase (Google Cloud infrastructure)

• Firebase (Google): Authentication
• Neon: Database hosting (data processor)
• Railway: Server hosting (data processor)
• Google Analytics: Anonymous usage analytics
• PostHog: Product analytics
• LemonSqueezy: Payment processing (for Pro subscriptions)

We do not sell, rent, or share your personal data with advertisers or data brokers.

• Access: View your data through the extension
• Export: Export all your data as JSON (Settings → Export Data)
• Deletion: Delete your account and all associated data (Settings → Delete Account). All data is removed from our database immediately.
• Portability: Export your data in a machine-readable format (JSON)

Your data is stored as long as your account is active. When you delete your account, all data is permanently removed from our database. Automated backups are rotated and deleted data is not recoverable.

• All server communication uses HTTPS
• Authentication via Firebase JWT tokens
• Database encrypted at rest
• Minimal Chrome permissions — only those required for functionality

Leap is not intended for children under 13 years of age. We do not knowingly collect data from children under 13.

If you are in the European Economic Area, you have additional rights under GDPR including the right to access, rectification, erasure, data portability, and the right to object to processing. To exercise these rights, contact us at the email below.

Legal basis for processing: Contract performance (sync, account management), Consent (analytics), Legitimate interest (product improvement via aggregated analytics).

If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

We may update this Privacy Policy from time to time. We will notify you of material changes through the extension or by email at least 14 days before they take effect.

For questions about this Privacy Policy or to exercise your data rights, contact us at: