Tabatha Privacy Policy

Effective date: 2026-07-21

This Privacy Policy describes how Duck & Shark ("we," "us") collects, uses, and discloses information in connection with Tabatha — the browser extension, the desktop companion and other companion applications, the mobile and web applications, and our websites (together, "the Services"). By installing or using the Services, you agree to the practices described here.

Information we collect

• Account information — email address, name, sign-in identifiers, and organization or team membership associated with your account.
• Activity data — the titles and addresses (URLs) of tabs you open; the timing of your sessions (focus sessions, clock in/out, breaks, idle state); the contexts, intents, labels, tasks, and notes you enter; and your settings and preferences.
• Device and technical data — browser and device type, device names you assign, installation and device identifiers, version information, and diagnostic and log data generated by the Services.
• Companion application data — if you install a companion application, the name of the application and window in the foreground, for time attribution across your apps.
• Optional features — some features, when you enable them, process additional data. What a feature processes is described where you turn it on.
• Communications — feedback, support requests, and information you submit through our websites.

In standard operation the Services record browsing metadata — titles, addresses, and timing — not the body content of pages, and they do not log keystrokes.

How we use information

We use the information we collect to provide, operate, maintain, and secure the Services; to sync your data across your signed-in devices; to develop and improve the Services and their features; to provide support and respond to you; to communicate with you about the Services; to detect and prevent fraud, abuse, and security incidents; to enforce our terms; to comply with legal obligations; and for any other purpose described to you at the time of collection or with your consent.

How we disclose information

• Service providers — vendors that host and process data on our behalf (such as cloud hosting and infrastructure providers), bound to use it only to provide services to us.
• Your organization — see the next section.
• Legal and safety — where required by law or legal process, or where necessary to protect the rights, property, or safety of us, our users, or others, or to enforce our agreements.
• Business transfers — in connection with a merger, acquisition, financing, or sale of all or part of our business, information may be transferred as part of that transaction.
• At your direction — when you ask us to share something or consent to a disclosure.

We do not sell personal information. We do not use or transfer it to determine creditworthiness or for lending purposes.

Organization accounts

If you use the Services through an organization — for example, your account was created with an organization invite, your device is managed by an organization, or your organization provisioned the Services for you — then:

• The organization may administer your account and may access information associated with your organizational use of the Services, including activity, time, and context data connected to the organization and device management state.
• That information is the organization's business data. Making it available to your own organization is part of how the Services function and is not a sale of your information or a disclosure to an unrelated third party.
• How your organization collects, uses, retains, and shares that information is governed by your organization's own policies and agreements, not by this policy, and we are not responsible for your organization's practices. Direct questions or requests about organization-managed data to your administrator.
• Where we process information at an organization's direction, we do so on the organization's behalf.

Retention

We retain information for as long as your account is active and as needed for the purposes described above. We may retain information longer where reasonably necessary to comply with legal obligations, resolve disputes, enforce agreements, or maintain security, and we may retain and use aggregated or de-identified information that does not identify you.

Security

We use reasonable administrative, technical, and organizational measures to protect information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Your choices

Signing out or removing the Services from a device stops further collection from that device. You may request access to, correction of, or deletion of your personal information by using the tools in your account or contacting us below; requests concerning organization-managed data may need to be made through your organization. We may decline or limit requests where permitted or required by law.

Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. Updates take effect when posted here with a new effective date. Your continued use of the Services after an update means you accept the updated policy.

Contact

Questions or requests about your information:

[caspera@duckandshark.com](mailto:caspera@duckandshark.com) (Duck & Shark)

This policy covers the Tabatha browser extension, companion applications, mobile and web applications, and our websites.