Privacy and your data
SessionPaw has no server that collects your tabs or browsing. Your sessions, settings and maps stay in your browser. A few features talk to outside services, and they are listed below.
Where your data is kept
| What | Where | Leaves this computer? |
|---|---|---|
| Local sessions, including Auto Saved | Extension storage in this browser profile | No |
| Settings, junk-param rules, appearance choices, custom backgrounds | Extension storage | No |
| Window names, colors and list order, Quick List choices, daily allowance count | Extension page storage | No |
| Concept Mode maps and notes | Extension page storage | No |
| Drop Area files and text | Extension database (up to 50 MB per item) | No |
| Tab history (Popup → History) and Play History | Temporary storage, cleared when the browser closes | No |
| Tab nesting you set by hand | Extension storage, cleared when the browser starts | No |
| Cloud sessions, Read Later, Dustbin | Your browser bookmarks | Yes, if your browser syncs bookmarks |
| Sign-in state, plan, profile (nickname, sign, avatar link, Gravatar email) | Synced extension storage | Yes, through your browser's sync, if it is on |
| Other devices and recently closed | Read from the browser, not stored by SessionPaw | Managed by your browser |
"Extension storage" and "extension page storage" both live inside your browser profile. They are removed when you uninstall SessionPaw.
What leaves your computer
SessionPaw only contacts outside services in these cases:
| When | Service | What is sent |
|---|---|---|
| A tab's own icon cannot be shown and the browser's icon cache has none | Google favicon service | The site's domain name, to fetch its icon. Public domains only: intranet and private addresses, IP addresses and localhost are never sent |
| You click Load from Google in the Popup's Favicon tool | Google favicon service | The site's domain. Nothing is sent until you click; intranet and private addresses have no such button |
| You use Search in site | Google search | Your search words and the site's domain |
| You set a Gravatar email | Gravatar | A hash of that email, to fetch your picture |
| You set an avatar link | The site hosting the picture | A normal image request |
| You sign in or subscribe | ExtensionPay | Your email and payment details, entered on their page |
| You use an AI feature with your own API key (names, tags, summaries, AI organize, Split by topic, Organize this window, Digest into a note, the merged session name) | The AI service you chose | Tab titles and addresses without anything after ? or #. AI organize, Split by topic, the merge name, Organize this window and Digest into a note leave out intranet and sign-in pages. Built-in browser AI sends nothing |
| You first install | SessionPaw's own quick tour page opens | Nothing |
| You uninstall | The browser opens a feedback form | A normal page visit |
SessionPaw does not include analytics or tracking code.
Why SessionPaw asks for these permissions
| Permission | Why |
|---|---|
| Tabs and windows | To list, move, group, hibernate and close them. |
| Bookmarks | Bookmarks Manager, Cloud sessions, Read Later, Dustbin, bookmark badge. |
| Sessions | Recently closed and other devices. |
| Storage, unlimited storage | To keep sessions and Drop Area files without running out of room. |
| Tab groups | To show and create tab groups. |
| Side panel | The browser side panel view. |
| Context menus | The right-click menu on pages and on the toolbar icon. |
| Display information | To place Side View and your windows on the right screen. |
| Favicon | To show site icons from the browser's own cache. |
| extensionpay.com | Payments and sign-in. This is the only site SessionPaw asks for at install. SessionPaw does not read or change page content |
| Other sites, only when you click | The AI service you set up, or Google's icon service when you download a site icon. The browser asks you first |
Back up your data
- Local sessions: Session Manager → Export. You get one JSON file per list. Import loads them back.
- Cloud sessions, Read Later, Dustbin: they are bookmarks. Use your browser's bookmark export, or turn on bookmark sync.
- Concept Mode maps, window names, settings and backgrounds have no export yet.
Remove your data
- Delete single sessions in Session Manager. Clear Auto Saved with its broom icon.
- Delete the SessionPaw bookmark folders in your browser's bookmark manager.
- Uninstall SessionPaw to remove everything stored in the extension. Bookmark folders are not removed by uninstalling.
- To remove your sign-in, sign out on the account page.
Incognito
- SessionPaw only sees incognito windows if you allow the extension in incognito in your browser's extension settings.
- Incognito windows are not saved. To change this, turn off Settings → Behavior → Exclude from saving → Incognito windows.
Leave tabs out of saved sessions
Settings → Behavior → Exclude from saving decides which tabs are never saved.
- SessionPaw's own pages, other extensions' pages and the browser's own pages such as settings or the new tab page (all on by default).
- Local files, popup windows and incognito windows (only incognito is on by default).
- Domains:
example.comalso coverswww.example.comand other subdomains. - Keywords: a tab is left out when its address or title contains the word.
- Auto Saved always uses these rules. Saving by hand keeps every tab unless you turn on Use these rules for manual saves too.
- When tabs were left out, the session says so, for example 3 excluded. Click it to see the rules.