moftab
Install

Privacy Policy

Last updated: July 2026

1. About this Policy

This Privacy Policy describes how MofTab and the Moftly studio ("MofTab", "Moftly", "we", "us") handle personal data. It is compliant with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Romanian Law 190/2018 on the processing of personal data.

This policy covers two distinct things:

  • The website — moftab.com, the product site you are reading now.
  • The extension — MofTab, the new-tab extension you install in your browser.

The short version: the website collects nothing, and the extension only touches data for the integrations you switch on yourself. Everything below is the detail behind that.

2. Data Controller

MofTab is operated by [INSERT PFA LEGAL NAME — as registered with ONRC] (the "Data Controller"), a Romanian Persoană Fizică Autorizată (PFA).

Registered address: [INSERT REGISTERED ADDRESS]

Tax identification number (CUI): [INSERT CUI]

Contact: privacy@moftab.com

3. Data We Collect

(a) The website, moftab.com

The website collects no personal data. There is no signup form, no account, no newsletter, no analytics, no tracking, and no advertising or tracking cookies. Fonts are self-hosted — no Google Fonts CDN, no third-party embeds that could observe you.

The only thing stored in your browser is a single localStorage entry, moftab-theme, which remembers whether you chose the light or dark theme. It never leaves your device. See the Cookie Policy.

The site is hosted on Vercel. Like any web host, Vercel records technical request logs (such as IP address and user-agent) as a normal part of serving and protecting the site. This is standard infrastructure logging, not something MofTab collects or uses for profiling.

(b) The extension, MofTab

Out of the box, the extension shows a clock and a wallpaper and collects nothing. It only reaches any personal data through an integration you enable yourself in Settings. Section 13 lists each one in full: what data, through which API, and where it is stored.

4. Purpose of Data Collection

When you enable an integration, the extension uses the data for one purpose only: to display it to you on your new tab. Your calendar events, the weather where you are, your open pull requests — shown, and nothing more. Data is never used for advertising, profiling, resale, or any purpose beyond the feature you turned on.

5. Legal Basis for Processing

Every integration is processed on the basis of your consent(GDPR Article 6.1.a). You give that consent by explicitly enabling the integration in the extension's Settings — each one is a separate, deliberate choice.

You may withdraw consent at any time by disconnecting the integration (the Disconnect control in Settings) or by uninstalling the extension. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

6. Data Processors

MofTab keeps no servers that store your data. The processors involved are:

  • Vercel — website hosting; technical request logs only (Section 3a).
  • Two Cloudflare Workers — used solely to relay OAuth token exchange for GitHub and Outlook. They neither store, log, nor analyse tokens or user data (Section 14).
  • The providers you connect — Google, Microsoft and GitHub process your request under their own privacy policies when you choose to connect them.

7. Data Retention

Because MofTab has no server-side store of your data, there is nothing for us to retain. Everything fetched by an integration is cached locally on your device— in the browser's extension storage or IndexedDB — so the new tab loads instantly.

That local cache is cleared when you disconnect the integration, and all of it is removed when you uninstall the extension. OAuth tokens live in local extension storage and are deleted on Disconnect.

8. International Data Transfers

Moftly does not transfer your personal data anywhere — it holds none on any server.

When you choose to connect a provider (Google Calendar, Outlook, GitHub, or a weather service), your request goes directly to that provider, which may process it inside or outside the European Economic Area under its own privacy policy and safeguards. That transfer is between you and the provider you selected, on the legal basis of your consent to connect it.

9. Automated Decision-Making

MofTab does not carry out automated decision-making or profiling. It displays your data; it does not score, rank, or make decisions about you.

10. Your Rights

Under GDPR you have the following rights regarding your personal data:

  • Right of access — request a copy of the personal data we hold about you.
  • Right to rectification — correct inaccurate or incomplete data.
  • Right to erasure("right to be forgotten") — request deletion of your data.
  • Right to restriction of processing — limit how your data is processed.
  • Right to data portability — receive your data in a structured, machine-readable format.
  • Right to object — object to processing.
  • Right to withdraw consent — at any time, without affecting prior lawful processing.

In practice, most of these you exercise directly: MofTab holds nothing centrally, so disconnecting an integration or uninstalling the extension erases your data at source. For anything else, contact privacy@moftab.com and we will respond within 30 days as required by GDPR.

11. Right to Lodge a Complaint

You have the right to lodge a complaint with the Romanian Data Protection Authority, or with the supervisory authority in your country of residence:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania
Website: www.dataprotection.ro
Email: anspdcp@dataprotection.ro

12. Third-Party Sharing

MofTab does not sell, trade, rent, or otherwise share your personal data with third parties for their commercial purposes. It has no data to share: what integrations fetch stays on your device.

13. Extension Integrations

This is the heart of the policy. Every integration is opt-in and OFF by default. Nothing here runs until you turn it on in the extension's Settings, and each stays on only until you disconnect it. All calendar and code integrations are read-only — MofTab never creates, edits, or deletes anything in your accounts.

Google Calendar

Authorised through chrome.identity.getAuthToken, Chrome's native sign-in — it does not go through any Moftly server. Scope: calendar.readonly. MofTab reads upcoming events (title, time, location) to show them on the new tab. Read-only: no creating, editing, or deleting. Events are cached locally in the browser's extension storage and cleared on Disconnect. See the Google API Limited Use disclosure in Section 15.

Outlook Calendar

Uses the Microsoft Graph /me/calendarView endpoint. Delegated permissions: Calendars.Read, offline_access, openid, profile. Sign-in uses the OAuth authorization-code flow with PKCE (S256) and a public client — no client secret. Read-only, same as Google.

