Legal
Privacy Policy
This Privacy Policy explains how Coffee Tab (the "Extension") and the Coffee Tab website (together, the "Service") collect, use, and share information. The Service is operated by Changsha Oupeng Technology Co., Ltd ("we", "us"). By installing the Extension or using the Service you agree to the practices described here.
Short version: the Extension's Work Mode reads your open tabs and bookmarks locally in your browser and never uploads them. When you sign in to Cafe Mode, we store your account details, your conversations with AI characters, gift and progress data, and your paid entitlement status so the Service works across devices. We do not sell your personal information, and we never receive your card details.
1. Information we collect
1.1 Account information
Cafe Mode requires sign-in with Google. When you sign in we receive and store your Google account identifier, name, email address, profile picture URL, and locale. We use this to create your account and keep your progress and purchases attached to you.
1.2 Conversations and in-app activity
When you use Cafe Mode we store the messages you exchange with AI characters, which character you talked to, when the conversation happened, and in-app activity such as favorability, unlocked characters, gifts you have sent or received, achievements, and usage statistics.
1.3 AI memory
To let characters remember earlier conversations, conversation excerpts are sent to our memory provider (mem0) and stored as memory records associated with your account and the character. Memory records are deleted when you delete your account (see section 9).
1.4 Optional third-party AI keys
If you choose to supply your own AI provider API key in Settings, we store it encrypted with AES-256-GCM. The key is decrypted only to make requests on your behalf and is never returned to the browser in plain text or shared with other users.
1.5 Payments and entitlements
Purchases are processed by third-party payment providers acting as merchant of record. We receive and store purchase confirmations, order and subscription identifiers, the email address associated with the purchase, amounts and currency, and the resulting entitlement state (VIP status, renewal date, gift credits). We do not receive or store your card number, CVC, or bank credentials.
1.6 Technical and session data
When you authenticate, we record session data including a refresh token, the browser user agent string, IP address, and timestamps. We use this to keep you signed in, refresh access tokens, and detect abuse.
2. Information processed only in your browser
2.1 Tabs and bookmarks
Work Mode reads your open tabs and bookmarks to build the workspace on the new tab page.
This happens locally inside your browser using the tabs and
bookmarks permissions. Tab and bookmark data is
never transmitted to our servers, and it is discarded when you close the
page.
2.2 Local settings and progress cache
Interface settings (language, music and sound preferences, autoplay) and a local cache of game data are stored in your browser's local storage. You can clear them at any time from your browser settings.
2.3 On-device character detection
To place characters in the cafe scene, the Extension runs an object-detection model (TensorFlow.js COCO-SSD) entirely on your device against the cafe background image. No camera or microphone access is requested, and no image or video of you is captured or uploaded.
3. How we use information
- Provide the Service: run conversations, generate replies, and remember context.
- Maintain your account, progress, and entitlements across devices.
- Process purchases and grant the credits or VIP access you paid for.
- Operate, secure, and debug the Service, including abuse and fraud prevention.
- Respond to support requests and comply with legal obligations.
We do not sell your personal information, and we do not use your conversations to train our own models.
4. Service providers we share data with
We share only the data needed for each provider to perform its function. These providers process data under their own privacy policies, linked below.
| Provider | Purpose | Data shared |
|---|---|---|
| Sign-in and account authentication | OAuth authorization code, then your account identifier, name, email, and picture | |
| DeepSeek | Generating AI character replies | Conversation messages and character context |
| mem0 | Long-term conversation memory | Conversation excerpts and an internal user identifier |
| Waffo Pancake | Merchant of record for subscriptions | Buyer email, order metadata, and the internal user identifier needed to grant credits |
| Paddle | Merchant of record for the one-time Gift Pack | Buyer email, order metadata, and the internal user identifier needed to grant credits |
| PayPal | Alternative checkout provider | Buyer email, order metadata, and the internal user identifier needed to grant credits |
| OpenAI | Generating cafe scene artwork (server-side) | Text prompts describing a scene; no user content or personal data |
| Cloudflare | Hosting this website | Standard web request data such as IP address and user agent |
We may also disclose information if required by law, to enforce our terms, or to protect the rights and safety of our users.
5. Legal bases for processing (EEA/UK)
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Service and processing purchases), legitimate interests (security, abuse prevention, and service improvement), consent (optional features you explicitly enable), and legal obligation (tax and accounting records).
6. Data retention
Account, conversation, progress, and memory data are retained while your account is active. If you delete your account we delete or anonymize this data, except where we must keep records for legal, tax, or accounting purposes. Payment records are retained by the payment provider according to its own policy. Local browser data is removed when you clear your browser storage or uninstall the Extension.
7. Security
We protect data in transit with TLS and encrypt sensitive values such as user-supplied API keys at rest. Access tokens are short-lived and refreshed with a separate refresh token. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
8. International transfers
Our service providers may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.
9. Your rights and choices
Depending on where you live, you may have the right to:
- Access the personal information we hold about you.
- Correct inaccurate information.
- Delete your account and associated data.
- Receive a portable copy of your information.
- Object to or restrict certain processing.
- Withdraw consent where processing is based on consent.
To exercise any of these rights, contact us using the details in section 12. You can also remove local data at any time by uninstalling the Extension or clearing your browser storage.
10. Children
The Service is not directed to children under 13 (or under 16 where required by local law), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us so we can delete it.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Material changes will be communicated in the Extension or on this page.
12. Contact
For privacy questions, data access, or deletion requests, contact us at [email protected].