Privacy Policy

Last updated: October 25, 2026

Updated marks what changed since you last read this page.

This policy covers both the "Homepage" web app (doncus.github.io/homepage) and its companion browser extension. They're built and used together, so this page describes both rather than splitting the picture in two.

The browser extension

The extension's job is narrow: get a page, a tab group, or a bookmark folder from your browser into a Homepage container with one click or drag, and relay a few page-triggered actions (opening a link in incognito, opening links in their own windows or on a screen you chose, opening a local file link from a task, submitting a search) back through the browser's own APIs. It does not run any analytics, does not phone home to any server on its own, and does not transmit anything anywhere by itself — it only ever hands data to the Homepage page itself (via the browser's extension storage), which then decides what to do with it exactly the same way it would if you'd typed that data in by hand.

To do that, it asks for the following browser permissions:

• Tabs and broad site access — to read the title and URL of whichever tab you choose to add, no matter what site it's on, and to open new tabs/windows (including incognito) when you ask it to — for a link you set to open in its own window, on a screen you chose or incognito, only when you click it. Which window it opened on which screen is remembered only until you close the browser, so later links can join that window.
• Local file links — when you click a file:// link in one of your tasks, the extension opens that file in a new tab, but only if you've turned on "Allow access to file URLs" for it yourself. It only opens the file the same way your browser would; it never reads or uploads its contents.
• Bookmarks — to read a bookmark folder you pick for "Import Bookmarks," and to create bookmark folders when you use "Export to Bookmarks." Your bookmarks are never read or modified for any other reason.
• Tab groups — to read the tabs inside a tab group you choose to import.
• Storage, context menus, search, windows — to hand a capture over to the Homepage page, add its own right-click menu items, submit a search using your browser's own default search engine, and open/focus windows as needed.

The extension's own content script only runs on the hosted Homepage page itself, on local file:// copies of it, and on localhost/127.0.0.1 during development — not on other websites you visit.

The Homepage web app

Data that stays on your device

By default, everything you create — link containers, notes, tasks, icon choices, layout, and settings — is stored in your browser's own localStorage and never leaves your device. Uninstalling the extension or clearing your browser data removes it the same way it would for any other website.

If you turn on Settings → Debug, a diagnostic log is kept in this browser too — it can include names of your tasks and profiles, and, while task sharing is being tested, each sharing step with the profiles involved and the server's answers. It is never uploaded, synced or included in a backup; it only leaves your device if you copy it yourself, e.g. to send with a bug report.

Apart from that, this browser keeps a short record of when the Tasks Overview was opened or closed and which part of the app did it - the last 30 changes, with times, but no names or contents of your tasks. It helps find why the Overview sometimes starts closed. Like the diagnostic log, it is never uploaded, synced or included in a backup.

Each profile keeps its own design and emblem. So switching profiles shows the right one, this browser remembers each profile's design and emblem settings - including an emblem image you uploaded - for as long as you use it here. This stays on your device; only the settings themselves (not the image) also go into that profile's backups, see below.

If you choose a screen for a link to open on, your browser first asks whether this page may see your screens ("Window management"). Their names and positions are only used to place the window, and the screen you chose is kept in this browser only — never synced, backed up or sent anywhere.

Data tied to an account

Signing in uses GitHub OAuth. We receive your GitHub numeric user ID and username (via the read:user scope) to identify you — never your GitHub password, and never broader account access than that. The OAuth access token GitHub gives us is used once, server-side, to look up that ID and username, and is then discarded; what your browser holds afterward is an opaque session token of ours (valid for 30 days) with no meaning outside this app.

Once signed in, depending on which features you actually use, we may store:

