Privacy Policy

Last updated: September 15, 2026

This policy covers both the "Homepage" web app (doncus.github.io/homepage) and its companion browser extension. They're built and used together, so this page describes both rather than splitting the picture in two.

The browser extension

The extension's job is narrow: get a page, a tab group, or a bookmark folder from your browser into a Homepage container with one click or drag, and relay a couple of page-triggered actions (opening a link in incognito, submitting a search) back through the browser's own APIs. It does not run any analytics, does not phone home to any server on its own, and does not transmit anything anywhere by itself — it only ever hands data to the Homepage page itself (via the browser's extension storage), which then decides what to do with it exactly the same way it would if you'd typed that data in by hand.

To do that, it asks for the following browser permissions:

• Tabs, active tab, and broad site access — to read the title and URL of whichever tab you choose to add, no matter what site it's on, and to open new tabs/windows (including incognito) when you ask it to.
• Bookmarks — to read a bookmark folder you pick for "Import Bookmarks," and to create bookmark folders when you use "Export to Bookmarks." Your bookmarks are never read or modified for any other reason.
• Tab groups — to read the tabs inside a tab group you choose to import.
• Storage, context menus, search, windows — to hand a capture over to the Homepage page, add its own right-click menu items, submit a search using your browser's own default search engine, and open/focus windows as needed.

The extension's own content script only runs on the hosted Homepage page itself, on local file:// copies of it, and on localhost/127.0.0.1 during development — not on other websites you visit.

The Homepage web app

Data that stays on your device

By default, everything you create — link containers, notes, tasks, icon choices, layout, and settings — is stored in your browser's own localStorage and never leaves your device. Uninstalling the extension or clearing your browser data removes it the same way it would for any other website.

Data tied to an account

Signing in uses GitHub OAuth. We receive your GitHub numeric user ID and username (via the read:user scope) to identify you — never your GitHub password, and never broader account access than that. The OAuth access token GitHub gives us is used once, server-side, to look up that ID and username, and is then discarded; what your browser holds afterward is an opaque session token of ours (valid for 30 days) with no meaning outside this app.

Once signed in, depending on which features you actually use, we may store:

• If you don't have access yet and click "Send Access Request": your GitHub login/ID and when you asked, kept only so an admin can review it. Removed automatically the moment access is granted, and only ever sent once per account either way.
• Your profile record (display name, your GitHub login/ID, which org you belong to).
• Chat messages you send — either in a shared room with your org's other members, or in a private, one-to-one conversation you or someone else started via a connection request.
• Your Tasks board — tasks, saved templates, and tag names/colors — synced live and automatically across every device you're signed into, so the board stays current wherever you open it. This is separate from the backups below: it happens continuously as you use the board, not just when a backup runs.
• Custom icons you upload — stored in cloud storage and reachable by a direct URL, the same way any image hosting works.
• Images you paste into a task or template's description — stored in cloud storage like icons, but private: unlike an icon, these are never given a public URL and can only be retrieved by you, signed in.
• Backups you create or that run automatically — a snapshot of your local data (links, tasks, settings), stored privately; unlike icons, a backup is never given a public URL.
• If you're an admin: a short audit log entry (your GitHub ID/login, what you looked at, and when) whenever you view another org's data.

Where this is hosted

The app itself is hosted on GitHub Pages. Sign-in, chat, icons, and backups run on Cloudflare (Workers, KV, R2, and D1) under our own account. We don't use any third-party analytics or advertising service, and we don't sell or share your data with anyone outside these two providers.

Exporting your data

Settings → Profile has an "Export my data" button that downloads everything tied to your active profile — your profile record, icon filenames, backup contents, your synced tasks/templates/tags, the keys of any task/template attachments, the chat and connection messages you've sent, and your connections list — as a single JSON file, instantly, with no need to contact anyone.

Deleting your data

Clearing your browser's local storage removes everything that lives only on your device. Settings → Profile also has a "Delete profile" button that immediately removes that one profile's record, icons, backups, and synced tasks/templates/tags, and — if your GitHub account owns more than one profile — a separate "Delete account" button that does the same for every profile you own in one step (task/template attachments are cleared once no profile is left on the account, rather than one at a time, so deleting one profile never risks another still-active profile's own pasted images). Your past chat and connection messages are kept rather than deleted — so the people you talked to keep their own copy of those conversations — but your name is replaced everywhere with an anonymized placeholder. If you'd rather we handle any of this for you directly, contact us using the email below.

Children's privacy

Homepage isn't directed at children, and we don't knowingly collect data from anyone under 13.

Changes to this policy

If this policy changes in a meaningful way, the "Last updated" date above will change along with it.

Contact

Questions about this policy or your data: dominic.handl@hotmail.com. For general questions, bug reports, or feature requests, see Support instead.