Privacy Policy

1. Your dashboard, local by default

Offline Start Page (OSP) replaces Chrome’s New Tab page with a customizable dashboard. No developer account is required. This policy describes version 1.0.27 and this official website.

Dashboard pages, shortcuts, notes, Offline Tasks, layout and preferences are stored in Chrome extension storage on your device. Local storage can also contain RSS URLs, cached feeds and read state, weather locations and forecasts, icon caches, local usage counts for Smart widgets, integration settings, and recovery snapshots.

The extension has no developer-operated backend that receives dashboard content, advertising, profiling or analytics. Optional network features send requests directly to their providers. Local storage is not represented as encrypted.

2. Google user data access and use

Google Tasks is optional. When you choose Connect in a Google Tasks widget, OSP asks Chrome Identity for the single read-only scope below. This scope permits reading your Google Tasks lists and tasks; OSP does not request permission to create, edit, complete or delete them.

Account identity: Chrome Identity provides the connected Chrome profile’s Google account ID and email address, if available. OSP uses the ID to bind the connection and its caches to that account and detect account changes; it shows the email so you can identify the connected account. OSP stores the ID, email and connected service name in Chrome extension storage on this device.

Task lists: OSP receives list records from the Google Tasks API so you can choose a list. It uses list IDs and titles to populate that choice and keeps fetched list names and your selected list IDs locally. Google may return other list metadata in the API response; OSP does not save that extra list metadata in its dedicated list-name cache.

Tasks: When a selected list is refreshed, OSP receives its task records from Google. It displays tasks and caches these fields locally for offline viewing: task ID, title, notes, status, due and completion dates, parent ID, position, update time, ETag, and hidden/assigned indicators. Titles and notes are shown to you; status, dates, hierarchy and order support the widget’s read-only display. The account and list IDs associate each cache with the correct account and list. The API may include other response fields; OSP stores only the listed fields in its dedicated task cache.

OSP uses these data only to connect the account, let you select a list, display its tasks and show the local offline copy. The developer does not operate a server that receives your Google Tasks content.

3. Google user data sharing, transfers and disclosures

When you connect or refresh, Chrome Identity handles Google authorization and account identity. The extension sends the OAuth access token in an Authorization header directly to tasks.googleapis.com and receives list/task responses directly from Google into your browser. Google and Chrome therefore process the account and request data needed for authorization and the Tasks API. Google may receive ordinary request information such as your IP address, request headers and timestamps.

OSP does not automatically send Google task titles, notes, list names, cached task records, account email or account ID to the developer, advertisers, data brokers, analytics services, calendar hosts, RSS feeds, weather providers or icon providers. It does not sell or broker Google user data or disclose it to other people through an OSP service.

If you explicitly enable OSP’s optional Chrome Sync, OSP transfers supported dashboard settings through Google’s Chrome Sync service. A selected Google task-list ID and widget display settings may be in that payload; Google task content, fetched list names, account email/ID, OAuth tokens and dedicated task caches are excluded. OSP-generated JSON dashboard exports, local automatic backups and revision backups also exclude that fetched content and identity information, although an opaque selected list ID and user-entered widget title/settings can remain. If you manually copy task details into an ordinary note, title or link, those user-entered fields follow the normal dashboard Sync/export rules.

Other connected features make their own requests as described below; they are not fed Google Tasks API responses. If you choose to share information yourself, such as by copying task text or emailing support, that disclosure is under your control.

4. Google user data protection and security

In transit: OSP calls the Google Tasks API at an HTTPS address, so the browser uses TLS for the connection to Google. The access token is sent in the request Authorization header. Tasks requests use cache: no-store to avoid relying on the browser’s HTTP cache; OSP separately maintains the local offline cache described here.

Tokens and local storage: Chrome Identity manages its cached OAuth tokens. OSP temporarily handles an access token in its extension worker to call Google, but does not write it to its dashboard data, Chrome Sync payload, JSON exports or revision backups. The account binding, fetched list names, selected-list metadata and task caches are written to chrome.storage.local, Chrome’s extension-specific storage in your browser profile. This separates them from ordinary website storage. OSP does not add its own encryption at rest or guarantee that the browser profile, operating system, device backups or someone with access to your device cannot read local data. Protect your device and browser profile.

Data minimization and account checks: OSP requests only the Tasks read-only scope, saves a reduced task cache, excludes fetched Google content and account identity from OSP’s Sync/export/revision paths, and checks the current Chrome profile ID before using a saved connection or committing a refreshed cache. The dashboard accepts cached tasks only when their account and list IDs match the connected account and selected list; stale in-flight responses are discarded. These checks prevent ordinary account-switch races, but do not protect a compromised browser profile or device.

Disconnect and retention: When you disconnect, OSP removes the account binding and all OSP Google Tasks caches, fetched list names and selected-list metadata from local extension storage, even if Chrome reports a token-cache clearing error. If an error appears, check the connection state. If no other OSP Google service uses the connection, OSP asks Chrome Identity to clear its cached authorization tokens. Clearing a browser token cache does not revoke Google’s account-level authorization or guarantee that previously issued tokens or copies elsewhere are permanently deleted. To revoke the grant, remove OSP in your Google Account’s third-party connections settings. An opaque list ID may remain in widget settings until the widget is removed. If your Chrome profile account changes, OSP blocks the previous account’s Tasks display and removes its saved Google Tasks cache, list names and selection metadata the next time the extension handles a Tasks request or status check. Until that check runs, old local records can remain on disk. The connected account’s local task cache remains available offline across browser and service-worker restarts until it is refreshed, the account changes, you disconnect, or extension storage is removed. Device backups and data already copied outside OSP must be managed separately.

