Tabfleet Privacy Notice

Scope and operator

Effective September 14, 2026. This notice describes Tabfleet, a cloud-browser service operated by Dalton Solutions, LLC. in Burleson, Texas, United States. When this notice says "Tabfleet," "we," "us," or "our," it means Dalton Solutions, LLC. Contact support@tabfleet.com with privacy questions or account-data requests.

This notice applies to the Tabfleet website, dashboard, API, MCP server, OAuth and agent-authorization flows, cloud browser sessions, and signed live viewers. Websites visited through a Tabfleet browser, the agents or MCP clients you connect, and applications that embed a viewer have their own privacy practices.

Google user data

Tabfleet requests only the Google OpenID Connect identity permissions openid, email, and profile. Google supplies a stable account identifier, verified email address, and display name. We do not request access to Gmail, Google Drive, Google Calendar, contacts, or other Google product data.

We use Google user data only to authenticate you, associate you with your Tabfleet workspace, display your account identity, protect account access, and confirm the account approving an MCP or agent connection. We do not use Google user data for advertising, sell it, use it to train AI models, or allow humans to read it except when necessary for security, support requested by you, legal compliance, or operation of the service.

Google authorization codes and identity tokens are processed on our server to verify the sign-in and are not retained. Tabfleet does not retain Google access or refresh tokens. We retain the resulting Google account identifier and the account, workspace, and authorization records described below. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Account and authorization information

Tabfleet stores workspace names and identifiers, hashed API-key credentials and labels, approved agent and OAuth client connections, granted permissions, Tabfleet-issued authorization records, session state, and account-management activity needed to provide and secure the service. Connected-client records may include the client name and identifier, the permissions you approved, creation and expiration times, and a pseudonymous user identifier.

Account session cookies keep you signed in. We also process IP addresses into derived rate-limit identifiers and maintain short-lived OAuth, consent, registration, and abuse-prevention records. We use this information to authenticate requests, isolate workspaces, enforce permissions and limits, investigate failures and abuse, and let you manage credentials and connected applications.

Browser sessions and content

Browser operations transmit the URLs, actions, page data, cookies or storage state you choose to import, and other content needed to run your task. Browser pages may contain personal, confidential, or sensitive information that you or your agent enters or accesses. Requested snapshots, screenshots, and live views return browser content to the authorized client or viewer. Visiting another website also sends information to that website under its own privacy practices.

Tabfleet does not offer hosted browser recordings and does not retain snapshot, screenshot, or live-stream content as Tabfleet application records. Imported authentication state is used to initialize the requested browser and is not saved in the Tabfleet session record. Cloudflare processes browser traffic and session content to operate the browser infrastructure. Session records include identifiers, status, timestamps, termination reasons, and usage measurements. Signed viewer and CDP URLs are temporary bearer credentials and should be shared only with intended recipients.

Service providers and sharing

Cloudflare provides browser infrastructure, API hosting, storage, network delivery, and security services. Google processes sign-in. The public website and dashboard use hosting infrastructure provided through OpenAI Sites and Cloudflare. These providers process information on our behalf to deliver and secure Tabfleet and may maintain their own operational and security logs.

An MCP client or agent receives the browser results and Tabfleet data that its approved permissions allow it to request. A recipient of a signed viewer link can access the browser within that link's permissions and lifetime. We may disclose information when required by law, to protect users or the service, or as part of a merger, acquisition, financing, or sale of assets subject to appropriate protections. We do not sell or rent personal information.

Cookies, logs, and tracking

The Tabfleet API sets secure, HttpOnly cookies for Google sign-in state and dashboard account sessions. These cookies are used for authentication, security, and continuity, not advertising. The standalone viewer does not set account cookies and is served without third-party assets or Tabfleet analytics.

Cloudflare and hosting infrastructure may process IP addresses, request metadata, device or browser information, and security events to deliver traffic, prevent abuse, diagnose failures, and protect the service. Tabfleet does not currently use advertising pixels or sell browsing activity.

Retention

Dashboard account sessions expire after seven days. Google sign-in and consent attempts normally expire within ten minutes. Approved agent and MCP connection records expire after up to thirty days unless renewed or revoked. Signed live-view and CDP credentials have shorter expiration periods tied to the browser lease.

Browser sessions are temporary and are subject to hard and idle timeouts; the current maximum browser lease is one hour. Closing a session initiates browser cleanup, and failed cleanup is retried. Tabfleet keeps at most 100 completed session records per workspace in addition to active sessions, while cumulative usage and allowance records are retained to administer the workspace. Account, workspace, credential, authorization, and security records may remain until deletion, expiration, or revocation is processed and may outlive an individual browser session.

Infrastructure providers may retain operational, security, backup, or legal-compliance records under their own schedules. We may retain limited information when reasonably necessary to meet legal obligations, resolve disputes, prevent fraud or abuse, and enforce agreements.

Your choices, revocation, and deletion

You can sign out of the dashboard, close active browsers, revoke API keys and connected applications, revoke signed viewer links, and remove Tabfleet access from your Google Account settings. Signing out deletes the current Tabfleet account session. Revoking Google access prevents future Google authorization but does not by itself delete workspace records already held by Tabfleet.

Email support@tabfleet.com to request access to, correction of, or deletion of your Tabfleet account and associated Google user data. State that the message is a privacy or account-deletion request and identify the email used for Tabfleet. We may verify account ownership before acting. We will delete or de-identify covered information unless retention is required for security, fraud prevention, dispute resolution, or legal compliance, and we will explain any applicable limitation. Do not send passwords, API keys, OAuth tokens, signed viewer links, or sensitive browser contents by email.

Security

We use HTTPS, scoped and expiring credentials, hashed API keys, signed URLs, workspace isolation, permission checks, secure cookies, rate limits, and restricted browser connections to protect the service. Google identity tokens are checked for signature, issuer, audience, expiration, nonce, and verified email status before a session is created.

No online service is completely secure. You are responsible for protecting API keys, OAuth tokens, CDP URLs, signed viewer links, and the accounts you access through a browser. If you believe a credential or account has been exposed, revoke it promptly and contact us. We will provide legally required breach notifications.

Children and international users

Tabfleet is a developer service intended for adults and is not directed to children under 13. Do not provide children's personal information through the service. Tabfleet is operated from the United States, and information may be processed in the United States and other locations where our infrastructure providers operate.

Updates

We will update this page and its effective date when our data practices materially change. If a change requires additional consent, we will request it. Review this notice before using Tabfleet for a new category of data.

Contact

Dalton Solutions, LLC. operates Tabfleet from Burleson, Texas, United States. Email support@tabfleet.com for privacy questions, requests, or complaints.