Only one calendar provider can be connected at a time — Google or Outlook, not both. See the Microsoft Graph data use note in Section 16.

Weather

Weather comes from Open-Meteo (forecast) with no API key and no account. Two location paths:

  • Automatic— with your permission, the browser's geolocation provides approximate coordinates, which are turned into a city name by BigDataCloud's no-key reverse-geocoding API. Coordinates are sent to these weather services only; nothing is sent to Moftly.
  • Manual— search for a city by name and no coordinates are used at all; only the city name you type is sent to Open-Meteo's geocoding to resolve it.

A note on permissions: because of a Chrome MV3 constraint, geolocation cannot be an optional permission, so it appears in the install-time permission list. MofTab only ever reads your location afteryou enable Weather and choose automatic detection — never on install, and never for manual city search. Your chosen location is stored locally. Weather data is refreshed at most every 30 minutes; automatic location is re-checked at most every 6 hours, and only updates if you have moved more than 50 km.

GitHub

Connected through a GitHub App with fine-grained, read-only permissions: Pull requests (Read), Issues (Read), and Metadata (Read). You choose which repositories the App is installed on, so MofTab sees only those repositories — nothing else in your account. It shows your open pull requests and assigned issues; it never writes, comments, or modifies anything.

Bookmarks (quick links)

The quick links on your new tab are ones you type in yourself, stored in the browser's synced extension storage. MofTab does not use the chrome.bookmarksAPI, so it cannot and does not read your browser's actual bookmarks.

Site icons are fetched from Google's public favicon service — only the domain name of a link you added is sent, nothing else.

World Clocks

Entirely local: no API, no account, no network. Times are computed on your device with the browser's built-in Intl.DateTimeFormat.

Search bar

The new-tab search bar is opt-in and off by default. When enabled, it hands whatever you type to your browser's own configured default search engine through chrome.search.query. MofTab does not store your queries, does not see the results, and sends nothing to Moftly — it simply runs the search you asked for in your default engine.

Crucially, MofTab does not change your default search engine, does not intercept your queries, and does notadd a search engine of its own. It uses your browser's existing setting exactly as it is. A new-tab extension must never hijack the search experience, and MofTab does not.

Notifications

Notifications are an optionalpermission, requested the first time you turn a notification on — never at install. They use the browser's native chrome.notifications for two kinds of alert: a meeting starting in about 10 minutes (from your connected calendar) and new pull requests (from GitHub). Each type is opt-in and off by default.

Nothing is sent anywhere to produce them: the alerts are composed on your device from data the integrations you already enabled have fetched, scheduled with the browser's local alarm scheduler.

Custom wallpaper upload

An image you upload as a wallpaper is stored in your browser's local IndexedDB and never leaves your device. Moftly does not receive it and claims no rights over it.

14. OAuth Token Exchange (Cloudflare Workers)

Two Cloudflare Workers exist for one narrow job each: relaying the OAuth token exchange so the extension can connect GitHub and Outlook. They are the only Moftly-operated servers in the whole system.

  • GitHub Worker— GitHub requires a client secret at token exchange even with PKCE, and the Chrome Web Store forbids secrets inside extension code. The Worker holds that secret server-side and forwards GitHub's response verbatim.
  • Microsoft Worker — a pure relay with no secret (the client is public, PKCE). It exists only because Microsoft rejects a token exchange sent directly from a browser; the Worker, having no browser origin, is accepted.

Neither Worker stores, logs, or analyses tokens or any of your data — they pass the exchange through and forget it. Google does not go through any Worker: its sign-in is handled natively by Chrome (chrome.identity).

15. Google API Limited Use Disclosure

MofTab's use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

Specifically, for data obtained via the calendar.readonly scope:

  • Allowed use — the data is used only to display your upcoming events on the new tab.
  • Allowed transfer — the data is never transferred to anyone; it stays on your device.
  • No advertising — the data is never used for advertising of any kind.
  • No human access — no human reads the data; it is not sent to any Moftly server, so there is nowhere for anyone to read it.

16. Microsoft Graph Data Use

Data obtained from Microsoft Graph via the Calendars.Read permission is used the same way and under the same limits as Google Calendar data: only to display your upcoming events on the new tab, read-only, cached locally, never transferred to Moftly or anyone else, and never used for advertising or profiling. It is deleted from your device when you disconnect Outlook.

17. Permissions We Never Request

What MofTab deliberately does not ask for is as much the point as what it does:

  • tabs — never. MofTab cannot see which sites you visit. This is a permanent decision.
  • webNavigation, webRequest, history, cookies, downloads — none of them.
  • <all_urls> host access — never.
  • Content scripts of any kind — none, anywhere. MofTab never injects code into the pages you browse.
  • Analytics, telemetry, or tracking pixels inside the extension — none.
  • User accounts or profiles on Moftly servers — they do not exist.

18. Security

MofTab is built to minimise exposure by design: your data stays on your device, OAuth secrets never ship in the extension, and no Moftly server holds your personal data. We apply reasonable technical and organisational measures to the parts we do operate (the website and the token Workers). No method of transmission or storage is ever 100% secure, but the smaller the surface, the smaller the risk — and MofTab keeps it deliberately small.

19. Children's Privacy

MofTab is not directed at children under the age of 16, and does not knowingly process their personal data. If you believe a child has provided personal data through MofTab, contact privacy@moftab.com and we will address it.

20. Changes to This Policy

This Privacy Policy may be updated from time to time. Material changes will be reflected in the "Last updated" date at the top of this page. Continued use of MofTab after a change constitutes acceptance of the updated policy. See also our Terms of Service and Cookie Policy.

21. Contact

For any question about this Privacy Policy or how your data is handled, contact:

Email: privacy@moftab.com