PRIVACY & DATA HANDLING · UPDATED 4 NOVEMBER 2026

Your browser.
Your information.

This policy describes the hosted TabCircuit service, its browser extensions and tabcircuit.com. It does not describe the older local-server edition.

Who operates TabCircuit

TabCircuit is operated by ArcZen, based in Taguig, Philippines. The website is tabcircuit.com and the account and connection service is console.tabcircuit.com. The support and privacy address is [email protected]. Its Namecheap mailbox is provisioned and enabled; incoming and outgoing delivery are still being verified during the website’s DNS transition. Do not send passwords, access tokens or private page content in a support request.

What you authorize

TabCircuit connects the AI client you authorize to your browser. Sign-in, browser connection, agent authorization, website access and confirmation of consequential actions are separate steps. An agent can use tabs it opens, tabs you explicitly share, or approved existing tabs you let it discover and reuse. Enabling tab discovery does not approve new websites.

Commands and results travel through the TabCircuit service to your chosen AI client. HTTPS protects those connections. The service processes their contents; this is not end-to-end encryption against the operator. Your AI client can send results to its model provider and keep them in conversation history under that provider’s own policies.

Browser information we process

• Page content and actions: page text, accessibility snapshots, tab titles and URLs, interaction results, and values supplied for typing. Screenshots are included only when their separate setting is enabled. Approved pages may contain personal or sensitive information and use your existing website sign-in.
• Existing-tab discovery: when enabled, bounded tab titles, website origins, active or focused state, recent-use times and temporary candidate identifiers. Discovery does not return full URL paths or page contents before a candidate is reused.
• Point and share: an element or section you select, its short label and temporary selection identifier. Scoped inspection is available only to the selected agent. Sharing also grants the chosen website access mode; it is not a guarantee that the rest of that website is inaccessible.
• YouTube captions: when video-transcript access is enabled, the extension can read existing captions from a supported YouTube watch page, with timestamps, video ID, title and available language information. It does not download or transcribe the video’s audio. Opening the transcript panel automatically requires interactive website access.
• Task context: agent-supplied task names, handoff messages, progress checkpoints and completion summaries, plus action and error counts. These summaries are the agent’s account of its work, not an independent verification.
• Requested downloads: the requested URL, source and file-host origins, filename, task and agent identifiers, progress and outcome. A URL can contain a signed access token. File bytes are downloaded by your browser rather than stored in TabCircuit’s account database. Downloaded file contents and unrelated download history are not exposed by the download tool.

The relay handles browser commands and results in memory; the authentication database does not store page text, screenshots or tool arguments. This does not describe copies retained by your AI client, the original website or infrastructure providers. The hosted service does not upload or expose the local edition’s shared-memory notes.

Account, security and billing information

Google verifies your sign-in. TabCircuit receives a verified provider identifier and display name and derives an internal account identifier. It does not receive your Google password. The sign-in flow requests identity and profile information; it does not request access to your Gmail, Drive or other Google account content.

The service stores browser and AI-client registrations, account and device identifiers, credential hashes, authorization metadata, browser-profile bindings, a selected default browser and plan information. These records provide access, preserve the browser’s setup identity, enforce session limits and allow revocation. The extension keeps connection credentials in browser storage restricted to the extension where supported.

When paid billing is enabled, PayPal processes payment details on its own pages. TabCircuit does not receive card or bank credentials. It uses your internal account ID as the subscription reference and stores provider payer and subscription IDs, status, paid-through date, cancellation state and applied notification identifiers. Checkout attempts include a request identifier, selected billing period, callback and approval URLs, timestamps, known subscription ID and a provider-configuration fingerprint to prevent duplicate subscriptions after interruptions.

Network addresses and request metadata can be processed by hosting providers to deliver and protect the service. Application abuse limits are held in memory. The current application has no advertising, analytics or model-training integration; this statement does not describe your AI provider’s separate processing.

Support messages: messages you send contain your email address and any information or attachments you include, and are handled to respond to your request. Namecheap Private Email hosts the provisioned mailbox. End-to-end delivery and mailbox-retention settings have not yet been verified. Automated TabCircuit receipt emails are not implemented.

Where information goes

The configured providers are Cloudflare for the public website, Render for the service, Neon for the account database, Google for sign-in and PayPal for subscriptions when billing opens. The configured service and database regions are Frankfurt, Germany. Providers and your selected AI client may process information in other countries under their own policies and service arrangements.

Browser results go to the AI client you connect. Sharing a tab with another agent authorizes another connection to inspect that tab under its own website permissions; it does not transfer the first agent’s private selection records. The website’s demonstration uses illustrative data and does not connect to your tabs or accounts.

