Privacy policy

Hoome is a browser extension that replaces the new tab page. It runs entirely inside your browser. An optional account, reserved for Premium, is described below: without it, nothing leaves your browser apart from the services listed here. Hoome was called TabHub until version 0.2.0. It is available for Chrome and for Firefox: what follows applies to both, and the one real difference, sync, is described where it belongs.

Data handled

• Your shortcuts, folders and settings, and the content of your widgets, such as your notes and tasks, are saved in your browser local storage (chrome.storage.local). They are never sent to any server of ours without your consent. Two features send them out, and only if you use them: sync between browsers, described just below, which stores them in your own account, the one of your browser; and, for a Premium subscriber signed in to their Hoome account, account sync, described further down, which keeps a copy of your desks on the Hoome account server and which you can stop at any time.
• Site icons: to show the logo of a shortcut, the extension asks the icon services of Google (gstatic.com) and DuckDuckGo (icons.duckduckgo.com) for that domain icon. Only the domain name is sent. The icon is then cached locally.
• Weather, an optional widget that is off by default: forecasts come from Open-Meteo (api.open-meteo.com). Only the coordinates of the city you picked are sent. Tides, a Premium widget also off by default, reads water levels from Open-Meteo’s marine service (marine-api.open-meteo.com), with only the coordinates of the place you picked. City search sends the text you typed to geocoding-api.open-meteo.com, here and in the other widgets that ask for a city.
• Usage counter: to rank search results, each shortcut remembers locally how many times it was opened and when. Those counters stay in local storage, like everything else, and are never transmitted.
• Bookmarks: your bookmarks are read only when you ask for an import, from “Import from bookmarks…” in the page context menu, or from “Add from bookmarks…” on a folder. Chrome then asks for permission to read them, an optional permission that is never requested at install time. They are read once to create the folders you ticked, are never modified, and never leave your browser.
• Most visited sites: in “New shortcut”, the “Also suggest your most visited sites” link asks for permission to read the list of the sites you visit most (topSites), an optional permission that is never requested at install time, which your browser then puts to you. The list is read on your computer, to suggest the sites that are not in Hoome yet: it is neither stored nor sent, and no icon is requested for those sites until you add them. Firefox does not offer this permission, and the link does not show there.
• Location: browser geolocation is requested only if you click “My location”, in the settings or in a widget that asks for a city. The position is rounded and saved locally as your chosen city; for the weather, only its coordinates go to Open-Meteo, as described above. You can replace it at any time with a city you search for.
• Notifications: a widget can alert you with a notification on your computer, if you allow it when Chrome asks. This permission is optional, never requested at install time, and the notification is written on your device: nothing is sent.

Sync between browsers

A free feature, off by default, in the settings under Data. With Premium account sync, described further down, it is one of the only two Hoome features that send your data off your computer. This one you ask for, it never turns itself on; account sync, on the other hand, starts when you sign in to your Hoome account, and a switch stops it.

What leaves: for each of your desks, your folders, your shortcuts (address, title, initials and colour), the look of your page, that is the chosen background, theme, layout, icon size, and the clock and search settings, and the content of your widgets, such as your notes and tasks.

What does not leave: fetched icons, which are a cache each browser rebuilds on its own; your imported background image; strict privacy mode; animated background quality.

Where it goes: into Chrome’s synced storage (chrome.storage.sync), that is into your own Google account. Nothing passes through our servers, we have no access to it, and it only works between Chrome browsers signed in to the same Google account. What Google does with it falls under its own privacy policy.

In Firefox, the same setting goes through Firefox’s synced storage, that is through your Mozilla account, and only links Firefox browsers signed in to the same account: Chrome and Firefox do not sync with each other. Mozilla’s own privacy policy then governs how it is processed.

For how long: until you untick the setting, which immediately erases what had been stored. Uninstalling the extension removes it too.

Strict privacy mode makes sync impossible while it is on.

