Last updated: October 29, 2026
Short version: Tabwren has no accounts, no analytics, no ads, no cookies and no trackers. Everything you type in the app stays in your browser on your device. We never receive it, so we cannot see, sell, share or lose it.
Tabwren ("we", "us") is an independent software product sold under the Dowel Pages studio brand. We are the controller for the small amount of personal data described in sections 5 and 6. Contact: dowelpages+tabwren@mail.grokbot.com (see also our Contact page).
Trip names, the names of people in your groups, expenses, payments, exchange rates and your Pro license key are saved only in your browser's local storage (keys named tabwren.v1 and tabwren.license). The app files are also cached on your device so it works offline. None of this is sent to us or to anyone else. This storage is strictly necessary to provide the app you asked to use, so no consent banner is needed and none is shown.
Other people's names: when you add friends to a group, you enter their names on your own device for your own personal use. Only add what is needed (a first name or nickname is enough) and share links only with the people in the group.
How to delete it: open the app → Settings → Delete all my data on this device. Clearing your browser's site data for tabwren.pages.dev also deletes it. Use Download backup first if you want to keep a copy; backups are files you control.
When you tap Copy share link, the app packs a read-only copy of that trip (names, expenses and amounts) into the link itself, after the # sign. Browsers do not send that part of a link to any server, so the trip is not uploaded to us or stored anywhere. Anyone who has the link can open it and read it, and the apps you send it through (messaging apps, email) handle it under their own policies. Share it only with your group. Opening a share link saves nothing unless the person taps Save a copy.
We do not use cookies, analytics, advertising, social media pixels, fingerprinting or any third-party scripts. We do not sell or share personal information, and we do not use it for targeted advertising or profiling. Because there is nothing to opt out of, Global Privacy Control and "Do Not Track" signals are automatically respected.
The website is served by Cloudflare (Cloudflare Pages). Like any web host, Cloudflare processes technical data such as IP address, browser type and the requested page to deliver the site and protect it from abuse, under its own privacy policy. We do not use these logs to identify you. Legal basis (EU/UK GDPR): our legitimate interest in running a secure website (Art. 6(1)(f)).
If you buy Pro, payment is handled by Stripe, which receives your card details, email and country under its own privacy policy. We never see your full card number. We receive the order record (email, amount, date, country, Stripe payment ID) to deliver your key, give refunds and keep the accounting and tax records the law requires. If you email us, we use your message only to reply. Legal bases: performance of a contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)).
Order records: as long as tax and accounting laws require (usually 5 to 10 years). Support emails: up to 24 months after the conversation ends, then deleted. App data: we never hold it.
Stripe and Cloudflare may process data in the United States and other countries. They use safeguards such as the EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework.
Depending on where you live (for example under the EU/UK GDPR, the LGPD, or California and other US state privacy laws) you can ask to access, correct, delete or receive a copy of your personal data, object to or restrict its use, and withdraw consent. Email dowelpages+tabwren@mail.grokbot.com; we reply within 30 days and will not treat you differently for asking. Data in the app is already fully under your control (see section 2). You can also complain to your local data protection authority.
Tabwren is not directed to children. You must be at least 16 to use it (18 to buy Pro). We do not knowingly collect data from children under 16; if you think a child sent us data, email us and we will delete it.
The site is served only over HTTPS with strict security headers (Content-Security-Policy, HSTS and others) and loads no third-party code. Because your app data never leaves your device, keep your device, backups and share links protected.
If we ever add anything that changes this (for example privacy-friendly analytics), we will update this page and the date above before it goes live, and ask for consent where the law requires it.