• If you don't have access yet and click "Send Access Request": your GitHub login/ID, when you asked and the optional line you wrote for the admin, kept only so an admin can review it. Removed automatically the moment access is granted, and only ever sent once per account either way; after a "no" (or if your access is removed), a new request is possible 30 days later. On Standard, "Ask for Full Access" stores the same kind of request, until the admin answers it. When your access and Full Access were granted, and when a Full Access request was declined, are kept for the admin's overview and deleted with your account. The admins get a push notification with your GitHub login when you send it. While you wait, the page asks our server now and then whether you've been approved - also if you look around as a guest, before or after sending a request, for which your session token stays in this browser until then (signing out removes it). Nothing new is stored for that. When an admin approves your access, declines your request or removes your access later, we store that decision and when it was made, so the next time you open Homepage it can tell you once; after that, only that it was shown. One record per account, replaced by a newer decision, deleted with your account and included in your data export.
• Your profile record (display name, your GitHub login/ID, which org you belong to).
• Account activity: when you first and most recently opened the app while signed in, and on how many different days you did — nothing about what you did, which pages you looked at, or where from. Seen only by the admin, to know whether an account is actually in use when managing access. Included in "Export my data" and removed once your last profile is deleted.
• Chat messages you send — either in a shared room with your org's other members, or in a private, one-to-one conversation you or someone else started via a connection request. If you edit a message (possible for 2 minutes after sending), only the new text is kept, marked with when it was edited. A reply stores just which message it quotes, never a copy of it - so a quote always shows the original's current text, and disappears once that message is deleted. A reaction you give a message stores which emoji, your profile name and when; everyone who can read that message sees who reacted. Taking it back deletes it, and it's gone along with the message.
• A Support conversation: every account with access gets one with Homepage's support team (the admin and one helper), created the first time its chat opens and starting with a welcome message, so you can write in with questions, problems or ideas. Messages there are stored like any other conversation's and read by the support team, who see your profile name and GitHub login; you see them only as "Support", whoever of them writes. It's for chatting only - nothing can be shared through it - and it can't be removed.
• Feedback you leave on the documentation pages — what you wrote, what kind of change it asks for, which page and feature it's about, your GitHub login and when. Visible to everyone signed in who reads that page, so the same note isn't written twice; an admin can mark it done or declined with a short reply. You can delete your own while it's still open. When an admin deals with yours, the time is stored, and the time you next open the documentation - so the Help button can show you a dot until then. It's included in "Export my data", and all of it is removed when your account is deleted.
• A nickname you give one of your connections, if you choose to set one — visible only to you. The other person never sees it, has no way of knowing you set one, and could give that same connection a completely different nickname of their own without either of you seeing the other's.
• Your Tasks board — tasks, saved templates, and tag names/colors — synced live and automatically across every device you're signed into, so the board stays current wherever you open it. This is separate from the backups below: it happens continuously as you use the board, not just when a backup runs. Of your completed tasks, only the newest 500 per profile are kept on the server; older completed tasks are removed automatically (from your devices too). Open tasks are never removed this way.
• Your pages, containers, notes and links — each page's name, each container's title and notes text, each link's title, address, icon and color, and how a container is sized or folded — and each link's click count with when it was last clicked. Synced live and automatically across every device you're signed into with the same profile, so your links are the same wherever you open Homepage. Like the Tasks board, this is separate from the backups below and stored privately for that profile; nobody else can read it. It is deleted from the server when you delete the profile or your account, and included when you export a profile.
• A task you explicitly choose to share with one of your connections, someone in your organization or another of your own profiles becomes visible to, and editable by, that person (or profile) too — one shared task, not a private copy each of you keeps in sync, so an edit either of you makes is immediately the same change for both. Requires Full Access and an already-accepted connection, a shared organization, or both profiles belonging to your own account; a screenshot pasted into a shared task is readable by everyone currently sharing it, not just whoever pasted it. Your own category, tags, star, effort and relations to your other tasks on a shared task — and where it sits on your board — stay yours: kept separately and never shown to the others. Completing a shared task takes you off it and leaves you your own completed copy; the others are shown your profile name and when you completed it - the same when you remove yourself from one.
• Custom icons you upload — stored in cloud storage and reachable by a direct URL, the same way any image hosting works.
• Images you paste into a task or template's description, or a Notes container — stored in cloud storage like icons, but private: unlike an icon, these are never given a public URL and can only be retrieved by you, signed in.
• Backups you create or that run automatically (every day by default while the app is open — how often is set per device; an automatic backup's file name carries a random tag your browser makes for itself) — a snapshot of your links, notes and pages (with their click counts and icon colors), your tasks, templates and tags with the images pasted into them, your tips and RS-mode progress, and your profile's design and emblem settings (not an uploaded emblem image, and none of your other settings). Stored privately; unlike icons, a backup is never given a public URL. Each backup made from your own data also notes the browser it was made in (such as Chrome or Safari) and whether that was a phone, tablet or computer, so Backup History can show where it came from — nothing more about the device, and not its version or model. A backup is kept for one month and then deleted automatically — except your newest one, which always stays.
• If you turn on task notifications (Settings → Tasks, phone or desktop): the push subscription your browser generates for that one device (an endpoint URL and public key, both meaningless without our private key to sign a message to them), your device's timezone, and the time you asked to be notified at. Also, each time you open Tasks or Tasks Overview and actually click, tap or type there, a timestamp marking that your tasks were looked at — used only to skip sending a notification about tasks you've already seen. A page reloading or a screen waking up on its own never sets it. Turning the setting back off removes that device's subscription immediately.
• If you use recurring task templates: the time zone of your device (just its name, e.g. "Europe/Vienna" — never a location), saved whenever your tasks sync, together with the date recurring tasks were last created for you. This is what lets a recurring task be created on time on the server even while the app is closed, so it's already there the next time you open it — it applies whether or not you've turned on notifications.
• If you use the GitHub notifications window (admins and org members only): which of its notifications you've opened and which you gave a thumbs up from there (their GitHub IDs). If you save your own GitHub token to give those thumbs up in your name, it's stored encrypted and used for nothing else; you can remove it there any time. Pictures in those notifications are copied to our storage so they can be shown, and deleted as soon as the notification drops out of the window.
• If you're an admin: a short audit log entry (your GitHub ID/login, what you looked at, and when) whenever you view another org's data.

