Privacy Policy

Last updated: October 2026 — applies to extension version 2.1.0 and later.

BBQOne is a Chrome extension for personal notes, bookmark backups, and a simple calendar. The extension runs in the extension popup and extension pages — it does not inject scripts into the pages you visit, does not read your browsing history, and does not ship any tracking or advertising code. This policy explains what data is stored, where, and what happens when you opt into cloud sync.

Local-first architecture

By default, BBQOne stores your data locally in your browser using chrome.storage.local. We do not collect, transmit, or store your content on remote servers unless you explicitly sign in for cloud sync.

This local data may include:

• Notes, note bodies, and folders (including Secure Folder contents)
• Bookmark backup snapshots and related settings
• Calendar events
• Extension preferences (theme, UI language, layout, banner dismissals)

Backup files. When you are not signed in, BBQOne can save a backup file of your notes, calendar events and bookmark backups to your computer's Downloads folder: when you click "Back up now" in Settings, and — unless you turn it off in Settings › Backup — automatically at most once a day when you open BBQOne and your data has changed (into Downloads/BBQOne, keeping the last 7 days). Before "Restore from file" replaces your data, a safety backup of the current data is saved the same way. These files stay on your computer and are never uploaded. Notes are stored in them as plain text, except notes in Secure Folders, which stay encrypted — keep backup files somewhere safe. When you restore, the file is read only on your device; its content is checked and cleaned before anything is replaced.

Address bar search. When you type bbq and a space in Chrome's address bar, the words you type next go only to BBQOne, which matches them against the notes already stored on your device. That text is not sent to any server — ours, Supabase, or Google — and is not stored. In Settings you can choose whether suggestions show a note's title and a short snippet or the title only, or turn address-bar search off.

In addition, BBQOne uses chrome.storage.session to hold the Supabase sign-in token (when you choose to sign in), short-lived keys used by Secure Folders, and — only for accounts that have account encryption turned on — the unlocked note key, which is discarded after 30 minutes of inactivity. chrome.storage.session data is kept in memory and is automatically cleared by Chrome when you close the browser.

What we do not track

• Your IP address
• Your browser fingerprint
• Your browsing history
• The pages you visit
• Your location
• Personal identity (name, address, phone number)
• Payment or financial information
• Any analytics or telemetry

Optional cloud sync (Supabase)

If you choose to sign in (Sign In from the dashboard), BBQOne can sync your data to a Supabase project. After signing in:

• Your data is stored under your account, protected server-side by Row Level Security (RLS) — only your authenticated user can access your own rows.
• You can sign out at any time. The extension continues to work in local mode after sign-out.

What is encrypted vs. stored as plaintext

Encryption-at-rest in the cloud applies only to specific feature surfaces:

• Secure Folder notes — notes (title, label, body) stored inside a passphrase-gated Secure Folder are encrypted on your device using AES-GCM before being sent to Supabase. The encryption key is derived from your passphrase and never leaves your device.
• Account encryption (accounts that turned it on in an earlier version) — note titles and contents are encrypted on your device with AES-GCM before upload, using a key protected by your passphrase and recovery key; neither leaves your device. The option to turn this on is temporarily not offered in Settings while we review it; accounts that already use it keep working as before.
• Other notes, folders, bookmark backups, and calendar events — stored as plaintext under your user account, isolated from other users by RLS. Encryption-at-rest at the database layer is provided by Supabase's infrastructure but is not end-to-end. (The former bookmark PIN was removed in version 2.0.0.) Calendar events are intentionally not end-to-end encrypted so that the optional Google Calendar link below can work.

All network transmission to Supabase uses HTTPS (TLS).

Optional Google Calendar link

In Settings › Google Calendar you can create a private link to your BBQOne calendar and add it to Google Calendar (Add calendar › From URL). This is one-way: Google Calendar only reads it.

• Creating the link stores a random secret token for your account in Supabase. The link is served by a Supabase Edge Function and returns your calendar events (title, description, date/time, done status) from about 90 days ago to about 400 days ahead, in iCalendar format.
• Anyone who has the link can read your calendar. Keep it private, and do not tick "Make the calendar publicly accessible" in Google Calendar.
• After you add the link, Google's servers fetch it on Google's own schedule, and Google's terms and privacy policy apply to the copy held by Google. BBQOne records only when the link was last fetched.
• You can create a new link (the old one stops working immediately) or turn the link off at any time. Supabase may keep standard request logs, including the link path, for operating the service.

Authentication credentials

When you opt to sign in, BBQOne uses Supabase Auth with email + password (no OAuth redirect, no chrome.identity permission). Your email and password are used only at the moment of sign-in. Passwords are never stored by the extension — Supabase handles password hashing and credential security on its side.

Optional two-step verification (version 2.3.0 and later). If you turn it on in Settings, Supabase Auth creates and keeps a TOTP secret for your account so it can check the 6-digit codes from your authenticator app. BBQOne shows that secret (as a QR code and as text you can copy) only while you set it up, and does not store it or send it anywhere else. The codes you type are sent only to Supabase Auth. While two-step verification is on, the server returns your synced data only after a valid code. Turning it off in Settings removes the secret.

No content scripts, no in-page features

BBQOne does not inject any content scripts into the pages you visit. It cannot read, modify, or observe the content of websites. All functionality runs inside the extension's own popup and background service worker.

Address bar search: after you type bbq and a space in Chrome's address bar, the text you type next is sent only to BBQOne (not to your search engine). BBQOne searches the notes stored on your device and never sends that text over the network.

How data is used

Your data is used exclusively to provide the core features of BBQOne. It is never sold, shared, or transferred to any third party for advertising, analytics, or any other purpose.

Data storage & security

Local mode (default): Application data is stored in chrome.storage.local, protected by Chrome's extension sandbox. Other extensions and ordinary websites cannot access this storage.

Cloud mode (opt-in): Data is stored in the Supabase backend configured for this build. Transmission uses HTTPS (TLS). Database access is gated by Row Level Security — your auth.uid() must match row ownership. Secure Folder notes (and notes of accounts with account encryption turned on) are additionally encrypted client-side with AES-GCM before upload.

Your rights

You can at any time:

• Delete or edit items through the extension UI
• Export your Chrome bookmark tree as an HTML file from the Bookmarks tab (file saved on your device using chrome.downloads)
• Sign out from cloud sync (the extension continues to work locally)
• Turn off or regenerate your Google Calendar link in Settings, and remove the calendar from Google Calendar
• Uninstall the extension to remove local extension data from this browser profile
• Delete or export your cloud data using your Supabase project / account tools

Third-party services

For this version of BBQOne, network access in normal use is limited to:

• Supabase (*.supabase.co) — Authentication and optional data sync. Triggered only after you sign in.
• Google Calendar — only if you add your Google Calendar link: Google's servers (not the extension) fetch the link from Supabase. Google's terms and privacy policy apply.

The Inter UI font is bundled with the extension, so no font requests leave your device. Without signing in, the extension makes no network requests.

The extension does not load remote scripts or remote code from any domain. It does not include content scripts on websites. It does not contact translation, dictionary, analytics, or advertising services.

Children's privacy

BBQOne is not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top will reflect the latest revision. Continued use of BBQOne after changes constitutes acceptance.

Contact

If you have any questions about this privacy policy, please contact hghungdev@gmail.com.