Privacy Policy
Effective date: September 25, 2026
Firstlight — New Tab Dashboard ("Firstlight", "the extension", "we") is a browser extension for Chrome and Firefox that replaces the New Tab page with a customizable widget dashboard. This policy explains what data the extension handles and how.
The short version
- Firstlight has no servers, no accounts, no analytics, and no ads.
- Everything you create in the extension is stored locally in your browser using the browser's own extension storage.
- We never collect, transmit, sell, or share your personal data. There is nowhere for it to go — we don't operate a backend.
- Google sign-in is optional, available in Chrome only, and only used to display your own Google Calendar and Tasks data inside your new tab. The Gmail widget involves no sign-in at all — it reads Google's unread-mail feed using the Gmail session already in your browser.
Data stored in your browser
Your dashboard layout, widget settings, and widget content (to-do items, notes, habit history, timers, cached feed and API responses) are saved with the extension storage API (storage.local) on your device. If you enable the optional cross-device sync, a copy of this data is mirrored to storage.sync, which your browser itself synchronizes through your own account — Chrome Sync with your Google account in Chrome, Firefox Sync with your Mozilla account in Firefox. That sync is performed entirely by your browser — the data never passes through any server of ours. Fetched caches — including all Google user data described below — are excluded from this mirror and never leave your device.
Uninstalling the extension deletes its local data. Synced data can be removed by clearing your browser's synced extension data; turning sync off in the extension only stops further syncing and leaves the already-synced copy in place for your other devices.
Google user data (optional sign-in)
If you choose to connect your Google account, Firstlight uses Chrome's built-in identity system (chrome.identity) and requests these OAuth scopes. Firefox has no equivalent identity system, so the Google Calendar and Tasks widgets are not available there and this section applies to Chrome only:
| Scope | Used for |
|---|---|
calendar.readonly | Reading your upcoming calendar events to display them in the Calendar widget. Read-only. |
tasks | Displaying your Google Tasks and letting you check tasks off from the widget. |
Google data is fetched directly from Google's APIs to your browser, displayed in your new tab, and cached in local extension storage so widgets can render while offline or between refreshes. It is:
- never transmitted to us or to any third party;
- never used for advertising;
- never read by humans;
- never sold.
Firstlight's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect at any time via any Google widget's ⋯ menu ("Disconnect this widget"), and you can revoke the extension's access entirely at myaccount.google.com/permissions. Disconnecting stops all Google API requests and deletes that widget's cached Google data from local browser storage.
The Gmail widget (no sign-in)
The Gmail widget does not use Google sign-in or any OAuth scope. Instead, when you choose to connect it, the extension asks for permission to read mail.google.com and fetches Google's standard unread-mail feed using the Gmail session already signed in in your browser. That feed contains only your unread messages' senders, subjects, dates, and one-line snippets — never message bodies or attachments. This data is displayed in your new tab and cached in local extension storage only; it is never synced across devices and never transmitted anywhere other than the request to Google itself. No account credential or token is granted to the extension. You can withdraw the permission at any time via the widget's ⋯ menu ("Disconnect") or in your browser's extension settings, which also deletes the widget's cached data on disconnect.
How we protect your data
Firstlight protects all data it handles — in particular Google user data obtained through sensitive OAuth scopes — with the following mechanisms:
- Encryption in transit. Every request the extension makes — to Google APIs and to every other service listed in this policy — uses HTTPS (TLS) exclusively. The extension has no permission to contact non-HTTPS endpoints of its own.
- Credential security. Sign-in (Chrome only) uses Chrome's built-in identity system (
chrome.identity). OAuth tokens are issued, cached, and protected by Chrome itself; the extension never writes tokens to its own storage, never logs them, and never sees or handles your Google password. - Least privilege. Only the narrowest scopes are used — read-only Calendar access, and Tasks access limited to the task lists the widget shows — and each scope is requested individually, only when you choose to connect the widget that needs it. No restricted Google scopes (Gmail, Drive) are requested at all.
- Storage isolation. Cached Google data is kept only in the extension's local storage (
storage.local), which the browser sandboxes per extension: websites and other extensions cannot read it, and it is protected on your device by your operating-system user account like the rest of your browser profile. - No server-side copies, no sharing. Firstlight has no backend, so no server-side copy of your data exists anywhere that could be breached, and nothing is ever shared with third parties. Google data flows only between your browser and Google's APIs.
- Excluded from sync. Google user data is never mirrored to
storage.sync— even with cross-device sync enabled, it stays on the device that fetched it. - Retention and deletion. Cached Google data is deleted when you disconnect a widget or sign out, and all local data is deleted when you uninstall the extension. You can revoke the extension's access to your Google account at any time at myaccount.google.com/permissions.
Third-party services
Some widgets fetch public data directly from your browser. These requests are keyless and include no account information — like any web request, the remote service technically sees your IP address. Firstlight contacts a service only when you use the widget that needs it:
| Service | What is sent | Purpose |
|---|---|---|
| Open-Meteo | Your coordinates or a city name you enter | Weather forecast and location search for the Weather widget |
| Google / DuckDuckGo / Bing suggest | Text you type in the search bar | Search suggestions from the provider you selected |
| Lorem Picsum, Wikimedia | A generic image request | Optional background photos |
| ZenQuotes / Quotable | A generic request | Quote of the day in the Focus widget |
| Google News and RSS feeds you add | The feed URL | Fetching headlines for the News/RSS widgets |
| CoinGecko | The coin ids you picked and your display currency | Prices, market caps, 7-day sparklines and coin logos for the Crypto widget |
Browser permissions
| Permission | Why Firstlight needs it |
|---|---|
| storage | Saving your dashboard and widget data locally (and optionally to your browser's sync) |
| search | Running your query in your default search engine from the search bar |
| geolocation | Locating you for the weather forecast, only if you choose automatic location |
| topSites | Showing your most-visited sites |
| sessions | Listing and restoring recently closed tabs |
| favicon (Chrome only) | Showing site icons next to links and bookmarks |
| notifications | Alerting you when a pomodoro/focus timer finishes |
| identity (Chrome only) | Optional Google sign-in for the Google Calendar and Tasks widgets |
| clipboardRead / clipboardWrite | The extension's right-click copy/paste menu inside its own page |
| bookmarks (optional) | Displaying your bookmarks — requested only when you import bookmarks into the Bookmarks widget or add the All bookmarks widget |
| host access to sites you specify (optional) | Fetching RSS feeds from URLs you add — requested only when you add a feed |
None of these permissions are used to track your browsing. Firstlight runs only on its own New Tab page and does not read or modify other websites.
Children
Firstlight is not directed at children under 13 and does not knowingly collect personal information from anyone.
Changes to this policy
This policy is published at https://firstlight-extension.site/privacy.html. If it changes, the updated version will be posted at this address with a new effective date.
Contact
Questions about this policy or the extension: maxym2010i@gmail.com