Where this is hosted

The app itself is hosted on GitHub Pages. Sign-in, chat, icons, and backups run on Cloudflare (Workers, KV, R2, and D1) under our own account. We don't use any third-party analytics or advertising service, and we don't sell or share your data with anyone outside these two providers.

Exporting your data

Settings → Account has an "Export my data" button for your active profile, and an Export button next to each of your other profiles, so you never have to switch to a profile first. Each downloads everything tied to that profile — your profile record, icon filenames, backup contents (with the browser and kind of device each was made on), your synced tasks/templates/tags, the keys of any pasted-image attachments (from a task, a template, or a Notes container), the chat and connection messages you've sent and the reactions you've given, your connections list, the shared tasks you're on (with your own position, category, tags, star, effort and relations), the devices you get task notifications on, your account activity record, any access request you sent and the GitHub notifications you opened or gave a thumbs up (a saved GitHub token is only listed as "saved", never included) — as a single JSON file, instantly, with no need to contact anyone.

Your data stays yours even if your access changes. If your access level is reduced, nothing is deleted — some features are locked and adding more is limited, but everything you already have stays stored and comes back if access is restored. If your access is removed entirely, the screen you see after signing in still lets you export each of your profiles or delete all of your data, without needing to contact anyone.

Deleting your data

Clearing your browser's local storage removes everything that lives only on your device. Settings → Account also has a "Delete profile" button (for your active profile, plus a Delete button next to each of your other profiles) that immediately removes that profile's record, icons, backups, and synced tasks/templates/tags, and — if your GitHub account owns more than one profile — a separate "Delete account" button that does the same for every profile you own in one step (pasted-image attachments — from a task, template, or Notes container — are cleared once no profile is left on the account, rather than one at a time, so deleting one profile never risks another still-active profile's own pasted images). Deleting the profile you're in also clears its data from the browser you delete it in - its links, pages, tasks, settings and the rest - and deleting your account does the same for its profile there; only this browser's own bookkeeping (like the language you picked) stays. Another device still holds its own copy until you clear that browser's storage. Your past chat and connection messages are kept rather than deleted — so the people you talked to keep their own copy of those conversations — but your name is replaced everywhere with an anonymized placeholder. That includes your Support conversation: the support team sees it as from a "Deleted user", and if you sign up again later, you get a new one. The reactions you gave are deleted. Deleting your account also removes everything kept for the GitHub notifications window - what you opened there, your thumbs up, a saved GitHub token and any picture copies. If you'd rather we handle any of this for you directly, contact us using the email below.

Children's privacy

Homepage isn't directed at children, and we don't knowingly collect data from anyone under 13.

Changes to this policy

If this policy changes in a meaningful way, the "Last updated" date above will change along with it.

Contact

Questions about this policy or your data: dominic.handl@hotmail.com. For general questions, bug reports, or feature requests, see Support instead.