Privacy

What the new tab knows

Updated October 23, 2026. Questions: hello@tinydevz.com.

The extension

TinyDevz replaces the Chrome new tab with a briefing of cybersecurity and AI headlines, plus a desk of GitHub trending, package advisories, recent releases, Hacker News, and doc links. It asks Chrome for storage, so it can remember your theme, the topics you follow, saved stories, and whether you skipped sign-in. It asks for the search permission so a web search can use the search engine you already chose in Chrome. It asks for the identity permission only to finish Google or GitHub sign-in. It reads tinydevz.com and tinydevz.onrender.com for the briefing, the desk, and, if you choose, your account.

An account is optional. Without one, saved stories, the topics you follow, pinned shortcuts, and the theme stay in this browser and are not sent to TinyDevz. With one, the stories you save are stored with that account so another browser can pick them up. The theme, the topics you follow, and pinned shortcuts stay on the device either way. The icon for a pinned site is requested from that site. If a site from the common list has no icon, one is requested from Google's icon service. There is no analytics pixel.

If you create an account

Google and GitHub sign-in share the name and email those providers already have for you. Email sign-up stores the email and a hash of the password, not the password itself. You can sign out or delete the account from the new tab. Deleting it removes the account and the stories saved to it.

The account database is Postgres on Render, next to the same service that hosts this site.

Search

Searching stories and the desk happens on this page. Those queries are not sent to TinyDevz. Searching the web from the extension hands the words to the search engine Chrome is already set to, and TinyDevz does not receive them. The same search on tinydevz.com/briefing opens Google.

The briefing

tinydevz.com fetches public RSS feeds, keeps a short cache, and returns headlines as JSON. Titles and short excerpts are sent to xAI's Grok API to write a one-line takeaway under each headline. Your email and saved stories are not included in that request. If the summary service is quiet, the tab still shows one line from the publisher's excerpt. A red Urgent badge is for alerts worth acting on, such as a critical PHP vulnerability. Render may keep standard request logs the way any web host does.

The desk is a second public fetch. tinydevz.com reads GitHub's trending page, the GitHub advisory database for npm and PyPI, release notes from a short list of projects, and the Hacker News front page, then returns that as JSON. The same request carries no account information.

What we don't do

• No ads in the new tab.
• No sale of personal information. We don't collect a profile to sell.
• No third-party trackers in the extension or on this site.
• No remote code. The new tab's program ships inside the extension. The network loads the briefing and the desk, both public data fetched by tinydevz.com.

Uninstall

Remove TinyDevz from chrome://extensions. That deletes the copy of the extension and the stories it saved on this computer. An account stays until you delete it from the tab.