Privacy Policy

Account Data

Leap works without signing in: on first launch it creates an anonymous account (a random identifier, no email) through Firebase Authentication. If you sign in with Google, we receive your email address, display name, and profile photo from Google OAuth; if you sign in with email, we receive your email address.

Spaces & Tabs Data

Cloud sync is always on — for anonymous and signed-in accounts alike — and cannot currently be turned off. It sends your saved spaces, saved tab URLs and titles, folder structure, pinned tabs, and settings to our server. Only explicitly saved tabs are synced — current (unsaved) browser tabs, page content, and your browsing history never leave your device.

Feedback Data

If you submit feedback through the Contact Us form, we store your email, feedback category, and message.

Analytics Data

We collect anonymous, aggregated usage events (e.g., "space created", "tab pinned") via Google Analytics 4 and PostHog. We never collect tab URLs, page titles, browsing history, or any personally identifiable information through analytics.

• Current (unsaved) browser tabs — these stay in local storage on your device
• Chrome tab IDs (chromeTabId) — local runtime data only
• Browsing history, passwords, cookies, or form data
• Data from other extensions
• Keystrokes or screen content

• Cloud Sync: To synchronize your saved spaces, tabs, and settings across devices
• Authentication: To verify your identity and manage your account
• Analytics: To understand aggregate usage patterns and improve the product (no PII)
• Feedback: To respond to your support requests and bug reports

• Locally: chrome.storage.local on your device
• Server: Neon PostgreSQL (encrypted at rest)
• Authentication: Firebase (Google Cloud infrastructure)

• Firebase (Google): Authentication
• Neon: Database hosting (data processor)
• Railway: Server hosting (data processor)
• Google Analytics: Anonymous usage analytics
• PostHog: Product analytics
• LemonSqueezy: Payment processing (for Pro subscriptions)

We do not sell, rent, or share your personal data with advertisers or data brokers.

• Access: View your data through the extension
• Export: Export all your data as JSON (Settings → Export Data)
• Deletion: Delete your account and all associated data (Settings → Delete Account). Your sign-in account is deleted immediately; your account record and synced data are permanently deleted within 30 days (see Data Retention).
• Portability: Export your data in a machine-readable format (JSON)

Your data is stored as long as your account is active. When you delete your account, your sign-in account is removed immediately; your account record and synced data (spaces, tabs, folders, pins, settings) are kept for a 30-day grace period, then permanently deleted. We also keep a short record of the deleted account — email, name, sign-up and last-seen dates, the number of spaces and tabs, and the reason you gave for leaving, if any — to understand why people leave. Automated backups are rotated and deleted data is not recoverable.

• All server communication uses HTTPS
• Authentication via Firebase JWT tokens
• Database encrypted at rest
• Minimal Chrome permissions — only those required for functionality

Leap is not intended for children under 13 years of age. We do not knowingly collect data from children under 13.

If you are in the European Economic Area, you have additional rights under GDPR including the right to access, rectification, erasure, data portability, and the right to object to processing. To exercise these rights, contact us at the email below.

Legal basis for processing: Contract performance (sync, account management), Consent (analytics), Legitimate interest (product improvement via aggregated analytics).

If you are a California resident, you have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information.

We may update this Privacy Policy from time to time. We will notify you of material changes through the extension or by email at least 14 days before they take effect.

For questions about this Privacy Policy or to exercise your data rights, contact us at: