Every Permission, and Why
| Permission | Why BelayTab needs it |
|---|---|
tabs | Read tab titles and URLs so they can be saved |
tabGroups | Keep group names and colours |
sessions | Show recently closed windows on the Recovery screen |
storage, unlimitedStorage | Store your sessions on your computer |
alarms | Run snapshots on a timer |
favicon | Show site icons from the browser’s cache, not from the sites |
contextMenus | Right-click to save a page or link |
That’s the whole list. You can check it yourself on your browser’s extension details page.
How Sync Is Protected
- Transport: all traffic uses TLS, and our domains use HSTS.
- Sign-in: email codes or Google sign-in, so we never handle passwords. Access tokens last one hour and can be revoked per device.
- Isolation: row-level security in the database means one account’s requests can only ever reach that account’s rows, even if there were a bug in our API.
- At rest: the database and stored version history are encrypted at rest.
- Logs: we log counts and timings, never URLs, titles or other session content.
- Dependencies: pinned versions with automated update alerts. Browser extension rules forbid remote code, and BelayTab doesn’t use any.
Backups and Recovery
| Layer | Protection |
|---|---|
| Your device | Append-only change log, automatic snapshots, version history, and a backup before every update |
| Your disk | Optional rolling JSON export to your Downloads folder |
| Sync database | Point-in-time recovery for the last 7 days |
| Offsite copy | Nightly encrypted backup, kept for 30 days |
We test restoring from backups every quarter. A backup that has never been restored isn’t a backup yet.
Reporting a Vulnerability
Email [email protected] with the details and steps to reproduce. We’ll acknowledge within two working days, keep you updated, and credit you in the changelog if you’d like.
Good-faith research is welcome. Please don’t access or change other people’s data, run denial-of-service tests, or use social engineering, and give us reasonable time to fix a problem before you publish it. If you follow these rules, we won’t take legal action against you.