"Privacy-focused" gets printed on a lot of software that still phones home for analytics, crash reports, or a sign-in check. TabStyr's claim is narrower and more literal: there is no server for it to phone home to.

What "no servers" actually means

Every session TabStyr records — which tab, how long, when — is written to IndexedDB inside your browser profile. That's it. There's no account to create because there's nowhere to send an account's data. There's no cloud sync because there's no cloud. The extension's Content Security Policy is set to connect-src 'none' on its own pages — a network request to anywhere isn't just avoided, it's blocked at the platform level.

What that rules out

Being local-only isn't free. It rules out:

  • Cross-device sync, automatically. If you want your data on a second machine, you export a backup file and import it there yourself — optionally encrypted with a passphrase before it ever leaves the device.
  • Any second opinion on your data. There's no dashboard you can check from your phone. It's a browser extension; your data lives where the browser lives.
  • Remote debugging or crash reporting. If something breaks, we find out from a GitHub issue, not a telemetry beacon.

For a tool whose entire premise is "tell me the truth about my own screen time," that trade felt like the right one to make deliberately, not something to work around later with an opt-out toggle.

The parts people don't think about

Local-only also shapes decisions that aren't obviously "privacy" features:

Encrypted backups use real cryptography, not obfuscation — AES-256-GCM with a PBKDF2-derived key, computed with the browser's own Web Crypto API. A wrong passphrase fails to decrypt cleanly rather than returning garbage data, because authenticated encryption catches tampering by construction.

Import is hardened, not just parsed. A backup file is untrusted input the moment it's dropped into the restore dialog — even if it's your own file. Every record is type-checked, sizes are capped, and the passphrase KDF's iteration count is clamped to a safe range, so a crafted file can't be used to exhaust CPU or corrupt the database.

The marketing site doesn't get a pass either. The landing page you're reading this on ships with zero analytics by default — no Cloudflare beacon, no Plausible, nothing — until a token is deliberately pasted into a config file before a build. "No tracking" isn't a claim that stops at the extension's edge.

Verifying it yourself

The whole point of "no servers" as a claim rather than a slogan is that it's checkable. The repo is open source (MIT) — open a network tab, use the extension, and count the requests. There should be exactly zero to anywhere but the browser's own extension pages.