Stuff I've made

What stays in your browser

Everything the page is made of is stored by the browser on your own machine, and none of it is sent anywhere:

The page itself

Netlinks and their categories, widget contents (scratch pad text, task lists, RSS feed addresses), the greeting name, colours, scan lines, sounds, the tab's title and favicon, your chosen search engine and weather source.

A wallpaper you upload

Kept in the browser's IndexedDB rather than uploaded anywhere, because an image or video can run to tens of megabytes.

Your most-visited sites

Read once, on the first run, to fill the netlinks grid so it doesn't start empty. The browser answers that question locally and the answer never leaves it.

A backup, only if you ask for one

The settings panel can write a snapshot of your settings or your netlinks into your browser account, so a new machine can restore them. It is written when you press the button and at no other time, and it goes to your browser account - Google's or Mozilla's - not to avi12.

Where you are

The weather widget can follow this device, and then it reads the device's location - rounded to four decimal places - and asks two open APIs about it: open-meteo.com for the forecast, and bigdatacloud.net to turn the coordinates into the name of the place so the widget can say where it is. Neither asks for an account and neither is told anything else about you.

You can pin a location by name instead, and then the device is never read at all. The permission is asked for at install because Chromium refuses to make it an optional one - not because the extension reads your location unprompted.

What leaves your browser, and where it goes

Searches

Go to the engine you picked in the search bar, or to your browser's own default engine - the same trip the address bar makes. They are not logged or counted anywhere in between.

Prompts

A prompt goes only to the destination you sent it to - ChatGPT, Claude, Perplexity, Google AI Mode or Brave - and only when you press send.

RSS feeds

A feed doesn't allow a browser extension to read it directly, so a feed address you add is fetched through a public CORS proxy - api.allorigins.win, cors.redoc.ly or api.codetabs.com, whichever answers first. Those proxies see the feed address you chose.

Google's weather (off by default)

If you pick Google as the weather source, the page fetches a Google search as your signed-in browser, cookies and all, and reads the forecast out of the returned page. That's why it asks for google.com first, and why it's off until you turn it on.

Copilot Tips

Fetched from edge.microsoft.com, the same public address Microsoft Edge itself uses. No account, no sign-in.

Your name

No browser API hands over a name, so "Use Google account" asks Google. You sign in at Google's own account chooser, Google answers with an ID token, the token is read for the first name in it, and the access token is handed straight back to Google's revoke endpoint. Neither token is written anywhere. Nothing but the name is kept, and the name sits in a text field you can overwrite with anything you like.

Copilot Journeys and Tips

On Microsoft Edge for Windows 11 the page can show the Journey cards and prompt Tips Edge writes under your own profile. An extension can't read a browser profile, so a separate companion app reads those files and answers over native messaging. It reads them on your machine and hands them to the page on your machine - nothing about them is sent anywhere.

Until you press Set it up, nothing is sent to the app at all, and the permission it needs is asked for at that moment rather than at install. Every other browser and platform never sees this section.

Some of Edge's Tips ask about your own tabs or your own recent reading. A card like that asks - separately, and only when you press it - for permission to read your open tabs, your history and the text of those pages, so it can write them into the prompt. Refusing leaves the card working with less. What you then send goes to the AI destination you chose, and nowhere else.

Counting installs

The extension reports five things to Google Analytics so there's some idea of how many people use it and what they use: a new tab opened, a search submitted, a prompt sent, the companion linked, and a control pressed. Alongside each one it sends the search engine or destination involved, the kind of card, and whether it worked - plus the extension's version, whether the browser is Microsoft Edge, and your browser's interface language.

"A control pressed" is every button and link on the page, and what it sends is the name the control was given in the source - "netlink_opened", "widget_toggled" - never the label you see. That distinction is the whole point: your netlinks are named after sites you chose and your categories after words you typed, so a report that described a button by what it says would be carrying your data out. Nothing derived from the page's text is ever sent, and a control with no name in the source sends nothing at all.

It counts against a random identifier generated on first use, which says "the same browser as last time" and nothing else. Your prompts, searches, netlinks, addresses and name are refused outright by the reporter - it drops anything named like that and any value that looks like a URL - and the advertising flags are set to denied, so none of it can become advertising data. Nothing is reported from a development or sideloaded build.

On Firefox, data collection is a permission you can refuse when you install, and refusing it stops the reporting entirely.

What avi12 receives

Nothing. avi12 runs no servers for this extension and receives no data from it: no settings, no netlinks, no prompts, no searches, no location, no account, no crash reports, no ads. The only third parties in the path are the ones named above, each for the one feature that needs it.

Children

Cyberpunk 2077 New Tab is not directed at children and collects nothing about anyone's identity.

Questions

Email contact@avi12.com, or open an issue at github.com/avi12/cyberpunk-2077-new-tab.