Privacy Policy — Nova
Last updated: October 2026 (Nova 3.0.0)
Nova (a new-tab homepage extension) was built with a commitment to privacy. This document explains exactly what data is stored, what network requests are made, and which permissions the extension asks for.
Guiding principle
All of your personal data is stored locally on your own device only, via chrome.storage, IndexedDB and the backup files you choose to create. We do not run any servers, we do not collect data, and we have no access to any of your information. There is no analytics, no tracking, and no advertising.
Data stored locally
Your settings, tasks (including projects, tags and status), notes, links, habits, mood and water entries, your personal journal and goals, the statistics history behind the productivity hub, saved themes, profiles and preferences are stored in chrome.storage.local on your device. A background image you upload from your computer is stored in the extension's IndexedDB.
If you enable sync (off by default), your settings only are synced through Google's chrome.storage.sync — between your own browsers, under your own Google account. Tasks, notes, journal, goals and the rest of your data are not synced.
A PIN lock (for the whole screen or for a single note) stores a hash (SHA-256) of the code on your device. It is privacy against a casual glance, not encryption: the text itself is stored as usual.
Backups
- Manual export — a JSON file that you save yourself. You can protect it with a password (AES-256-GCM, entirely local). The copy/paste transfer code and the shareable day-summary image are also created locally. None of this is sent to us.
- Automatic folder backup (optional, new in 3.0) — you pick a folder in the browser's folder picker. Nova saves one file per day,
nova-backup-YYYY-MM-DD.json, keeps the latest 7, and does not touch any other file. These files are not encrypted and contain your data (tasks, notes, journal, settings), so choose a private folder. If that folder is synced by a cloud service you use (Google Drive, Dropbox, …), that service uploads it; Nova itself uploads nothing. The folder reference is kept in the browser (IndexedDB). Chrome may ask you to allow access again after a restart. You can stop the backup at any time in Settings, and the extension forgets the folder.
On-device AI (optional, new in 3.0)
Nova can use Chrome's built-in AI (the Prompt API and the Summarizer) to polish the daily briefing, summarize a note and add a task from free text. These models run on your device, inside Chrome. The text you process (the task you typed, the note, or the briefing built from your tasks and events) goes only to your own browser — not to a Nova server and not to any other server on our behalf. Nova does not download a model by itself: Chrome does, only after you explicitly click a download button in Settings, and that download is governed by Google's and Chrome's own policies. You can turn these features off in Settings. The "smart add" (detecting dates and priorities in text) is plain local code with no AI.
Network requests
The extension only contacts external services when needed, for features you've turned on:
| Service | When it's used | What's sent | Their policy |
|---|---|---|---|
| Open-Meteo | Weather widget | Coordinates or city name | open-meteo.com |
| CoinGecko | Only if the crypto ticker is enabled | Coin IDs (no personal data) | coingecko.com |
| DuckDuckGo | Only if search suggestions are enabled | Search text as you type | duckduckgo.com |
Frankfurter (api.frankfurter.app) |
Only if currency conversion in search is enabled | The two currency codes (for example USD and EUR), no amounts | frankfurter.app |
| Stooq | Only if the stocks widget is enabled | The ticker symbols you entered | stooq.com |
Wikipedia (en.wikipedia.org) |
Only if "On this day" is enabled | The current month and day | wikimedia.org |
Picsum (picsum.photos) |
Only if you choose the "photo of the day" background | A daily image identifier | picsum.photos |
| Google Fonts | Only if you choose a custom font | The font name you entered | policies.google.com |
| Addresses you enter yourself | News (RSS/Atom), upcoming calendar (.ics), or a background image from a URL |
An ordinary request to that address, sent directly from your browser | Up to the owner of that address |
All requests are encrypted (HTTPS) and sent directly from your browser, never through us. As with any network request, the service sees your IP address and ordinary browser details. Every one of these features can be turned off from Settings.
Permissions and how they're used
storage— store your settings and data locally.geolocation— location for the weather widget (you can enter a city manually instead).favicon— display site icons locally, with no external request.alarms— local background alerts: the end of a Pomodoro session, and reminders for habits and tasks that you gave a reminder time. No other use.
Optional permissions (requested only when you turn the feature on, not at install time):
topSites— suggest quick links from your most-visited sites (read locally only).bookmarks— show bookmarks in the quick-access panel (read locally only).sessions— show recently closed tabs (read locally only).tabs— search across your open tabs: titles and addresses are read locally to show matches and to switch to the tab you pick.notifications— system notifications for a finished Pomodoro and for the reminders you set.- Access to
api.coingecko.com,api.frankfurter.app,stooq.comanden.wikipedia.org— requested only when you turn on the matching feature in the table above.
Data read from topSites/bookmarks/sessions/tabs is never transmitted anywhere — it is used only to display it on the page.
Security
The extension uses a strict Content Security Policy (script-src 'self'), runs no dynamic code (no eval), and is protected against XSS and prototype pollution. Content that comes from AI or from an outside address is treated as untrusted input: AI output is validated and cleaned, and text from outside addresses (news, calendar) is shown as plain text only.
Contact
For privacy questions, please open an issue in this repository.