Blackbox Privacy Policy

Effective November 10, 2026

Blackbox is a Chrome extension that records supported web tabs on your device so you can restore a saved session after a crash or restart. It can also park idle tabs using Chrome's native tab-discard feature.

Information Blackbox uses

To record and restore a session, Blackbox reads and stores HTTP and HTTPS tab addresses and titles; tab order, pinned, active, discarded, and last-accessed state; window membership and focus; and tab-group names, colors, collapsed state, and membership. It also derives a broad tab category from the address. These details can reveal browsing activity.

Blackbox stores your idle-tab settings, seal names, times and tab/group/window counts, an optional passphrase hint, and an encrypted passphrase check. A keyed digest is used to avoid duplicate seals. The passphrase itself is not saved.

Local storage and encryption

Session contents are encrypted with AES-GCM in chrome.storage.local. The device key is also stored there, unencrypted, so Blackbox can restore without asking for a passphrase. Someone with access to your Chrome profile and its local extension data may be able to read the key and decrypt local seals. Seal names, times, counts, settings, and the optional hint remain readable in local storage.

You can download an optional .bbx backup encrypted with a passphrase. Backups created by this version contain only the format and key-derivation parameters, random salt and IV, and ciphertext; the session, hint, creation time, and counts are inside the ciphertext. New backups use PBKDF2-SHA-256 with 600,000 iterations and AES-GCM. Blackbox can still import older Blackbox backups with their original iteration count; older files may contain a readable hint and counts. Keep your passphrase and downloaded file safe; Blackbox cannot recover a lost passphrase.

Use, sharing, and retention

Blackbox uses this information only to record and restore sessions, park idle tabs, and operate the backup and settings features. It has no account, analytics, telemetry, advertising, or extension-initiated network requests. Blackbox does not upload session data or backup files, sell data, or share it with the developer or third parties. Restoring a web address causes Chrome to load that page in the usual way.

Blackbox keeps up to 20 recent seals and a separate recovery checkpoint on your device. You can remove the extension to remove its local extension storage. Downloaded backups remain wherever you saved them until you delete them.

Limited Use

Blackbox's use of information received through Chrome APIs follows the Chrome Web Store User Data Policy, including its Limited Use requirements. Browsing activity is used only for the user-facing session and tab features described above.

Contact

Questions about this policy: open an issue in the Blackbox privacy repository.