Whiskr privacy policy

Updated 23 October 2026 · version 1.0.0

Whiskr is a bookmark and tab-session manager by theSpider. Your library stays in this browser profile by default. There are no accounts, cloud synchronization, analytics or advertising. Optional public publishing sends only the space you explicitly choose to your configured sharing server.

Information on your device

Whiskr reads open-tab titles and URLs to display and save tabs. It stores saved links, titles, notes, tags, workspaces, spaces, collections, favourites, Next items, aliases, recent links opened from Whiskr, appearance preferences, and your optional local display name/avatar using Chrome extension-local storage. The sharing server address and publish key also stay in this storage. Website icons use Chrome's native favicon API. Whiskr does not read passwords, cookies or page content. Browser history is read only if you select History in search and grant its optional permission.

How information is used

Data is used to display, organize, search, save, group and reopen your links and sessions. Whiskr contains no remote executable code, telemetry or model-generation requests. It does not sell information, use it for advertising or creditworthiness, or upload your entire library automatically.

Optional public pages

A Public Space starts as a local draft. Pressing Publish uploads that space's name, collection names/descriptions, link titles, URLs and tags to the server you configured. Link notes are excluded unless you check Include link notes. Standalone notes, other spaces, local profile and Next list are excluded. Publication creates a snapshot; later local edits do not automatically update it. Anyone with the public URL can read the snapshot. The hosting operator can access stored snapshots and may process network information such as IP addresses according to its own practices. Choose a host you trust.

Revoke a public page before making its space private, changing servers or uninstalling Whiskr. Revocation removes the live snapshot from that server but cannot recall copies, downloads, screenshots or third-party caches. Published data remains on the host until revoked or removed by the hosting operator; its backups follow that operator's retention policy. HTTPS is required for remote sharing servers; HTTP is supported only on localhost for development.

Optional browser permissions

History search requests the history permission only when you select the History category. It searches the last 90 days and keeps results in memory while search is open; it does not upload browser history. Tab grouping requests the tabGroups permission. Side-panel mode requests sidePanel. Direct to/alias navigation requests declarativeNetRequestWithHostAccess and access only to http://to and https://to; the to/ omnibox keyword works without those redirects. Publishing requests access to the configured server origin. Declared optional HTTPS host patterns allow you to choose your own server; they do not grant access at installation. You can revoke permissions in browser extension settings. Configured GitHub sign-in asks for optional identity and API/exchange-origin access. Large imports may request optional unlimitedStorage. Usage pairing asks only for the chosen localhost origin.

Files, clipboard and feedback

Import reads only a chosen JSON, bookmark HTML or plain-text URL file. Export writes ordinary unencrypted JSON, HTML, TXT or Markdown files. JSON backups include library content, workspaces, Next, aliases and notes; they exclude sharing keys, publication tokens and your profile/avatar. Copy actions write selected text to your clipboard; Whiskr does not read your clipboard. Feedback opens an email draft in your mail application and does not send it automatically. Messages you choose to send are received at om.spider.dev@gmail.com and used to respond to support or product feedback.

Control, retention and deletion

You can edit or remove links and notes. Deleted collections remain in Trash until restored or permanently removed. Local data remains until deleted, the profile is removed or Whiskr is uninstalled. Keep backups before uninstalling. Exported files and public snapshots must be removed separately. Whiskr does not encrypt local library storage itself; your browser and operating system provide their usual protections.

Websites you open

Opening a saved link loads that website normally. Its own privacy practices apply. Incognito windows follow the browser's normal incognito rules and do not make saved library content private from other users of the same browser profile.

Optional repository activity

Repository pulse sends the public repository identifier and optional assignee username you choose to api.github.com when you select Save and load or Refresh. It reads open PRs, assigned issues and CI metadata; it does not edit repositories or read private code. Public reads require no token. Chrome API-origin permission is requested on demand. GitHub receives the request and network information under its own privacy practices.

Activity is cached in memory for five minutes, bounded to 20 repository/profile snapshots, and excluded from backups/public space snapshots. Project repository/assignee settings remain local and are included in JSON library backups. There is no continuous polling. Remove pulse to stop using this feature; revoke optional host access in Chrome settings if desired.

Optional developer integrations

Social links, project destinations, saved searches, recovery snapshots and AI usage readings are stored locally. Optional GitHub connection sends OAuth authorization to GitHub and a publisher-configured exchange endpoint, then reads identity and public repositories; session tokens are excluded from library exports. No GitHub OAuth app is preconfigured in this build.

The optional usage companion runs separately on your computer and accepts a paired extension origin. It reads supported CLI usage interfaces and returns percentages, reset times and timestamps. Claude's exporter discards prompts and other session data. Pairing keys are stored separately from library data. Whiskr does not transmit these readings to a Whiskr cloud service, and manual readings require no companion.

Limited Use

Whiskr's use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. Data is used only for the disclosed developer bookmark and session workflows.

Contact

Publisher: theSpider. Support and privacy questions: om.spider.dev@gmail.com. Website: whiskr.thespider.dev.

Whiskr help