1. Overview
TaskOrbit is a browser-based workflow automation extension built on a privacy-first, local-only architecture. Your workflows, data, and settings are stored exclusively on your device using chrome.storage.local and are never transmitted to external servers.
This policy explains what data TaskOrbit accesses, why it needs specific browser permissions, and how your information is handled.
2. Data Storage
| Data Type | Storage Location | Shared Externally? |
|---|---|---|
| Workflows (steps, variables, folders) | chrome.storage.local | ❌ No |
| Execution logs | chrome.storage.local | ❌ No |
| Memory Bank (dedup hashes) | chrome.storage.local | ❌ No |
| Settings & preferences | chrome.storage.local | ❌ No |
| License activation data | chrome.storage.local | See §5 |
| Device ID (UUID) | chrome.storage.local | See §5 |
All workflow data stays on your machine. There is no cloud sync, no remote database, and no telemetry.
3. Permissions Explained
TaskOrbit requests the following Chrome permissions. Each is listed with its purpose and justification.
Required Permissions
| Permission | Why It's Needed |
|---|---|
storage | Stores all workflows, logs, settings, and Memory Bank data locally on your device using chrome.storage.local. |
scripting | Injects the workflow executor and recorder scripts into web pages so TaskOrbit can automate actions (clicks, typing, extraction) on your behalf. |
tabs | Reads the active tab's URL to match Auto-run rules, resume workflows after page navigation, and inject content scripts into the correct tab. |
activeTab | Provides temporary access to the currently active tab when you explicitly click the TaskOrbit icon or trigger a workflow. |
downloads | Exports workflow data as JSON files, saves scraped data as CSV files, and downloads screenshots captured by the "Take Screenshot" step. |
alarms | Powers scheduled workflow runs (background scheduling) and periodic license validation checks (every 24 hours). |
contextMenus | Adds right-click menu entries: "Reveal this password" and "Reveal all passwords on page" for the Password Reveal feature. |
Optional Host Permissions
| Permission | Why It's Needed |
|---|---|
optional_host_permissions: *://*/* |
TaskOrbit uses a least-privilege model. It does not request blanket access to all websites at install time. When you configure a workflow to auto-run on a specific domain, the extension prompts you to explicitly grant access to that domain only. You can revoke this access at any time via Chrome's extension settings. |
4. Content Scripts
TaskOrbit injects two lightweight content scripts on all pages at document_idle:
| Script | Purpose | Data Collected |
|---|---|---|
toast.js | Displays a small notification toast when you visit a site that has a matching workflow, so you know automation is available. | ❌ None |
autoReveal.js | If enabled in settings, changes password fields from type="password" to type="text". Also handles right-click context menu "Reveal" actions. | ❌ None |
These scripts do not collect, transmit, or store any data from the pages they run on. They only modify the page DOM locally in your browser tab.
5. License Activation
If you choose to activate a TaskOrbit Pro license, the following data is sent once to the license server at https://taskorbit.subho.net/v1/license/verify:
- License Key (the key you entered)
- Email Address (the email you entered)
- Device ID (a locally generated UUID, stored in
chrome.storage.local)
This request validates your license key and returns an activation status. The extension caches the result locally. A background check occurs every 24 hours to verify the license is still valid, with a 7-day offline grace period if you are disconnected.
No other data is sent to any server. Workflow content, variable values, execution logs, and browsing history are never transmitted.
6. Community Marketplace (Optional)
TaskOrbit includes an optional Marketplace feature where users can share workflow templates. If you use this feature:
- Sharing a workflow: The workflow name, steps, author name, category, description, and tags are sent to the Marketplace server. No personal browsing data or variable values are included.
- Downloading a workflow: You download the workflow structure (steps and metadata) from the server.
- No account required: The Marketplace does not require user registration.
You are never required to use the Marketplace. All other features work entirely offline.
7. What TaskOrbit Does NOT Do
- ❌ No Telemetry: We do not track your usage, clicks, or browsing behavior.
- ❌ No Analytics: No Google Analytics, Mixpanel, or any tracking SDK is included.
- ❌ No Advertising: TaskOrbit contains no ads and no ad-related tracking.
- ❌ No Data Sales: We do not sell, rent, or share your data with third parties.
- ❌ No Remote Code Execution: TaskOrbit does not download or execute code from external servers.
- ❌ No Cookies: TaskOrbit does not set, read, or track browser cookies.
8. Sandboxed Code Execution
The "Calculate Math" step evaluates mathematical expressions using a sandboxed iframe (sandbox.html) that runs in an isolated context with no access to the page DOM, network, or extension APIs. This ensures safe expression evaluation per Chrome's Content Security Policy.
9. Data Retention & Deletion
- Workflows & Logs: Stored indefinitely in
chrome.storage.localuntil you manually delete them via the extension UI. - Memory Bank: Per-workflow hash data persists until you click "Clear Memory Bank" in the workflow editor.
- License Data: Stored until you click "Remove License" in Settings, or uninstall the extension.
- Uninstall: When you uninstall TaskOrbit, Chrome automatically removes all data stored in
chrome.storage.local.
10. Children's Privacy
TaskOrbit is not directed at children under the age of 13 and does not knowingly collect information from children.
11. Changes to This Policy
We may update this privacy policy from time to time. Changes will be reflected in the "Last Updated" date at the top of this document. Continued use of TaskOrbit after changes constitutes acceptance of the updated policy.
12. Contact
If you have questions about this privacy policy or TaskOrbit's data practices:
- Website: https://subho.net
- Contact Page: https://subho.net/contact
- Email: [email protected]