Privacy policy

Larksail is a browser extension for managing tabs: collections, notes, suspending idle tabs, merging windows, archiving, snapshots and focus mode. This policy explains what data Larksail handles and where it goes.

Larksail is made by Bulat Sabirov, Národní 25, 110 00 Prague, Czechia (“we”), who is responsible for your data under the GDPR (the “controller”). Contact: hello@larksail.com.

The short version: Larksail works fully without an account, and everything it stores stays on your device. No analytics, no ads, no tracking. Data leaves your device only for features you choose to use:

• Sync (optional, needs an account): end-to-end encrypted. Our server stores your library only as ciphertext it cannot read.
• Published pages (optional): a collection you deliberately make public as a web page.
• AI (optional, off by default): sent to the AI provider or server you pick.

What Larksail stores on your device

To do its job, Larksail keeps the following on your computer:

• Your collections and saved tabs: page titles, URLs, and any notes, tags, colors, covers, sticky notes and images you add.
• The archive: titles and URLs of tabs Larksail closed (automatically or at your request), so you can find and restore them.
• Snapshots: the layout of your open windows (tabs, order, pinned state, tab groups, window positions), so a session can be restored after a restart or crash.
• Collection history: earlier versions of your collections, so changes can be reviewed and undone.
• The action log: a record of recent actions (closing, moving, merging tabs) so they can be undone.
• Tab activity: when each open tab was last used, to decide which tabs are idle. This is temporary and cleared when the browser closes.
• Focus mode data (only if you turn on Focus mode): your blocked sites, schedules, and the daily time spent on sites you set a budget for.
• Saved copies (on by default, only with site access): a readable copy of the text of pages you save, so you can read and search them later; full-page snapshots of pages you ask for; and your highlights in them.
• Notes and reminders: your notes, sticky notes and the reminders you set.
• AI chats and summaries (only if you turn on AI): your questions to the Assistant and its answers (unless you turn off “Keep chat history”), and summaries of saved pages.
• Settings: your preferences, such as theme, timers and per-site rules.

All of this lives in your browser’s local storage (IndexedDB and chrome.storage). Unless you turn on sync, it is never sent to us or anyone else, and we cannot see it.

Settings and Chrome Sync

Larksail keeps its settings in chrome.storage.sync. If you are signed in to Chrome with sync turned on, Chrome itself syncs these settings between your devices through your Google account, as it does for every extension. This covers preferences only (including site names you added to rules or Focus mode), not your collections, archive or browsing data. Google’s privacy policy applies to Chrome Sync. Larksail has no access to it beyond reading and writing its own settings.

What Larksail does not do

• No account needed: every feature except sync and published pages works without one.
• No analytics, telemetry, crash reporting or tracking of any kind in the extension. On larksail.com: no cookies, analytics scripts or trackers either — we only count page visits, anonymously (see The website).
• No ads.
• No network requests except for features you turn on or click: sync, published pages, AI (see below), Send feedback (see Feedback below), and Library → Broken links → Check links, which asks each saved page’s own site whether it still exists (the address only, no cookies, only when you click). Webhooks (off unless you turn them on and add one): Larksail posts to the URLs you add — when tabs are saved into a collection you chose, or when you click Send to / Send test — the collection’s title, note, tags and space and its tabs’ titles, addresses, notes and tags; nothing else, and only to those URLs. Zapier (off unless you connect it): see Zapier below. Larksail does not load remote code, fonts or images. Page icons come from the browser’s own local icon cache.
• Larksail doesn’t read the pages you browse. It reads a page’s content only when you save that page (to keep its saved copy, if Saved copies is on and you granted site access) and, with site access, to check a page for unsent form input before suspending or closing it — that check stays on your device and stores nothing.
• No selling, sharing or transferring of your data.

Accounts and sync (optional)

Sync is off by default. If you create an account in Settings → Sync, our server (the “sync API”) stores:

• Your account: your email address, whether it’s confirmed, and your password as a salted one-way hash (never the password itself). Signing in creates a session that records the time, the network address it came from and your browser’s user-agent string, and expires after 30 days without use.
• Your devices: the name you give each device, its public key, and when it was added, approved and last seen.
• Your library, encrypted: every synced item (collections, saved tabs, sticky notes, notes, spaces) is encrypted on your device before it is sent, with keys that never leave your devices in readable form. The server stores the ciphertext and what it needs to sync it: an item’s type and random id, when it changed, which device changed it, and its size. We cannot read your titles, URLs or notes, and nobody who gets hold of the server’s data can either.
• Cloud backups, encrypted: while sync is on (unless you turn them off in Settings → Backups), once a day each of your browsers uploads a backup of its whole library — collections, notes, the archive, snapshots and settings — encrypted on the device with the same keys. The server stores the encrypted file, its size, when it was made and which of your devices made it, in Cloudflare R2. Each device keeps about three months of them; older ones are deleted.
• Your keys, sealed: your encryption key is stored only in “sealed boxes” that open with one of your approved devices’ private keys or with your recovery key. You keep the recovery key; we never see it. If you lose every device and the recovery key, we cannot recover your synced data — your devices still have their local copies.

