Privacy Policy

Effective September 2, 2026

The short version

Tab needs information to do work for you, but access should stay narrow and understandable. We do not sell your personal information. We do not put passwords or card details in Messages. We separate sensitive credentials from the AI that plans your work, and we give you ways to access, correct, or delete your information.

Information we collect

Account and contact information

We collect the name and mobile number you provide, phone verification status, consent records, account status, referral information, signup source, and the dates associated with your account and waitlist activity.

Messages, files, and requests

Tab processes the messages and materials you send so it can understand and complete your request. This may include text, photos, screenshots, documents, audio, video, contact cards, locations, and links. We also process Tab’s replies, task status, files it creates for you, and delivery information.

Calls

If you ask Tab to place a call, we process the destination, the purpose and instructions for the call, its status, and its result. A call may include a transcript or recording only when the feature is configured to do so and applicable notice or consent requirements are addressed. When recording is off, we limit the retained result to the information needed to report what happened and operate the service.

Browser and connected-account activity

When you ask Tab to use a website or connected account, we process the pages, actions, and results needed for that request. We may retain limited browser session metadata, such as the site, page title, task, timestamps, and action receipts. Connected services show the account or workspace access they request before you connect them.

Purchases and wallet information

If wallet or checkout features are available to you, we process the merchant, items, recipient and shipping details, currency, amount, approval, checkout status, and receipt. Card enrollment uses a separate private flow. Tab’s core systems are designed to retain only an opaque card reference and limited display metadata such as the card label, brand, and last four digits, not the full card number or security code.

Technical, safety, and attribution information

We process limited technical information needed to secure and operate Tab, prevent abuse, diagnose failures, and understand how people find the service. This can include IP-derived region, browser and device information, timestamps, pages visited, anonymous visitor or session identifiers, UTM parameters, click identifiers, referral codes, and conversion information.

How we use information

• Provide Tab, complete the work you request, and return the result to you.
• Verify your phone, protect your account, and keep each user’s workspace separate.
• Operate browser, connected-account, calling, wallet, and checkout features when available.
• Show you the merchant, amount, recipient, and other important terms before an approved payment is submitted.
• Manage the waitlist and referral program. If a friend joins through your invite and completes verification, we may tell you the invite worked. We do not share your phone number with the inviter or their phone number with you.
• Send service, security, waitlist, and product communications you requested or agreed to receive.
• Detect fraud, enforce safety boundaries, investigate failures, and improve reliability.
• Comply with law and protect the rights, safety, and integrity of Tab, our users, and others.

We do not sell your personal information. We do not use your phone number to let an inviter identify you.

How sensitive information is handled

Passwords and website credentials

When Tab creates or remembers a website credential for you, the password is encrypted with AES-256-GCM authenticated encryption before it is stored. The credential is bound to your user, the website origin, and an account label. Tab’s planning AI receives an opaque credential reference, not the password. Decryption happens only inside the credential-filling boundary after the active user and website origin match. Passwords are not written into Messages, task transcripts, or ordinary action receipts.

Cards and security codes

Card details are entered through a private, time-limited enrollment link and sent to the isolated vault boundary, not through Messages. Tab’s main application is designed to receive only a safe card reference and limited display metadata. During an eligible checkout, the private payment boundary can release card details only for the exact bound transaction. Payment fields are masked from screenshots, the security code is filled last, and temporary payment authority is cleared after the attempt. Wallet and automated checkout features remain limited beta features and fail closed when the required private services are not healthy.

Tokens and connected services

Session, capability, and one-time-link tokens are scoped, expiring where appropriate, and stored as hashes when the original token does not need to be recovered. Provider credentials stay in server-side or provider-managed boundaries. The AI receives bounded results instead of raw access tokens, cookies, or provider secrets.

Read more about these controls in Security at Tab.

Tracking and attribution

We use Trybe to understand which creator or campaign introduced a visitor to Tab. Trybe may use a first-party cookie and process anonymous visitor identifiers, session activity, UTM parameters, click identifiers, and conversion information. If Tab later offers a purchase through this site, attribution data may include the limited order information needed to connect that purchase to the referring creator or campaign. Learn more in the Trybe Privacy Policy.

Retention

We keep information only as long as reasonably needed to provide the service, complete and document requested actions, protect users, meet legal obligations, resolve disputes, and enforce agreements. Retention depends on the type of information and why it was collected. We aim to keep sensitive data out of general logs and receipts, and we delete or de-identify information when it is no longer needed, subject to legal, security, backup, and fraud-prevention requirements.

Your choices and rights

• Messages: Reply STOP to opt out of automated texts or HELP for help. Message and data rates may apply.
• Connected accounts: You can ask Tab to disconnect an account and may also revoke access through the connected provider.
• Credentials: You can ask Tab to stop using or revoke a saved website credential.
• Access, correction, and deletion: You may ask for access to, correction of, or deletion of your personal information. We may need to verify your identity before completing a request.
• Regional rights: Depending on where you live, you may have additional rights concerning access, deletion, correction, portability, restriction, objection, or appeals. We will honor applicable rights and will not discriminate against you for exercising them.

Opting out of automated texts does not prevent you from asking us to delete your waitlist or account information.

Children

Tab is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. Product features involving accounts, calls, connected services, or purchases may require a higher minimum age under the Terms of Use or applicable law.

Changes to this policy

We may update this policy as Tab evolves. We will post the new effective date here and provide additional notice when required by law or when a change materially affects how we handle your information.

Contact us

Tab is operated by Terrasoft, Inc., which is the controller of the personal information described in this policy. Questions or requests about privacy can be sent to privacy@tab.bot. Security concerns can be reported through the same address with the subject line “Security.”