How long records remain

• Authorization: access tokens last up to 15 minutes; browser and agent authorizations, with rotating refresh credentials, last up to 30 days. Account website sessions last seven days. Used refresh-token replay markers last up to 24 hours while the grant exists. These are validity limits, not deletion promises for backups. Expired application records are removed during subsequent cleanup activity.
• Browser bindings: a protected profile identifier can remain after sign-out, expiry or revocation to keep the browser’s setup identity stable. It cannot authorize access on its own. Account deletion removes these bindings.
• Browser-local records: preferences, site permissions and the latest 2,000 activity entries remain in the browser profile until cleared, replaced or removed. Activity can contain website origins and URL paths. The extension keeps at most 20 completion receipts and at most 20 interrupted-task records in browser-session storage. Interrupted-task recovery is available for up to six hours; expired records are removed during extension cleanup. Temporary tab-discovery candidates expire after two minutes. Point-and-share selection records are temporary and become invalid when relevant page or control state changes.
• Subscriptions: a canceled subscription’s entitlement is eligible for cleanup 30 days after its recorded paid-through date. A minimal account-to-subscription binding remains after entitlement expiry and account deletion to prevent delayed provider notifications from restoring a deleted subscription; it currently has no automatic expiry. Unresolved checkout attempts remain until the provider outcome is established.
• Notification records: the service keeps at most 5,000 recent billing-notification IDs across accounts, with the account ID and arrival time, replacing older entries as newer notifications arrive. This is a count limit, not a fixed retention period.
• Database recovery: the Neon project’s configured restore window is six hours. Information removed from the live database may remain in that recovery history during the window. A separate temporary backup branch created for the service-domain migration is configured to expire on 5 November 2026 at 13:53 UTC. Branch expiry and the restore window are not promises of immediate physical deletion of every provider copy.
• Other infrastructure records: hosting logs, support-mail records and any separate provider copies have their own retention rules. Their deployment-specific periods have not yet been verified. The six-hour database recovery window does not apply to those records or to the live account and billing records described above.

Your controls and account deletion

Use temporary or remembered website approval, choose read-only access when suitable, stop sharing individual tabs, clear browser-local activity and summaries, or revoke connections. Read-only mode still allows navigation and scrolling; visiting a URL can have effects on a website. Downloads require separate approval. Screenshots, password-field typing, Firefox container continuity and Chromium advanced control have their own settings or permission choices.

Advanced browser control is off by default and can be enabled only by you in Chromium-based browsers. It uses the browser debugger connection to deliver clicks, hover, typing and key presses in permitted tabs. It does not use that connection to read network traffic, cookies, saved passwords or site storage. The browser displays a debugging bar while attached; choosing Cancel turns the setting off. Turning the feature off does not remove the installed debugger permission. Firefox does not use this backend.

Firefox’s optional container continuity uses container identifiers to open related tabs in the same container; it does not read or copy cookie values. The download tray tracks only explicitly requested and approved files. The browser may follow download redirects; approval is not enforced at each redirect destination. Disabling access or ending a task does not necessarily stop a download already approved, and dismissing its tray entry does not delete the file.

Pause stops new actions. Take over on a shared tab pauses every agent using it. A Needs you handoff pauses the requesting agent and other agents sharing that tab; Done—resume resumes only the requesting agent. An action already underway may have completed, and pausing does not undo it.

Choose Delete account on the account page and type delete to confirm. Unresolved checkouts must be resolved and active or overdue subscriptions canceled first. Leaving PayPal checkout does not itself cancel a payable subscription. Account deletion revokes browser and agent connections and removes browser bindings, default-browser choices, plan entitlement and website sign-ins. It retains the minimal billing binding and bounded notification records described above. Deleting an account after cancellation gives up any remaining Pro access.

Deletion does not close your tabs, delete Google or other website accounts, erase browser-local data, remove PayPal’s records or erase copies held by AI providers. Signing in again with the same Google identity starts an empty account using the same internal identifier. Uninstalling, signing out or disconnecting does not erase all copies; revoke connections separately where appropriate.

Privacy requests and rights

Depending on applicable law, you may request access to or a copy of your personal information, correction, objection to processing, or deletion. Some records may remain necessary to resolve a pending payment or preserve security and billing integrity; applicable legal rights still apply. A request may require proportionate identity verification, never your password, access token or full payment credentials.

The request address is [email protected]; the mailbox is enabled, with delivery verification still in progress. No specific support response time is guaranteed. You may also contact the Philippine National Privacy Commission or another competent privacy authority about your rights. See the Commission’s Data Privacy Act information.

Security and policy changes

TabCircuit uses HTTPS, scoped and revocable authorization, credential hashing, verified database TLS and browser-side website controls. These measures cannot guarantee that an AI acts correctly, that an approved page contains no secrets, or that a compromised computer or account is safe. Hosted extensions do not expose arbitrary page-script evaluation.

This page identifies the current notice and its last-updated date. Review it when deciding whether to authorize new browser access. It describes the service’s data handling and known limits; it does not claim independent certification of the service.