Email. Sign-in, verification and password-reset codes are sent through Plunk, an email delivery service, which receives your email address and the message. We send no marketing email unless you opt in.

Service providers. Two companies run the sync API for us. They act only on our behalf, under their own data-processing terms:

Where it is stored. The database is in the EU (Frankfurt, Germany). Cloudflare answers requests from the data center nearest you. Some of these providers are US companies; any transfer of your data outside the EU is covered by the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses in their data-processing terms.

Deleting your account. Signing out keeps everything on your device. To delete your account and everything stored with it — the encrypted library, devices, keys and published pages — email hello@larksail.com from the account’s address; we delete it within 30 days.

Shared copies (optional, needs an account)

If you share a copy of a space or a collection (“Share a copy…” in its menu), Larksail encrypts the copy in your browser with a new key that exists only in the link it gives you (after the #, the part browsers never send to a server). Our server stores the encrypted file, its size, when it was made and which account made it — we cannot read it. Anyone you give the whole link to can open the copy in their browser, add it to their own Larksail or download it. You can delete a link at any time in Settings → Sync → Shared links. If a link is reported for abuse we can delete it by its address, without being able to see what’s in it.

Published pages (optional, needs an account)

If you are signed in, you can publish a collection as a web page from its menu (“Publish as a web page…”). Publishing is never automatic. It sends a plaintext copy of that one collection to our server: its title and its links, and — if you leave “Include notes and tags” on — its note, tags and each link’s note and tags. Nothing else (no other collections, no browsing data, no page contents). Unlike synced data, a published page is not encrypted: anyone with its link can see it. Pages are unlisted (we ask search engines not to index them), and a page only changes when you choose Update now.

Link safety check. When you publish or update a page, its links may be checked against Google Safe Browsing to keep malware and phishing off larksail.com. Only the page’s links are sent to Google (they are about to be public anyway), nothing about you. If any link is flagged, the page isn’t published and Larksail tells you which links.

Unpublishing removes the page and deletes its content (and its title) from our server right away; caches drop it within a couple of minutes. Settings → Sync lists all your published pages, including ones whose collection you deleted, so you can unpublish them. Deleting your account deletes all your pages.

Reports. Anyone can report a page. We store the reason, any details they write, and a one-way salted hash of the reporter’s network address (to limit abuse) — never the address itself. If we take a page down, its content is deleted; we keep its title, the reason and a record of the action.

“Save to my Larksail” on a published page asks your installed extension to add that collection; the extension downloads the page from our server itself and asks you before adding anything.

Zapier (optional, needs an account)

If you are signed in and connect Zapier (Settings → Webhooks → Zapier), our server stores:

• API keys you create for Zapier — only a one-way hash of each key, its name, when it was made and last used. Revoking a key deletes it.
• Your Zaps’ subscriptions: which event a Zap listens to, the Zapier address to post it to, and a collection name if you gave one. No tabs or other library data.
• Links Zapier sends to Larksail (“Save link”): the address and the title, collection name, note and tags Zapier sent. These are not encrypted on our server — they come from outside your library — and wait there only until your browser collects them, usually within a few minutes; then they are deleted. Links nobody collects are deleted after 30 days.

When a Zap listens to Larksail (tabs saved to a collection, or a collection you send to Zapier), your browser posts that collection’s title, note, tags and space and its tabs’ titles, addresses, notes and tags directly to Zapier — the same fields as webhooks. Our server never sees them. Zapier’s own privacy policy applies to what you send it.

The website (larksail.com)

larksail.com sets no cookies and loads no analytics scripts or third-party code. To see which pages people read and where they came from, our server counts each page visit as a total: the page, the website that linked to it (the site’s name only), the campaign tags in the link (utm_source, utm_medium, utm_campaign, ref), the country (from Cloudflare), phone or computer, and the browser family. On the page you see after uninstalling Larksail, the version number and the reason you picked are counted too. Your IP address, the full browser string and anything that could tell two visits by the same person apart are never stored. The counts are kept by Cloudflare for 90 days.

Feedback and email to us

When you click Send feedback in Larksail (or Report this after an error), our server stores what you wrote, the kind you picked (bug, idea, question), your email address if you gave one (only to reply), and — unless you turn it off in the dialog, where you can see exactly what’s included — diagnostics: Larksail’s version, your browser and its version, operating system, language, which optional features are on, and the error message if you’re reporting one. Never your tabs, addresses, titles, collections or notes. A hash of your network address is kept for the rate limit. Mail you send to hello@larksail.com is stored the same way (the sender, subject and text).

