Privacy policy

Hoome is a browser extension that replaces the new tab page. It runs entirely inside your browser. An optional account, reserved for Premium, is described below: without it, nothing leaves your browser apart from the services listed here. Hoome was called TabHub until version 0.2.0.

Data handled

• Your shortcuts, folders, notes, tasks and settings are saved only in your browser local storage (chrome.storage.local). They are never sent to any server, not even to the Hoome account server described below.
• Site icons: to show the logo of a shortcut, the extension asks the icon services of Google (gstatic.com) and DuckDuckGo (icons.duckduckgo.com) for that domain icon. Only the domain name is sent. The icon is then cached locally.
• Weather, an optional widget that is off by default: forecasts come from Open-Meteo (api.open-meteo.com). Only the coordinates of the city you picked are sent. City search sends the text you typed to geocoding-api.open-meteo.com.
• Usage counter: to rank search results, each shortcut remembers locally how many times it was opened and when. Those counters stay in local storage, like everything else, and are never transmitted.
• Bookmarks: your bookmarks are read only if you choose “Import from bookmarks” in the “New folder” dialog. Chrome then asks for permission to read them, an optional permission that is never requested at install time. They are read once to create the folders you ticked, are never modified, and never leave your browser.
• Location: browser geolocation is requested only if you click “My location” in the weather widget settings. The position is rounded and saved locally as your chosen city. You can replace it at any time with a city you search for.

Strict privacy mode

For a work computer where no request may leave the extension, for example a law firm or a notary office, the settings offer a “Strict privacy” mode in the Data section. Once enabled, the extension makes no network request at all: site icons are no longer fetched and coloured initials replace them, the weather widget is unavailable, city search and “My location” are switched off.

Icons already cached stay visible. A “Clear cached icons” button removes them, while custom icons you imported are kept. Web search from the search bar still works, exactly like typing in the address bar. The mode stays on after an import, a backup restore or a reset to the default shortcuts.

What Hoome does not do

• No usage analytics, no tracker, no advertising.
• No access to your browsing history, your tabs, your cookies or the content of the sites you visit.
• No account for the free version, no sign up. The account exists only for Premium.

Backups and export

Automatic backups and JSON exports stay on your device. An exported file holds your shortcuts, folders, notes, tasks, settings and, if you choose so, your icons and imported background. You alone decide whether to share it.

Deletion

Uninstalling the extension removes all of its local data. From the settings, “Empty database” removes shortcuts and folders, and backups can be restored or overwritten.

The hoome.dev website

This site is hosted by Netlify. Its pages are static, apart from the account page. It uses no analytics tool, and sets cookies only on the account page, if you sign in: they are the ones listed in the next section, needed for signing in. A language preference is saved in your browser local storage if you dismiss the language bar; it never leaves your device.

The technical logs of the host may keep visitor IP addresses for a short time, for security and for the correct operation of the service. Those logs are not used by Hoome.

The form on the uninstall page is handled by Netlify Forms, a service of our host. It asks for no name, no address and no identifier, and its content is tied to no account. Netlify does however record the IP address of the submission, as it does for any form, and we cannot switch that off. That address is neither used, nor cross referenced, nor kept by us.

The form on the contact page also goes through Netlify Forms. It asks for your email address, so that we can reply, and for your message. They are only used to reply to you, and are deleted at the latest one year after our last exchange. Netlify also records the IP address of the submission.

The Hoome account, for Premium

The account is optional and only serves Premium: the fourteen day trial, the subscription, payments and invoices. The free version does not need it, and your shortcuts, folders, notes, tasks and settings are never sent to it, whether you are signed in or not.

What we keep. Your email address, your name and your Google account identifier, sent by Google when you sign in. The list of your signed in devices: browser and system, sign in date and last activity date. Nothing else: no contacts, no calendar, no history.

Why. To run your account and your subscription, that is to perform the contract you enter when you take Premium. None of this data is used for advertising, analytics or profiling.

Where. At Netlify, which hosts the site and the account storage. No sign in token is kept in clear there: only their hashes are stored.

For how long. The account, until you delete it. A site session ends after thirty days without a visit, an extension session after one hundred and eighty days. A sign in ticket lives sixty seconds and works once. Deleting the account immediately erases the account, its sessions and its Google link.

Payment. Premium is sold by Paddle, our merchant of record, which issues invoices and handles VAT. Paddle receives your email address and your name, and you enter your payment method in its window: Hoome never sees your card. That window is opened by a Paddle script, loaded on the payment page of the site only, never anywhere else. Paddle keeps invoices as its accounting obligations require, including after your Hoome account is deleted, and describes its own processing in its privacy policy.

Signing in. Google identifies you when you choose “Continue with Google”. We only ask it for your address, your name and your identifier, and nothing is read or posted on your behalf.

Transfers. Netlify and Google are based in the United States, Paddle in the United Kingdom. The resulting transfers rely on the contractual safeguards these providers offer, described in their own terms.

Account cookies. They are set only by the account page and its sign in routes, and only if you sign in. All of them are strictly necessary for the service you ask for, and serve nothing else.

Cookie	Lifetime	Purpose
__Host-hoome_session	until you sign out, the session ending after thirty days without a visit	Keep you signed in to the site.
__Host-hoome_oauth	ten minutes	Tie Google’s answer to the browser that asked for it, against a hijacked sign in.
__Host-hoome_sortie	thirty days	Remember that you signed out, so the site does not sign you back in through the extension on its own.

Your rights. From the account page, “Download my data” produces a file of everything we keep, and “Delete my account” erases it. For any other request, access, correction or objection, write to contact@hoome.dev. You may also lodge a complaint with your data protection authority.

Contact

For any question about your data: contact@hoome.dev.