Wilo privacy policy
Last updated: October 28, 2026
Wilo is a browser extension that saves and organizes your tabs into collections. This page explains what Wilo stores, what leaves your device, and how to delete it. In short: your library lives on your device first; it reaches our servers only if you sign in to sync; we never sell data or use it for advertising; and the cloud AI features are off until you turn them on.
On your device
Wilo keeps your library (workspaces, Spaces, collections, saved links, notes, tags, to/ links, the Next list, settings, and crash-recovery snapshots of your open windows) in your browser's local storage. To file and tidy tabs, Wilo reads the titles, addresses, and icons of your open tabs. Auto-organize runs on your device, including the on-device language model it uses to match tabs to collections. Wilo does not read the content of the pages you visit.
If you turn on History search, Wilo asks for permission to read your browser history and searches it on your device. Your history is never uploaded.
The first time auto-organize needs it, Wilo downloads that language model's files from Hugging Face (huggingface.co). The request contains no information about you or your tabs.
The Wilo web app (which always uses an account) keeps a copy of your library in that browser's storage so it opens instantly and works offline. Signing out of the web app, or deleting your account from it, removes that copy. To show site icons, the web app asks DuckDuckGo's icon service (icons.duckduckgo.com) for the icon of each saved site's domain name; the request contains only the domain, not the full address, the page title, or anything about you.
If you create an account
| What | Why |
|---|---|
| Email address, name, and profile picture (from Google, if you sign in with Google) | Your account, sign-in links, and showing who is in a shared workspace |
| A password hash (Argon2), if you choose a password | Signing in |
| Your library, as listed above, except the crash snapshots, which stay local | Syncing between your browsers and sharing with your team |
| Device names and browser types, with the last time each synced | Your device list, signing devices out, and the Free plan's device limit |
| Plan, trial dates, the end of the current paid period, and daily "Organize now" counts | Your plan's limits |
Saved titles and addresses are sent only for tabs you saved, or that auto-organize filed into a collection for you. Open tabs that were never saved or filed are not uploaded.
Sharing
A public share link shows that one collection, read-only, to anyone with the link, until you revoke it or it expires. Shared Spaces are visible to the workspace members you add. Auto-organize never files tabs into a shared Space unless you allow it for that Space.
Cloud AI (off by default)
If you turn on the cloud AI features, Wilo sends the titles and addresses of the tabs being named or sorted to our AI provider, after removing tracking parameters and anything that looks like a secret. Nothing else is sent. The provider may not use this data to train models. Turn the setting off at any time.
AI chats
When you save a ChatGPT, Claude, Gemini or Grok conversation, Wilo stores its title and address like any other link. It never reads the conversation itself. With cloud AI on, a chat is sorted by its title alone: the conversation's address is cut back to the assistant's site before it is sent. Importing a ChatGPT or Claude data export happens on your device: Wilo keeps each conversation's title and link and discards the messages before anything is saved or synced.
Payments
Paid plans are billed by PayPal. Wilo receives your subscription status, a PayPal subscription id, and the date your current paid period ends. We never see or store card or bank details. PayPal's privacy statement covers what PayPal collects.
If you cancel, billing stops at once and your plan stays until the end of the period you already paid for; then your account moves to the Free plan and keeps everything you saved. Payments are not refunded. The terms of service explain plans, cancellation, and refunds in full.
Anonymous usage statistics and crash reports
To check that Wilo works (for example, whether auto-organize picks the right collection and whether people undo what tidy does), the extension sends daily counts, such as "5 tabs saved" and "1 suggestion corrected", and reports of crashes in Wilo's own code. These counts and reports:
- never include page addresses, titles, collection names, notes, or your email;
- are sent without your account, tagged only with a random install number created on your device, so we cannot link them to you;
- have addresses, emails, and long ids removed from error messages before sending.
Turn this off in Wilo's settings menu (Share anonymous usage stats). Anything not yet sent is then deleted. Daily counts are kept for up to 400 days.
Feedback and the uninstall survey
When you use Send feedback, we keep what you write and, so we can reply, your account email (or the address you typed, if you're signed out). If you leave Include version and browser details on, the Wilo version, browser name, language, and plan come along; tabs, page addresses, and titles never do. After you remove the extension, Chrome opens a short page asking why; answering is optional and anonymous, and only the reasons you pick, your note, and the Wilo version are kept. Feedback is emailed to our support inbox and kept until it's no longer needed to improve Wilo, or until you ask us to delete it.
Sign-in links, workspace invites, and account notices are delivered by Zoho CPaaS. We don't send marketing email unless you ask us to.
Who processes data for us
| Provider | Purpose |
|---|---|
| Our hosting provider (application servers and database) | Running the Wilo service |
| "Sign in with Google", only if you use it | |
| PayPal | Payments, only on paid plans |
| Zoho CPaaS | Transactional email |
| DuckDuckGo | Site icons in the web app (domain names only) |
| Our AI provider | Cloud AI features, only if you turn them on |
| Sentry | Error reports, without personal data |
We do not sell personal data, share it for advertising, or use it for creditworthiness or lending decisions. Wilo's use of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Security
All traffic uses HTTPS. Sign-in tokens are short-lived, refresh tokens are stored only as hashes and rotate on every use, and a reused token signs out that device's whole session.
Keeping and deleting your data
- Export your whole library at any time (Settings → Export).
- Delete your account in the account dialog. Sign-in stops and every device is signed out at once. Your account data is permanently deleted 14 days later; email us within those 14 days to restore it. Workspaces you share with others stay with their remaining members.
- Items you delete go to the Trash for 30 days, then are deleted permanently.
- Uninstalling the extension removes the local copy from that browser.
Children
Wilo is not directed at children under 13, and we do not knowingly collect their data.
Changes and contact
We will post changes here and update the date above. Material changes are also announced in the extension's Updates panel. Questions or requests, including access, correction, and deletion: privacy@wilo.app.
Using Wilo is also subject to the terms of service.