Privacy Policy
Last updated: 2026-10-19. ShowMyTab (showmytab.com) is operated by Gemen Bilgi Teknolojileri Ve Ticaret Limited Şirketi, which is the data controller (Cumhuriyet Mah. Cevval Sk. C Blok No:1/3 İç Kapı No:2, Büyükçekmece, İstanbul 34520, Türkiye). This policy explains what data we collect, why, and how we protect it.
Video and control data
The picture of the shared tab and mouse and keyboard events travel directly between browsers over encrypted WebRTC. This data does not pass through our servers, is not recorded and cannot be seen by us. When a direct connection is impossible, traffic goes through a relay server (TURN) that only forwards encrypted packets and cannot decrypt them.
Data we collect
Account: email, name, a hash of the password (the password itself is never stored), organization name. Guest use: a random device identifier generated in the browser. Session records: start and end time, whether control was granted, whether the connection was relayed, the connecting user. Technical: IP address (short-lived, for rate limiting and abuse prevention), browser language.
Data of the sharing side
We ask no account, email or personal data from the person who installs the extension and shares a tab. Only the temporary 6-digit pairing code and connection signals pass through the server; the code is deleted within 10 minutes.
Purpose
To provide the service, count quotas, bill paid plans, prevent abuse and answer support requests. We do not use account, session or screen data for advertising and do not sell it. To measure how our ads perform, limited data about your visit to our website is shared with Google, and with Meta only if you consent; see Cookies.
Third parties
Payments are processed by Paddle; card details never reach us. Paddle is subject to its own privacy policy. Cloudflare may be used for DNS and traffic protection. Service data is stored on servers inside the European Union. For ad measurement we use Google (Google Ireland Limited and Google LLC) and, only with your consent, Meta (Meta Platforms Ireland Limited and Meta Platforms, Inc.); these companies may process data outside your country, including in the United States, under their own privacy policies. International transfers rely on the safeguards required by applicable law.
Cookies
Strictly necessary items need no consent: a session cookie for login and browser local storage for language, device identifier and your cookie choice (12 months). Advertising cookies are set only if you click Accept in the cookie banner: Google Ads (_gcl_au, 90 days) and Meta Pixel (_fbp and _fbc, 90 days). In that case the page address without query string, browser and device information, IP address, ad click identifiers and these events are shared: Add to Chrome clicks, sign-ups, checkout starts and purchase amounts. If you do not consent or you decline, Meta Pixel never loads. The Google tag runs in Google consent mode instead: it writes no cookies to your device, redacts ad click identifiers and sends only cookieless measurement signals. These signals contain the page address without query string, browser information, IP address and the events above; Google uses them to measure ad results in aggregated and modeled form. Ad code never runs on support session pages. In the account panel it runs only on the billing page, for the purchase event. The content of a shared screen is never shared. For advertising cookies and Meta Pixel the legal basis is your consent (GDPR Art. 6(1)(a), KVKK Art. 5(1)). Declining does not affect the service. You can change your choice at any time with the Cookie settings link at the bottom of the page; withdrawing consent deletes the advertising cookies.
Retention
Session records are kept for 12 months, audit logs for 12 months. When an account is deleted, personal data is removed within 30 days; invoice records required by law are kept for the legal period.
Your rights
Under GDPR and Turkish KVKK you may access, correct, delete, object to processing and port your data. Write to [email protected]; we answer within 30 days.
Security
All connections are TLS encrypted. Passwords are hashed with scrypt. Access is protected by rate limits and lockouts. The database is backed up encrypted.
Changes
When this policy changes, the date is updated and material changes are announced in the panel.