Controller and contact
The controller is Artur Mukhamatkhaev, an individual trading as From Artur, at Rua das Amoras 174, 2775-549 Cascais, Portugal (Portuguese tax identification number 315491051). From Artur is a trading name, not a statement that the provider is an incorporated company. For privacy questions or to exercise a data-protection right, email artur@fromartur.com.
Information stored in your Chrome profile
Tab Scheduler stores routine names, website addresses, schedules, preferences, saved templates, activity records and technical records used to prevent duplicate openings in the extension’s IndexedDB database in your Chrome profile. It also creates a random installation identifier and, after Pro activation, stores a signed license receipt locally.
The Free version requires no account. Routine content and scheduled addresses are not sent to From Artur. The extension does not read destination-page content, collect browsing history, or use advertising or analytics services. When you choose “Use this page”, the activeTab permission lets the popup read the address of the active page so it can be added to a routine.
Local retention, deletion and backups
Completed activity is limited to the most recent 500 attempts and entries from the previous 90 days. Technical occurrence records may remain for up to 180 days to prevent duplicate openings, and short-lived command records are kept for up to seven days. Current or unfinished records may be kept longer until they are resolved.
You can delete routines and clear completed activity in the extension. Clearing activity does not remove the technical records needed for duplicate protection or an opening already in progress. Uninstalling the extension normally removes its local data from that Chrome profile.
An exported backup is a plaintext JSON file containing routines, website addresses, preferences and saved templates. It does not include activity history or license secrets. You choose where the file is stored and when it is deleted.
Pro requests, activation and required information
The Free version requires no registration, email address or connection to the licensing service. Pro requests and activation are available only in a build configured with that service. To submit a Pro request, an email address and an affirmative contact-consent checkbox are required; without them, the seller cannot answer the request. Applying does not take a payment, reserve a place or guarantee availability. The first ten paid licenses are issued only after the seller manually confirms a direct transfer.
Activation requires the redemption key and the random installation identifier. Validation and deactivation require the signed license receipt, installation identifier and a one-time request value. Without these items the service cannot activate, refresh, restore or release the Pro entitlement. Routine names, scheduled addresses, templates, activity and browser history are never included in these requests.
After a purchase, the service also records license and order status, the verified payment time and a minimal payment reference entered by the administrator. It does not receive or store bank-card details. The information is used to answer the request, deliver and restore the licensed service, enforce one active installation, prevent unauthorized use, administer revocation or device resets, support the transaction and meet applicable record-keeping duties.
Information stored by the licensing service
The service database stores the application email, consent flag, random idempotency value, product, offer, creation time and state; customer email; order, price, currency and channel; payment reference and verification time; a SHA-256 hash of the redemption key; grant and license state and timestamps; and installation identifiers, binding status and last-seen time. The plaintext redemption key is accepted during activation and shown once when issued, but is not stored in the database.
Administrative audit records contain the time, action, product identifier, optional grant identifier and a required free-text reason written by the operator. Administrators are instructed not to put redemption keys, receipts, authorization tokens or unnecessary personal information in that reason. The service also exposes aggregate operational counts that do not contain customer details.
At startup and every 24 hours while running, the service deletes pending applications strictly older than 90 days only when they have no payment, order or grant, then removes an orphaned customer email. It deletes legacy and current administrative audit entries strictly older than 90 days. Records exactly 90 days old are retained until the next cleanup. The operation is repeatable and does not delete paid or manually granted applications, customers linked to orders, orders, payments, grants or installation bindings.
Purchased records are retained while needed to provide a permanent license, restoration and support, and afterwards for applicable accounting, consumer-protection, fraud-prevention and legal-claims periods. No automatic deletion period for these purchased records is currently implemented. The owner must confirm the applicable statutory schedule before accepting customer data or issuing a paid license; a verified privacy request can still lead to deletion or restriction where no overriding contractual or legal ground applies.
Limited use of extension and customer data
Tab Scheduler uses information only to provide the disclosed scheduling features and, when requested, Pro application, licensing, restoration, support, security and legal-compliance functions. Schedule URLs and routine content remain local to the Chrome profile and are not sent to the licensing service.
Personal information is not sold. It is not used or transferred for personalized advertising, unrelated profiling or purposes unrelated to Tab Scheduler, and it is not used to determine creditworthiness or for lending. Access to server customer records is limited to the authorized operator when needed for user-requested contact or support, license administration, security and abuse investigation, privacy requests, or legal compliance.
Server backups
A server database backup is a full SQLite copy and can contain application and customer emails, consent and idempotency values, orders, payment references, hashed keys, license and installation identifiers, timestamps and audit entries that existed when the copy was made. Signing keys are backed up separately and are not customer personal data, but they are security-critical.
An automated local backup runs once each day using SQLite's consistent backup mechanism. The production timer is active, its first snapshot completed successfully and local snapshots are managed with a 30-day expiry. Backup files are held in service-account-restricted storage on the same VPS. No external backup destination is currently confirmed, and the exact data-centre location and backup-at-rest encryption remain to be verified.
A deletion or correction request is applied to the live database when legally required. Existing restricted snapshots are not edited in place and expire under the 30-day policy; if a snapshot containing affected data is restored before expiry, the deletion or correction must be reapplied before normal service resumes.
Security, service providers and request metadata
Configured license requests use HTTPS. The Fastify application has request logging disabled, limits request bodies to 8 KiB and returns generic server errors. Its in-memory rate limiter temporarily processes the requesting IP address. It does not intentionally write request bodies, redemption keys, signed receipts, authorization headers or administrator tokens to application logs.
The deployment configuration places the license service in a restricted non-root container on an OVHcloud VPS behind a dedicated Caddy route at licenses.fromartur.com. That route does not enable Caddy access logging or request-body logging and forwards the client IP for the application rate limiter. Database and key paths are restricted to the service account. External network and infrastructure providers can still process connection metadata such as IP address, request time and path to deliver and protect traffic.
The exact OVHcloud hosting region, production backup location, infrastructure-level logging outside the reviewed application and Caddy route, subprocessor list and any resulting transfer outside the EEA have not yet been verified. This policy therefore does not claim either that an international transfer occurs or that none occurs. These facts and any required transfer safeguards must be confirmed before the public licensing endpoint accepts customer data or a paid license is issued.
Legal bases
A Pro request is processed to take steps at your request before a contract and, where applicable, on the contact consent you provide. License delivery, validation, restoration and support are necessary to perform the purchased service. Security, rate limiting and abuse prevention rely on the legitimate interest in protecting users and the service. Transaction records may also be kept to comply with legal obligations or to establish, exercise or defend legal claims.
A permanent Pro purchase uses a periodically refreshed signed receipt. A valid receipt supports at most seven days of offline Pro access between successful validations. This validation does not transmit routine content or scheduled addresses.
Your data-protection rights
Email artur@fromartur.com to request access to your personal data, correction of inaccurate data, deletion where the legal conditions apply, restriction of processing, or a portable copy of data you provided where portability applies. You may object to processing based on legitimate interests. Where processing relies on consent, you may withdraw that consent at any time without affecting processing that was lawful before withdrawal.
The controller may need to verify your identity and will respond without undue delay, normally within one month. That period may be extended by up to two further months for a complex or numerous request, in which case you will be told within the first month. Rights are not absolute: for example, deletion may be refused to the extent data must be kept to perform the contract, comply with law or handle legal claims.
You may lodge a complaint with Portugal’s supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or with another competent supervisory authority in the EEA country of your habitual residence, work or the alleged infringement.
Read the general From Artur Privacy Policy