WidgetBearPrivacy Policy
WidgetBear is a Chrome extension that replaces the new tab page. This policy explains what data it handles and where that data goes. In short: WidgetBear has no accounts, and, except for the Send files widget, no servers. What you save stays in your browser. The developer never receives your tabs, links, bookmarks, to-dos or calendar data. The Send files widget is the one exception, described in section 5.
1. Data stored on your device
The following is saved with Chrome's extension storage (chrome.storage.local) in your browser profile on your computer. It is not sent to the developer or any other server.
- Spaces, collections and saved links (URL, title, your notes and tags)
- To-dos and events you add by hand when Google Calendar is not connected
- Dashboard panels and what you put in them: notes, routines, timer settings, the name, birthday and gender you enter for Today's fortune, and secret memos. A secret memo is encrypted in your browser with a key made from its PIN (AES-GCM); the PIN itself is not stored.
- Settings: theme, language, which panels are shown, news feeds, keywords and calendar links you added
- Site usage, only if you add the "Site usage today" widget: how many seconds you spent on each website (its domain only, such as youtube.com, never the full address or page contents) per day, plus the daily limits and excluded sites you set. It is counted on your computer while a web page is in front, kept for 30 days by default (you can choose 7 to 90), and older days are deleted automatically. You can pause it or clear it any time from the widget, and it stops when no such widget is left. Incognito windows and browser pages are never counted.
- Short-lived caches so new tabs open quickly: news headlines (up to 30 minutes), calendar files from iCal links (up to 15 minutes), today's Google Calendar events (up to 5 minutes)
To delete this data, remove the extension from Chrome, or delete the items inside WidgetBear.
2. Permissions and why they are needed
| Permission | Used for |
|---|---|
| New tab page | Showing WidgetBear when you open a new tab. |
| Tabs | Listing the tabs open in the current window so you can save them, and opening saved links. If you add the "Site usage today" widget, also noting which site the tab in front is on, to count time per site on your device. Tab contents are never read. |
| Bookmarks | Showing and editing your Chrome bookmarks in the Bookmarks view, importing folders as collections, and saving collections as bookmark folders. Only when you use those features. |
| Storage, unlimited storage | Saving your data locally, as described in section 1. |
| Side panel | The panel that opens from the toolbar icon, for saving the page you're on to a collection. |
| Context menus | The "Save page to WidgetBear Inbox" and "Save all tabs as a collection" menu items. |
| Favicon | Showing site icons from Chrome's own icon cache. |
| Identity | Signing in to Google Calendar with Chrome's built-in Google sign-in, only if you choose to connect it. |
| Alarms, notifications (optional) | Water and stretch-break reminders. Asked for only when you turn reminders on in those widgets; without them the widgets still count and time everything. |
| Idle detection, alarms (optional) | The "Site usage today" widget. Asked for only when you add that widget: idle detection pauses the count while you're away from the computer, and an alarm saves it every minute. Nothing is counted without them, or once no such widget is on your dashboards. |
| Site access: news.google.com, calendar.google.com, outlook.office365.com, www.googleapis.com | Loading the default news feed, calendar links, and the Google Calendar API. Access to any other site is requested separately, only when you add a news feed or calendar link from that site. |
3. Google user data (Google Calendar)
Connecting Google Calendar is optional. If you connect it, WidgetBear asks Google for these permissions (OAuth scopes):
calendar.calendarlist.readonly: to list your calendars so you can choose which ones to show.calendar.events: to read today's events from the calendars you chose, and to create an event in your primary calendar when you add one in WidgetBear.
How the data is used
- Your browser requests data directly from Google. It is shown on your new tab page, and nowhere else.
- Event details (title, time, location, link) for today are cached in your browser for up to 5 minutes, then replaced. Nothing is stored on any server.
- WidgetBear only creates an event when you add one yourself. It never edits or deletes existing events.
- Google user data is not sold, not shared with third parties, not used for advertising, not used to train AI or machine learning models, and not read by people.
WidgetBear's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting
Open Settings in WidgetBear and choose "Disconnect Google Calendar". This revokes WidgetBear's access token. You can also remove access at any time from your Google Account under Security, Third-party apps and services (myaccount.google.com/connections).
4. Content from other sites
When WidgetBear loads a news feed or a calendar link, your browser connects directly to that site, which receives the request like any web visit (for example, your IP address). Those sites' own privacy policies apply. Links you open from WidgetBear open as normal browser tabs.
5. Send files widget
The "Send files" widget is the only part of WidgetBear that uses a server, and only when you use it to send files.
- Files go directly from your browser to the receiver's browser (WebRTC). They are never stored on our server.
- A connection server (widgetbear.jportal.cloud, with Upstash Redis) keeps the file names, sizes and types, plus connection details, for at most 5 minutes so the two browsers can find each other.
- When a direct connection is blocked, the data is relayed through a TURN relay server. It stays encrypted (WebRTC DTLS) and is not stored.
- Requests carry your IP address. It is used only for rate limiting and held for at most 10 minutes.
- The receiver does not need the extension or an account.
6. No analytics or advertising
The extension contains no analytics, crash reporting, advertising or tracking code, and sets no cookies. The Send files server does not use cookies either.
7. This website
This website is hosted on Vercel. Like any web host, Vercel may process basic request data such as IP addresses to deliver and protect the site. The website uses no analytics and no cookies.
8. Children
WidgetBear is not directed at children under 13 and does not knowingly collect their personal information.
9. Changes
If this policy changes, the new version will be posted here with a new effective date. Significant changes to how Google user data is used will be noted in the extension before they take effect.
10. Contact
Questions or requests: jimmyjin9197@gmail.com