Free plan: your groups never leave your device.
Pro sync: tabs are encrypted on your computer before upload, with a key from your passphrase. The server only stores ciphertext, so I can't read your tabs.
Pro AI: it only ever sees tab titles, URLs and group names. It never reads what's on the pages, your notes or your browsing history, and a tab summary is written from the title and URL alone.
When you click an AI action (auto-group, name or describe a group, summarize a tab, organize), only the tabs that action is about are sent.
Session suggestions run on their own, at most once a day: they look at your 5 most recent groups and suggest which to reopen or merge. You can turn them off in Settings AI.
Your tabs pass through my server on their way to the AI and aren't saved there. All it keeps is how many credits the request used. If a request fails, the log gets an error code, not your tabs, and error reports have the request removed before they're sent.
The AI provider (Anthropic for TabMerger's AI, or your own Anthropic, OpenAI or Gemini key) receives the titles, URLs and group names it needs to answer, under its own API data policy.
The code is public on GitHub if you'd like to check any of this: https://github.com/lbragile/TabM...