Strict privacy mode

For a work computer where no request may leave the extension, for example a law firm or a notary office, the settings offer a “Strict privacy” mode in the Data section. Once enabled, the extension makes no network request at all: site icons are no longer fetched and coloured initials replace them, the weather widget is unavailable, city search and “My location” are switched off, and the Hoome account no longer contacts its server, account sync included.

Icons already cached stay visible. A “Clear cached icons” button removes them, while custom icons you imported are kept. Web search from the search bar still works, exactly like typing in the address bar. The mode stays on after an import, a backup restore or a reset to the default shortcuts.

What Hoome does not do

• No usage analytics, no tracker, no advertising.
• No access to your browsing history, your tabs, your cookies or the content of the sites you visit. The one exception, if you allow it: the list of your most visited sites, described above, read on your computer and never sent.
• No account for the free version, no sign up. The account exists only for Premium.

Backups and export

Automatic backups and JSON exports stay on your device. An exported file holds your shortcuts, folders, notes, tasks, settings and, if you choose so, your icons and imported background. You alone decide whether to share it.

Deletion

Uninstalling the extension removes all of its local data, but not the copy of your desks that account sync keeps on hoome.dev: that copy is erased with your account, or by the extension’s switch, as described below. From the settings, “Empty database” removes shortcuts and folders, and backups can be restored or overwritten.

The hoome.dev website

This site is hosted by Netlify. Its pages are static, apart from the account page. It uses no analytics tool, and sets cookies only on the account page, if you sign in: they are the ones listed in the next section, needed for signing in. A language preference is saved in your browser local storage if you dismiss the language bar; it never leaves your device.

The technical logs of the host may keep visitor IP addresses for a short time, for security and for the correct operation of the service. Those logs are not used by Hoome.

The form on the uninstall page is handled by Netlify Forms, a service of our host. It asks for no name, no address and no identifier, and its content is tied to no account. Netlify does however record the IP address of the submission, as it does for any form, and we cannot switch that off. That address is neither used, nor cross referenced, nor kept by us.

The form on the contact page also goes through Netlify Forms. It asks for your email address, so that we can reply, and for your message. They are only used to reply to you, and are deleted at the latest one year after our last exchange. Netlify also records the IP address of the submission.

The Hoome account, for Premium

The account is optional and only serves Premium: the fourteen day trial, the subscription, payments and invoices, and the sync of your desks between your computers. The free version does not need it. Your shortcuts, folders, notes and tasks are sent to it in one case only: you are a subscriber, signed in to your account, and you have not stopped sync, described in the next section.

What we keep. Your email address, your name, and your Google account identifier if you sign in through Google. The list of your signed in devices: browser and system, sign in date and last activity date. And, with Premium, the copy of your desks described in the next section. Nothing else: no contacts, no calendar, no history.

Why. To run your account and your subscription, that is to perform the contract you enter when you take Premium. None of this data is used for advertising, analytics or profiling.

Where. At Netlify, which hosts the site and the account storage. No sign in token is kept in clear there: only their hashes are stored.

For how long. The account, until you delete it. A site session ends after thirty days without a visit, an extension session after one hundred and eighty days. A sign in ticket lives sixty seconds and works once, an emailed link fifteen minutes. Deleting the account immediately erases the account, its sessions, the copy of your desks, its Google link and its address index.

Payment. Premium is sold by Paddle, our merchant of record, which issues invoices and handles VAT. Paddle receives your email address and your name, and you enter your payment method in its window: Hoome never sees your card. That window is opened by a Paddle script, loaded on the payment page of the site only, never anywhere else. Paddle keeps invoices as its accounting obligations require, including after your Hoome account is deleted, and describes its own processing in its privacy policy.

Signing in. Two ways, your choice. Google identifies you when you choose “Continue with Google”: we only ask it for your address, your name and your identifier, and nothing is read or posted on your behalf. Otherwise we email a sign in link to your address, from contact@hoome.dev: that link is good for fifteen minutes and one use, and only its fingerprint is kept while it lasts. There is no password at all: we store none, and there is none to lose.

Transfers. Netlify and Google are based in the United States, Paddle in the United Kingdom. The resulting transfers rely on the contractual safeguards these providers offer, described in their own terms.