5. Google API Services User Data Policy and Limited Use

OSP’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. The Google Tasks data and data derived from it are used only to provide or improve the visible, user-requested Tasks widget, its offline display and connection management. OSP does not use or transfer them for advertising, retargeting, profiling, data brokerage, information resale, creditworthiness, lending, unrelated services or AI model training. The developer does not have routine human access to task content through an OSP server.

6. Calendar subscriptions (ICS)

Calendar widgets read user-provided HTTPS ICS subscription URLs directly from the selected calendar host. They do not use Google Calendar API or Microsoft Graph. OSP requests permission for the selected host, fetches without cookies or other request credentials, rejects redirects, and parses events locally. A secret embedded in the URL is still sent to that host.

A private subscription URL can act as a bearer credential: anyone with the URL may be able to read the calendar. Treat it like a password. OSP stores the source URL and an upcoming-event cache locally, including event identifiers, titles, times, dates, notes/descriptions and recurrence information.

Calendar source URLs and fetched events/notes are excluded from Chrome Sync, dashboard JSON exports and revision backups. Disconnecting a calendar removes that widget’s source URL and cache; OSP also attempts to release the host permission if no other OSP calendar uses it. This does not cancel the subscription URL at the provider. To invalidate a leaked link, reset or revoke it with the calendar provider.

7. Other network features

• RSS/Atom: downloads feeds from providers you select and caches content and read state locally.
• Weather: sends your entered place name to Open-Meteo geocoding and the resulting coordinates to its forecast service. OSP does not request device geolocation.
• Icons: uses Chrome’s favicon cache, Google’s favicon service, saved websites and user-approved icon sources. Requests can disclose a saved site’s origin/domain. User-requested icon discovery can read matching open tabs and use an existing signed-in site session for same-site resources.
• Saving open tabs reads tab titles and URLs when you invoke that feature. Local Smart-widget usage counts help organize shortcuts.
• Opening a shortcut or article, or submitting a dashboard search, sends you to the selected website or search provider.

Google Identity, Google Tasks, calendar hosts, feed providers, Open-Meteo and icon providers may receive ordinary request information such as your IP address, request headers, requested URLs and timestamps. Their own privacy and retention policies apply.

8. Optional Chrome Sync

Chrome Sync is off by default. When you enable it, supported dashboard data is uploaded to your Chrome Sync storage through Google. This can include pages, shortcuts, notes, Offline Tasks, layout, widget titles and settings, feed URLs and read state, and weather preferences.

Google account connection data, OAuth tokens, Google task content and fetched list names, calendar source URLs and events, fetched RSS/weather caches and custom/discovered icon bytes are excluded from the Sync payload. An opaque Google task-list ID and display settings can remain. User-entered titles, notes or links remain ordinary dashboard content even if you manually copy sensitive information into them.

Chrome Sync is subject to Google’s terms and privacy policies. Turning it off stops OSP synchronization; it does not by itself promise deletion of previous cloud copies or data on other devices.

9. Backups and recovery

OSP supports local recovery snapshots, revision history, optional scheduled local backups and user-requested JSON downloads/imports. Backups can contain dashboard content such as notes, shortcuts, feed URLs, widget titles and ordinary cached data. The special exclusions for Google Tasks content, fetched list names, account credentials, calendar source URLs and fetched events also apply to OSP-generated dashboard backups, exports and revisions. Display settings and the opaque task-list ID can remain.

These exclusions do not remove sensitive text you manually enter elsewhere in the dashboard. Downloaded files, imported older backups and device/browser backups may retain other copies. Keep backup files private and remove obsolete copies yourself.

10. Retention and deletion

Local information and caches remain until refreshed, replaced or removed through the relevant feature. Use integration Disconnect controls to clear their local connection/cache data, delete unwanted dashboard content, and manage local revision history and backups. Removing a widget is not a guarantee that all previous backups or service-side data are erased.

Chrome normally removes extension storage when you uninstall the extension, subject to Chrome behavior and device backups. OSP cannot erase downloaded/shared files, provider records, previously synchronized copies or other devices’ backups. Manage those separately through Chrome/Google, your providers and your device’s backup tools. For support requests sent by email, your email provider and ours process the message; avoid sending private calendar links, tokens or task content.

11. Browser permissions

• storage / unlimitedStorage: local dashboard data, caches, icons and backups.
• alarms: scheduled backups and Sync maintenance.
• favicon: Chrome’s favicon cache.
• tabs: saving open tabs and matching tabs during user-requested icon discovery.
• scripting: reading icon information from a matching tab when requested.
• identity / identity.email: Google Tasks authorization and account identification.
• Required host access: Google Tasks API and Open-Meteo forecast/geocoding services.
• Optional HTTP/HTTPS host access: requested for specific origins needed by user-selected feeds, calendars or icon discovery, rather than blanket optional access on installation.

12. This website

This static website has no analytics, advertising, forms, cookies set by its code, external fonts, Google sign-in or application scripts. Your browser requests the pages and local assets from our hosting provider. Hosting infrastructure may keep ordinary access/security logs containing IP addresses, requested paths and timestamps; actual logging and retention depend on hosting configuration. Clicking an external link takes you to that provider’s site.

13. Changes and contact

We will update this policy when data handling changes and revise the date above. For privacy questions or support, email info@zira3a.net.