Nova New Tab - Privacy Policy

1. Overview

Nova New Tab ("the Extension", "we", "us", or "our") respects your privacy. The core purpose of this extension is to replace the browser's default new tab page and provide a customizable homepage experience, including theme customization, shortcut management, widgets (weather, notes, clock, countdown, calendar, calculator, search), AI wallpaper generation, Creative Center community, and Negative Screen (news, game discounts, concerts, deals, tools).

Our Commitments:

We NEVER collect any personally identifiable information (PII such as real name, ID number, phone number — email and phone provided at login are used solely for account authentication).
We NEVER collect your browsing history, visited website content, or passwords.
We NEVER sell user data to any third party.
Notes data is stored locally by default. If you sign in and use cloud backup, notes text and todo data may be included in your cloud page-configuration snapshot.
All your personal configurations (themes, layouts, settings, shortcuts, etc.) are stored locally by default. Automatic cloud backup is enabled by default after login; when enabled, page configuration snapshots are synced to your account. You can turn it off under “Profile → Cloud Backup”.

2. Data We Collect and How We Use It

The table below lists all types of data collected or processed by this extension, along with collection methods, purposes, and sharing status:

Data Type	Collection Method	Purpose	Shared with Third Parties?
Account Information (email, phone number, username, avatar)	Provided voluntarily by user during registration/login	User authentication, account management, community interaction	No. Stored only on our self-hosted server (api.novatab.cn)
Login Token (JWT Token)	Generated after successful login, stored in browser localStorage	API request authentication, maintaining login session	No. Stored locally only, not shared
Cloud backup page-configuration snapshot (base64 string)	Automatically synced after login (enabled by default), or manually triggered by the user from “Cloud Backup”	Restore page configuration across devices. A snapshot may contain themes, layouts, settings, shortcuts, notes text and todo data, operation logs, wallpaper history, and other page configuration, but does not contain passwords, tokens, or device fingerprints	Stored only on our self-hosted server (api.novatab.cn); not shared with third parties or publicly displayed
Random Device Identifier (fp, random UUID)	Generated via `crypto.randomUUID()`, stored in localStorage	Unique visitor counting (UV), distinguishing anonymous users. Contains no device hardware information	Sent to our self-hosted analytics server (rp.novatab.cn), not shared with any third party
Browser Information (type, version, OS, screen resolution)	Automatically obtained via User-Agent and window.screen	Browser compatibility analysis, UI design optimization	Sent to our self-hosted analytics server (rp.novatab.cn), not shared with any third party
Channel Information (Web / Chrome Extension / Edge Extension)	Auto-detected	Per-channel usage statistics	Sent to our self-hosted analytics server (rp.novatab.cn), not shared with any third party
Interaction Events (feature usage event names, labels)	Triggered by user actions	Feature usage frequency analysis, product optimization. Does not include specific input content	Sent to our self-hosted analytics server (rp.novatab.cn), not shared with any third party
AI Prompts	Actively entered by user	Forwarded via api.novatab.cn to OpenAI GPT Image 2 model for wallpaper generation. We do not retain prompt history	Forwarded to OpenAI through our server. OpenAI acts as a data processor subject to its own privacy policy
AI Reference Images	Actively uploaded by user	Reference material for AI wallpaper generation. JPEG-compressed (quality 0.8) client-side, marked as private	Uploaded directly to Alibaba Cloud OSS. Used only for AI generation, not shared with others
AI Generated Images	Generated by AI model, stored in cloud OSS	User can view, download, and manage in "My AI Creations". Optionally share to community	Only shared publicly when user actively shares to Creative Center. Otherwise not shared
Community Shared Content (title, description, tags, theme config, layout)	Actively submitted by user	Creative Center wallpaper/theme/layout sharing functionality	Publicly shared works visible to all Creative Center users. Private sharing accessible via temporary key link (24h validity)
Search Queries	User types in search box	Sent to user's selected search engine to perform search	Sent directly to user-chosen search engine (e.g., Baidu, Google, Bing). We do not record search queries on our servers
Weather City Preference	User manually selects or auto location	Fetch weather forecast for the corresponding city	Optional city ID sent to i.tianqi.com for weather data. Does NOT send IP, device info, etc.
Web Version Changelog Read Status	Auto-recorded	Mark whether user has read the latest changelog	No. Stored locally only
UX Prompt Status (first-use tour, screen notice, voice notice, etc.)	Auto-recorded	Control display frequency of various onboarding prompts to avoid repeated interruptions	No. Stored locally only

3. Data We NEVER Collect

Browsing history — We do not track which websites you visit
Visited website content — We do not read any webpage DOM content
Account passwords — The login token is a session identifier, not a password
Personally Identifiable Information — Real name, ID number, bank card number, etc.
Cookies or other tracking technologies — We do not use any cross-site tracking
Precise geolocation — Weather auto-location is determined by a third-party weather service based on IP; we do not access your location
Behavioral analytics data — Mouse movement trails, scroll behavior, etc.
Device local data (contacts, calendar, photos) — Unless you actively upload via Notes

4. Local Data Storage

A significant amount of data is stored on your local device (browser localStorage / IndexedDB). When you are logged out or cloud backup is disabled, page configuration remains local. When automatic cloud backup is enabled or you manually upload a backup, the whitelisted page configuration is encoded as a base64 snapshot and sent to api.novatab.cn.