Account cookies. They are set only by the account page and its sign in routes, and only if you sign in. All of them are strictly necessary for the service you ask for, and serve nothing else.

Cookie	Lifetime	Purpose
__Host-hoome_session	until you sign out, the session ending after thirty days without a visit	Keep you signed in to the site.
__Host-hoome_oauth	ten minutes	Tie Google’s answer to the browser that asked for it, against a hijacked sign in.
__Host-hoome_sortie	thirty days	Remember that you signed out, so the site does not sign you back in through the extension on its own.

Your rights. From the account page, “Download my data” produces a file of everything we keep, and “Delete my account” erases it. For any other request, access, correction or objection, write to contact@hoome.dev. You may also lodge a complaint with your data protection authority.

Account sync, for Premium

A Premium feature, in the extension settings under Account, to find your desks again on all your computers and browsers, Chrome, Firefox or Edge, on Mac, Windows or Linux, even without a browser account. It starts by itself as soon as you are signed in to your Hoome account with Premium, trial included. Your desks then go to hoome.dev about twenty seconds after each change, at most once every two minutes per computer, and every computer signed in to the same account reads the copy again when a tab opens, at most once a minute. A switch in Settings > Account stops it on this computer. Strict privacy mode makes it impossible.

What is sent. Every desk of the account, including those this computer does not show, with for each one: its name; its shortcuts, with their address, title, initials, colour, tags, the number of times you opened them and their dates of creation, change and last opening; its folders and its Essentials; the content of its widgets, meaning your notes, tasks, goal of the day, countdowns and habits; and its look: the name of the chosen background, the layout, the widgets switched on and their settings, including the cities you picked. Also sent: the settings shared by all your desks (theme, icon size and style, clock, search, opening links in a new tab, quick links, colours), the identifier and date of deletion of the shortcuts, folders and desks you deleted, so that a deletion follows everywhere, and the main desk of each computer. The copy also carries its upload date, the number of desks, folders and shortcuts it holds, a fingerprint that identifies it, and a random identifier drawn when the extension is installed, which identifies the computer that sent it.

What is not sent. No image at all: neither your imported background image nor site icons, including those you imported yourself. Not “My location”, your device’s position, removed before upload. Not your backups, nor the interface language.

Where. On the Hoome account server, hoome.dev, in the account storage at Netlify (Netlify Blobs), filed under your account. One copy per account, of limited size, that each upload replaces after merging with it.

Who can read it. It travels encrypted, over HTTPS, and the server only returns it to you: to an extension signed in to your account, or to the account page on hoome.dev through “Download my data”. It is not end-to-end encrypted: there is no key or password to remember, and in return the publisher of Hoome, who runs the server, and Netlify, which hosts it, could technically access it.

Why. To perform the service your Premium subscription includes: finding your desks on all your computers. It serves no other purpose: no advertising, no statistics, no profiling.

On another computer. Every computer signed in to the same Hoome account, Premium or not, merges the copy with its own desks automatically: an addition, a change or a deletion made elsewhere arrives here, after a backup of all desks on the computer when a desk disappears, which lets you go back. A desk that is new to this computer is only shown if you choose it. When the same desk changes at the same time on two computers, the version from the computer where it is the main desk is kept, or both are merged, and the version from here is kept in a backup. You can also ask to be consulted before each update. An account without Premium receives the copy without uploading one.

For how long. Until a new upload replaces it, or until you erase it: the switch in Settings > Account stops syncing on this computer, and can also erase the account copy, right away and without Premium. Another computer that stays signed in and syncing would upload a new one: to erase it for good, stop it everywhere, or delete your account, which erases it immediately. Signing out of the extension does not erase the copy. It stays if your subscription ends, so you can still receive it, and uninstalling the extension does not erase it.

Viewing and erasing it. “Download my data”, on the account page, includes it in full. The extension’s switch erases it alone, keeping your account; “Delete my account” erases it with the account.

Contact

For any question about your data: contact@hoome.dev.