Privacy Policy

The short version

Thicket organizes your browser tabs. Signed out, everything happens on your device and we receive nothing. Signed in, we store the minimum needed to sync and search: page titles, addresses, and your saved workspaces. The extension never reads page contents. We don't sell data, run ads, or use your data to train AI models.

Who we are

Thicket is operated by Nolan Woo in California, United States. For anything in this policy, contact nolan.h.woo@gmail.com.

What the extension processes on your device

To group tabs, the extension reads the title, web address, and activity times of your open tabs, and keeps a local memory of pages you've had open. This processing is local. It never includes:

• Incognito or private windows — never observed at all
• Sign-in, password, and payment pages — detected and skipped
• Sites on the built-in sensitive list (banks, healthcare portals, government services)
• Sites you exclude yourself in Settings
• Secret-looking parts of web addresses (tokens, session IDs) — stripped before storing

What we receive when you sign in

With an account, and only while sync is enabled, our servers store:

• Your email address and name when you create an account or use an available sign-in provider
• Saved workspaces: their titles and the titles/addresses of pages in them
• Page memory: titles and addresses of pages you've had open, kept for 7 days on the free plan and 90 days on Pro, then deleted automatically
• Your settings, excluded-domain list, and connected devices
• Product events (for example "workspace saved") with counts — never page titles, addresses, or content

AI processing

When AI features are on, page titles and addresses are sent to our AI providers Anthropic and Voyage AI to group, name, summarize, and search your tabs. Under our agreements, these providers do not use the data to train their models.

Page content—the text, images, and form fields inside a page—is never available to the extension. Sensitive and excluded sites are never sent to AI.

What we never do

• Sell or rent your data, to anyone, for anything
• Show ads or share data with ad networks
• Use your data to train AI models
• Read your browser's full history file — only tabs that are open while Thicket runs
• Collect data while Thicket is paused

Service providers

We use a small set of processors to run Thicket:

• Vercel — application hosting
• Neon — database hosting
• Stripe — payments (we never see your card number)
• Anthropic and Voyage AI — AI processing as described above

Retention and deletion

Page memory expires automatically (7 or 90 days by plan). Workspaces stay until you delete them. Deleting your account — Settings → Your data → Delete — removes your account, workspaces, page memory, devices, settings, and events immediately, and cancels any subscription. Backups age out within 30 days. You can export everything as JSON first.

Your rights

Depending on where you live (GDPR, UK GDPR, CCPA and similar), you have rights to access, correct, delete, and port your data, and to object to processing. The export and delete buttons in Settings cover most of this instantly; for anything else, email nolan.h.woo@gmail.com and we'll respond within 30 days.

Security

Data in transit is encrypted with TLS; data at rest is encrypted by our hosting providers. Extension access tokens are stored hashed, can be revoked per device, and never appear in URLs. Payment details go directly to Stripe.

Children

Thicket isn't directed at children under 13, and we don't knowingly collect their data.

Changes

If this policy changes materially, we'll note it here and — for signed-in users — tell you by email before it takes effect.