4.1 localStorage (Approximately 40 Configuration Keys)

The following data is stored locally first; items noted below may be included in a cloud snapshot when cloud backup is enabled:

settings — Global settings (dock height, link opening mode, font size, etc.)
mainArea — Main area layout (all shortcuts, folders, widget positions and configurations)
theme / themeCreator — Current theme configuration + Creative Center theme cache (max 50 items)
customLinkIcons — Custom link icon mappings
background / wallpaperHistory — Wallpaper configuration and usage history
envMode — Environment mode snapshots ("Default", "Minimal", "Entertainment" etc.)
noteData — All notes text and todo data; included in the page configuration snapshot when cloud backup is enabled
search / hideDefaultEngines / customEnginesIcon / searchSettings / search-engine-key — Search config and history
recommendWords — Recommended search words cache (fetched from server once daily)
fp — Random device fingerprint UUID
token — Login session JWT Token
channel / env / exVersion — Channel/environment/version identifiers
logs — User operation logs (for troubleshooting); included in the page configuration snapshot when cloud backup is enabled
Cloud backup control data — Automatic-sync status, version baselines, fingerprints, and restore undo snapshots. Stored only in the current browser and not included in cloud snapshots.
migrationDone — Data migration completion flag
Approximately 20 UI state flags (onboarding prompts, display counts, etc.)

4.2 IndexedDB Storage

Notes Attachments (images, videos, files) — Local only, NEVER uploaded to server
Custom Link Icons — User-uploaded shortcut icons, marked as permanent

Auto-cleanup: IndexedDB files not accessed for 30 days are automatically cleaned up 3 seconds after page load. Storage Quota Protection: Before storing new files, the system checks the browser storage quota and refuses to save if insufficient space.

5. Data Sharing and Third-Party Services

5.1 Who We Share Data With

We do NOT sell your personal data to any third party. The following are the only data sharing scenarios:

Recipient	Data Shared	Purpose	Data Type
OpenAI (United States)	AI prompt text, reference image URLs	AI wallpaper generation (GPT Image 2 model)	Transmitted when user actively triggers
Tianqi / HeFeng Weather (China)	City ID (optional)	Fetch weather forecast data	Transmitted when user uses weather widget
Alibaba Cloud OSS (China)	User-uploaded file content	File storage (avatars, wallpapers, AI generated images, etc.)	Transmitted when user actively uploads
Nova self-hosted server (China, api.novatab.cn)	User-selected page-configuration base64 snapshots	Cloud backup and cross-device restore	Transmitted according to automatic-sync settings or manual user actions after login; not publicly displayed
Baidu (China)	Search keywords	Search suggestion autocomplete (sugrec API)	Transmitted when user uses Baidu search
User-selected search engines	Search keywords	Perform search	Transmitted when user initiates search

5.2 Self-Hosted Servers

Our self-hosted servers used to provide core services and analytics:

api.novatab.cn — Core API (user authentication, cloud backup, wallpaper management, AI generation, community sharing, etc.)
res.novatab.cn — CDN resources (wallpaper images, CSS, JS, etc.)
oss.novatab.cn — Alibaba Cloud OSS reverse proxy
rp.novatab.cn — Self-hosted analytics server (receives only anonymous technical data, no personally identifiable information)

All communications are encrypted via HTTPS.

6. International Data Transfers

This extension involves the following cross-border data transfers:

OpenAI (United States): When generating AI wallpapers, your prompts and reference image URLs are forwarded from our server (China) to OpenAI's servers in the United States for processing. OpenAI's data processing is subject to its own privacy policy.
Alibaba Cloud OSS (China): User-uploaded files are stored on Alibaba Cloud OSS nodes located in mainland China.
Search engines (depending on user choice): Search queries may be sent to search engine servers in different countries (e.g., Google in the United States).

We implement appropriate safeguards (HTTPS encryption, data minimization) for cross-border data transfers and require data processors to comply with applicable data protection laws.

