Trust
Security & Privacy
What NewTab stores, what it doesn't, and why the extension asks for each permission. Written in plain language, for you and for your IT team.
What we store
- Your account: name, email and avatar
- Organisations: the ones you belong to, plus groups and roles
- Your New Tab: Tabs, Cards and layout
- Tasks: the tasks you add
- Audit log: changes made in an organisation
What we don't
- Your browsing historyWe don't read it. The extension only replaces the New Tab page.
- Your calendar eventsThey're fetched live from Microsoft for display, and aren't stored.
- Your exact locationWeather uses a location rounded to about 1 km, or your office location.
Where Card logos come from
To show a logo on a Card, our server sends the Card's domain, such as example.com, to Logo.dev and fetches the logo. We then cache logos on our servers.
Chrome permissions, explained
What Chrome shows when you install NewTab, and what each one is for.
| Permission | Why NewTab needs it |
|---|---|
storage | Saves your settings and layout in Chrome. |
unlimitedStorage | Keeps your Tabs and Cards on your computer without hitting Chrome's storage limit. |
alarms | Schedules background refreshes, so the page stays up to date. |
identity | Signs you in. |
favicon | Uses Chrome's own copy of a site's icon. |
search | Sends what you type in the search box to your default search engine. |
notificationsOptional | Shows your task reminders. Asked for the first time you set one. |
geolocationOptional | Finds your approximate location for the weather, only if you allow it. |
Microsoft Entra ID
- Standard OpenID Connect sign-in.
- Delegated scopes:
User.ReadandCalendars.Read, to sign you in and show today’s meetings. - Group sync needs admin consent for
GroupMember.Read.All. - Tokens are encrypted at rest.
Payments
You enter card details on our payment provider's secure page. They never touch our servers.
Hosting & data location
Your NewTab data is hosted in:
New ZealandYour data rights
- Export your data
- Delete your account and data
- Organisation admins can export their organisation's data
Data protection
- Encrypted in transit (TLS)
- SSO client secrets and JWT signing keys encrypted at rest
- Data held under New Zealand's Privacy Act 2020
Questions, or found a security issue?
Email our security contact. For organisations, we're happy to go through this page with your IT team.