We read every message. To sort them and draft answers faster, the text and diagnostics are also processed by Anthropic (Claude) on our behalf, which doesn’t use them to train its models; replies are always sent by a person. Feedback is deleted two years after it was last handled, or sooner if you ask.

Permissions

Larksail asks for only what its features need. Some permissions are optional: Larksail asks for them only when you turn on the feature that uses them, and you can withdraw them at any time in your browser’s extension settings.

AI

AI is off by default. When you turn it on in Settings → AI, you choose where it runs:

• On this device: Chrome’s built-in model runs on your computer. Nothing is sent anywhere.
• Your own API key with Anthropic, OpenAI, Google (Gemini) or OpenRouter: when you use an AI feature, what that feature needs (for example tab titles, links or the text of a saved page) is sent directly from your browser to the provider you picked, under your own account and that provider’s privacy policy. We have no server in between and keep no copy. Your API key is stored on your device only and is never synced. Note that Google may use content sent with a free Gemini API key to improve its products.
• A local model (for example Ollama or LM Studio): requests go to the server address you enter, usually your own computer.

Larksail asks for access to the provider’s address only when you pick it, and asks your permission in the app before the first request to each provider or server, saying what may be sent. It sends nothing until you use a feature, nothing in the background, and never to any party you didn’t choose. You can revoke that permission in Settings → AI. AI results — answers, chats and summaries — are kept on your device like the rest of your data, and are included in your backups.

MCP for AI apps (optional)

Off by default. If you turn it on and install the larksail-mcp helper, AI apps on your computer that you connect to it (for example Claude, ChatGPT or Cursor) can search your saved tabs, notes, saved pages, highlights, closed tabs and open tabs, and — only if you turn on Allow changes — open, save and close tabs and create notes. The helper runs on your computer and passes messages only between Larksail and those apps, through a local connection only your user account can open; nothing goes to us. What an AI app reads through it, it may send to its own model under that app’s privacy policy — as with anything you paste into it.

Backups, import and export

If you turn on automatic backups, Larksail writes backup files to a folder in your Downloads. Export and import work with files you choose. Those files are yours, and Larksail doesn’t send them anywhere.

Your own storage (optional). If you set up a backup to your own S3 bucket or WebDAV folder (Settings → Backups → Your own storage), Larksail sends the daily backup there — straight from your browser to the address you entered, never through us — encrypted with a key made from a passphrase you choose. Larksail asks for access to that one address when you set it up. The address and its access keys or password stay on this device (not synced, not in backups); the passphrase isn’t stored at all. The storage’s provider’s own terms apply to what it keeps.

Something websites could notice

When Focus mode blocks a site, Larksail redirects it to its own block page. For the browser to allow that redirect, the block page has to be reachable by websites. As a side effect, a website could check whether Larksail is installed in your browser. It cannot see any of your data.

Published pages on larksail.com (and only those) can ask the extension whether it is installed, so they can show “Save to my Larksail” instead of “Get Larksail”. They cannot read any of your data; they can only ask the extension to add or open the published page you are looking at, and adding always asks you first.

Why we may process your data (legal basis)

Everything Larksail keeps on your device stays under your control and isn’t processed by us. For what reaches our server, the GDPR’s legal bases are:

• To provide the service you asked for (performance of a contract, Art. 6(1)(b)): your account, sign-in and its emails, sync, published pages and Zapier.
• Our legitimate interests (Art. 6(1)(f)) in keeping the service secure and free of abuse: sign-in sessions’ network address and browser, rate limits, the hashed address of whoever reports a page, the link safety check before publishing, records of pages taken down, handling the feedback you send us, and counting visits to larksail.com.
• Your consent (Art. 6(1)(a)): marketing email, only if you opt in. You can withdraw it at any time.
• Legal obligations (Art. 6(1)(c)): when the law requires us to keep or hand over data.

Your rights and deleting your data

Remove any item in Larksail, or clear the archive in Settings. Uninstalling Larksail deletes all of its data from your browser. Backup files you exported or that were written to your Downloads folder stay there until you delete them.

For data on our server (account, encrypted library, published pages, Zapier keys and links waiting to be collected, feedback you sent), you can ask us to see, correct, export or delete it by emailing hello@larksail.com. You also have the right to lodge a complaint with your local data-protection authority.

Children

Larksail is a general-purpose productivity tool and isn’t directed at children. Accounts are for people aged 16 or older. If we learn that an account belongs to someone younger, we delete it.

Changes

If this policy changes, the new version will be published at this address with an updated date; for changes that affect account holders, we’ll also email them. Larksail’s core promise won’t change: your data stays on your device unless you choose to send it somewhere — and what you sync stays encrypted.

Contact

Questions? Email hello@larksail.com.