7. Data Retention and Deletion

7.1 Server-Side Data Retention Periods

Data Type	Retention Period
User account information (email, phone, username, avatar)	Retained until account deletion or deletion request. Permanently deleted within 30 days after account deletion.
Login session token (JWT)	Automatically expires after token validity period, or immediately cleared upon logout.
AI generated images	Retained until user proactively deletes. Users can delete at any time from "My AI Creations".
Community shared content	Retained until user proactively deletes or unshares.
Cloud backup page configuration	At most the latest three calendar days per user. A new backup on the same day replaces that day’s data; when a fourth date is added, the oldest date is removed. Account deletion requests also include associated cloud backups.
Anonymous analytics data (rp.novatab.cn)	Aggregated data retained long-term for trend analysis; raw event data retained for 12 months then automatically anonymized.
Server logs (including IP addresses)	Retained for no more than 30 days for security auditing and troubleshooting.

7.2 Local Data Retention

localStorage and IndexedDB data is retained until manually cleared by user or extension uninstall.
IndexedDB files not accessed for 30 days are automatically cleaned up.
Uninstall to Delete: The browser automatically removes all extension-related local storage data upon uninstall.

7.3 How to Delete Your Data

Local data: Use browser developer tools (F12 → Application → Local Storage / IndexedDB) or uninstall the extension.
AI works: Delete from "My AI Creations".
Community shares: Edit or delete shared works from "My Shares".
Account data: Contact us at zhengbin7636@gmail.com to request account deletion and associated data removal.
Cloud backup: Under “Profile → Cloud Backup”, you can disable automatic sync, download backups, or restore a backup. Contact us to request deletion of cloud backups associated with your account.
Logout: Click "Log Out" to clear the local token.

8. Children's Privacy

This extension is not directed at children under 13. We do not knowingly collect personal information from children under 13. If we discover that personal information from a child under 13 has been inadvertently collected, we will delete it immediately. If you believe we may have collected information from a child under 13, please contact us at zhengbin7636@gmail.com.

9. Data Security

All network communications are encrypted via HTTPS.
User passwords are hashed server-side (bcrypt/argon2); the frontend never handles plaintext passwords.
API requests use JWT Bearer Token authentication with expiration.
File uploads use Alibaba Cloud OSS temporary STS signatures with short validity.
The analytics server only receives anonymous data containing no personally identifiable information.
Cloud backup APIs only allow the currently authenticated account to access its snapshots and use HTTPS in transit. Cloud backup values are base64-encoded; base64 is not encryption. Do not store sensitive information in page configuration if you do not want it uploaded to your account’s cloud storage.
Local configuration that is not backed up exists only in the browser. We do not collect sensitive personal information, so the risk of data leakage is low.

10. Permissions Usage (Chrome/Edge Extension Version)

Permission	Actual Use	Trigger
`storage`	Temporarily stores pending URLs from right-click "Add to Homepage", cleared immediately after page receives them	Right-click menu → Add to Homepage
`tabs`	Open/manage tabs, switch to newtab on extension icon click, redirect share links, get tab list	Clicking shortcuts, extension icon, share links
`bookmarks`	Read bookmark tree for "Import Bookmarks" feature	User actively clicks "Import Bookmarks" button
`contextMenus`	Add "Add to Homepage" option to right-click context menu	Right-click on page/link/image/video/selected text
`search`	Invoke browser default search engine (chrome.search.query)	User clicks "Browser Search" option in search box
`host_permissions (*.novatab.cn)`	Access API, CDN, OSS, analytics server	Automatically used during normal operation
`host_permissions (www.baidu.com)`	Fetch Baidu search suggestions (sugrec API)	When user uses Baidu search engine

11. User Control and Rights

Uninstall to Delete: Uninstalling the extension causes all local data to be automatically cleared by the browser.
Manual Clearing: Use browser developer tools to clear local data.
Log Out: Clears local token and interrupts API access.
Manage Shares: Edit or delete shared works from "My Shares".
Opt Out of Sharing: Works can be set to private.
Data Migration: Settings provide import/export functionality.
Search Engine Choice: Freely choose, add, delete search engines; clear search history.
Notes Backup: Manual export/import of notes data.
Cloud Backup: Under “Profile → Cloud Backup”, view, download, and restore backups, and turn off automatic sync at any time.
Account Deletion Request: Contact zhengbin7636@gmail.com to delete all account data.

12. Policy Updates

We may update this privacy policy to reflect feature changes or legal requirements. Updates will be posted on this page and reflected in the Chrome Web Store listing. Material changes will be communicated through version update notes. We recommend periodically reviewing this page.

13. Contact Us

If you have any questions, concerns, or complaints regarding this Privacy Policy, or wish to exercise your data rights (such as requesting account deletion), please contact us at:
Email: zhengbin7636@gmail.com