Privacy Policy

Last updated 15 July 2026

Lidless keeps your open browser tabs in sync across your own devices. It is built to be zero-knowledge about your tabs: the URLs and titles you sync are encrypted on your device before they leave it, and our servers only ever store ciphertext they cannot read. This policy explains, plainly, the small amount of data that is handled and why.

1. Your tab data (the sync content)

The tab URLs, titles, and ordering you sync are end-to-end encrypted on your device with a key that never leaves your control. Our backend stores only the resulting ciphertext and cannot decrypt it — no operator, administrator, or server process can read your tabs. We do not profile, sell, or share this data because we cannot read it in the first place.

2. Account data (only if you create an account)

Accounts are optional — Lidless syncs fine without one. If you choose to create an account (for recovery and premium features), we store the following in readable form:

• Email address — to identify your account, send verification and password-reset codes, and contact you about your subscription.
• Login metadata — account creation and update timestamps, email-verification status, and the network (IP) address our hosting provider observes when you make a request.
• Subscription status — your plan and whether it is active, so premium features unlock.

We never receive or store your password. Authentication uses a zero-knowledge scheme: your device derives a verifier that cannot be reversed into your password, and the encrypted backup of your sync key is protected by that password on your device, not by us.

3. Payments

Subscription payments are processed by Stripe. Lidless never sees or stores your card number or payment details — those are entered directly with Stripe. We store only a Stripe customer identifier and your subscription status. See Stripe's privacy policy.

4. Service providers (sub-processors)

• Cloudflare — hosting, storage of the encrypted sync data and account records, and network delivery. Policy.
• Brevo — sending transactional email (verification and password-reset codes). Policy.
• Stripe — payment processing. Policy.

5. Data location & retention

Encrypted sync data and account records are stored in Cloudflare's European region. We keep your encrypted sync data and account record for as long as your account exists. Short-lived items (email verification and reset codes, pairing hand-offs) expire automatically within minutes to hours.

6. Deleting your data

You can delete your account at any time from the extension's settings (Account → Delete account). This permanently removes your account record and its encrypted key backup from our servers. Your tabs continue to sync between devices that already hold your sync key locally, because that key was never ours to remove. To stop syncing entirely, remove the extension or use Leave sync on each device.

7. Your rights

If you are in the EU/EEA or UK, you have the right to access, correct, export, or erase your personal data, and to object to or restrict its processing. Because we cannot read your tab data, most of these rights concern your account email and subscription record, which you can view and delete yourself in the extension. The data controller is the operator of Lidless, reachable at privacy@lidless.io. Our legal basis is performance of the service you request (your account) and our legitimate interest in operating and securing it. To exercise a right or raise a concern, contact us below.

8. Children

Lidless is not directed to children under 16 and we do not knowingly collect their data.

9. Changes

We may update this policy; material changes will be reflected by the "Last updated" date above and, where appropriate, announced in the extension.

10. Contact

Questions or requests: privacy@lidless.io.