The Best Privacy-Friendly New Tab Extensions in 2026

I built Meelio, so before anything else: this is a post about my own product’s category, written by someone with an obvious reason to want it to look good. I’m not going to win that by attacking competitors I haven’t read the policies for. Where I could verify a claim — against a privacy policy, a Chrome Web Store disclosure, or Meelio’s own source — I did, and stamped it with the month checked. Where I couldn’t, I say so in place — or left the claim out. If you only take one line from this post: Bonjourr wins outright. No account, ever, and GPL-3.0 licensed — anyone can read every line of it. Meelio is honestly second place, and I’ll explain exactly why.

What “private” actually means for a new-tab extension

“Privacy-friendly” gets used as a vibe more often than a claim you can check. Four things are worth separating:

1. What leaves your device by default — does opening a new tab send anything anywhere, or just read local storage?
2. Whether an account is required for the core to work, not just offered.
3. Whether analytics or tracking ships inside the product itself, not just the marketing site.
4. What permissions the extension asks for, and whether they’re requested up front or only when a feature needs them.

A product can be private on one axis and not another. Bonjourr and Tabliss are close to a clean sweep. Meelio is local-first on the first and third axes but has an optional account layer. Momentum and Flocus are built the other way — account-first, with local storage playing a smaller role.

Five questions to ask before you install one

1. Does the free tier work without ever creating an account — not “can I dismiss the signup screen,” does it actually function signed out?
2. What does the Chrome Web Store’s “Data collected” disclosure list, not the marketing copy?
3. Does the privacy policy name specific third parties (payment processor, analytics vendor, host), or just boilerplate?
4. Is the source available to read? Open source doesn’t guarantee good behavior, but makes the claim checkable instead of asserted.
5. What happens the moment you sign in? Every sync feature eventually needs an account — the question is whether everything else keeps working without it.

The extensions

Bonjourr — for zero account, ever

Bonjourr is a minimalist start page: search, shortcuts, weather, a clock, background/quote customization. It’s open source under GPL-3.0 (confirmed on GitHub, checked July 2026), and its privacy policy states plainly: “We do not collect, store, or share any data the user generates on Bonjourr.” Settings live in local extension storage, which the developers say they can’t access. No account is ever required.

One nuance Bonjourr’s own docs name too: if you’re signed into your browser (Google in Chrome, a Firefox account in Firefox), settings sync through that browser’s own mechanism by default — toggleable in settings. That’s the browser vendor’s sync, not a Bonjourr account. It also talks to a few third parties to do its job — Unsplash for photos, a weather provider, Google/DuckDuckGo for search suggestions, Fontsource for fonts — none of which need a Bonjourr account.

Chrome Web Store, checked July 2026: roughly 300,000 users, 4.9★ across ~23,500 ratings — real scale proof that privacy-first, zero-monetization new tabs can win this category. The tradeoff is scope: no timer, no site blocker, no task manager. If you want a calmer new tab and nothing else, this is the honest best answer.

Meelio — local-first by default, account is opt-in

Meelio has no analytics SDK anywhere in the extension or web app — verified against the codebase, not asserted from a marketing page. The core tools (Pomodoro timer, site blocker, notes, to-do list, breathing exercises, tab management, zen mode) run on local IndexedDB storage and need no account. The blocker specifically uses Chrome’s built-in declarativeNetRequest API — rule matching, no network call involved in blocking a site.

Meelio’s Firefox listing is a useful independent check, because Mozilla structures this disclosure rather than letting a developer write prose: the manifest’s data_collection_permissions field declares required: ["none"]. The optional categories — authentication, personally identifying, location info — only apply if you turn on sign-in, sync, or location-based weather.

Where this gets less clean than Bonjourr: Meelio’s Chrome Web Store listing (checked July 2026) discloses “personally identifiable information, authentication information, user activity” — broader than Bonjourr’s. That’s not a contradiction of local-first; the listing covers everything the extension can do, including optional signed-in paths (auth for your account, whatever you type to the Pro-only Ask AI assistant, which calls api.meelio.io). CWS discloses the ceiling, not the default — but I’d rather flag that gap than pretend it’s not there.

Two precision notes, since “works offline” claims get sloppy in this category: the 32 ambient sounds stream from a CDN, not bundled at install — the catalog begins downloading into local storage shortly after setup, and playing an uncached sound also queues it for download. Successfully cached sounds replay offline; uncached sounds still need a connection. Wallpapers work the same way — roughly the last 6 viewed cached, out of 375 total. One honest limitation for this list specifically: Meelio is not open source, so unlike Bonjourr or Tabliss you can’t audit the code yourself — the checkable signals instead are the store listings’ data-collection disclosures, the Firefox listing’s declared “no required data collection,” and what you can observe in your own devtools network tab (nothing, for the local features). It’s also the smallest product in this comparison — current scale figures are in the table below.

Tabliss — the other zero-account option

Tabliss is a similarly minimalist, widget-based new tab, open source under GPL-3.0 (checked July 2026). Its Chrome Web Store listing (checked July 2026) states it “does not require any permissions,” with roughly 100,000 users at 4.7★ across 383 ratings. Its privacy policy is close to Bonjourr’s: no account, and the only data collected is anonymous crash reports sent to Sentry — third parties like Unsplash are contacted only if you enable a source that needs them. Tabliss is widgets only — no site blocker or task manager (checked August 2026); treat it as another zero-account, open-source option, not a productivity-suite alternative.

Where Momentum and Flocus stand

I’m not calling these two “not private” — that’s a claim I can’t back without reading their full policies. Here’s what their own published policies and CWS disclosures actually say, checked July 2026.

Momentum’s privacy policy names specific vendors: PostHog for analytics, DataDog for infrastructure, Stripe for payments, Mailchimp for email, Azure/OpenAI for AI features, Zendesk/Slack for support — hosted on Microsoft Azure, “not sold to third parties.” Its CWS listing discloses “personally identifiable information, authentication information.” Install prompts for name/email/password right away; Momentum’s own help center confirms the dashboard works without an account (checked August 2026), with an account needed for cross-device sync or Plus. Scale: ~2,000,000 users, 4.5★ across ~13,800 ratings.

Flocus’s privacy policy names a broader field set for a browser product — name, email, username, IP, device info, usage patterns, preferences, cookies, support interactions — with Stripe for payments and unnamed “cookies and similar tracking technologies” for analytics. CWS discloses “personally identifiable information, user activity.” Flocus is web-first, so more of its architecture assumes a signed-in session by design; the free dashboard’s core task list works with no sign-up required, per Flocus’s own feature pages (checked August 2026). Scale: ~4,000 users, 4.6★ across 7 ratings.

Neither is doing anything hidden — both name vendors and both say they don’t sell data. The honest framing is architectural: Momentum and Flocus are cloud-account-first because sync is core to the product from day one. Bonjourr, Tabliss, and Meelio are local-first, with an account layered on only where a server is genuinely needed. For where Momentum specifically wins and loses against Meelio (including where Momentum is flatly better — scale, polish), see Meelio vs Momentum.

What’s local vs. account-gated in Meelio, specifically

Fully local, no account, ever: Pomodoro timer, site blocker, zen mode, notes, tasks and goals, breathing exercises, tab management.

Fully local but capped free (the cap lifts with a paid account; the local-only part doesn’t change): 1 saved tab stash, 3 custom backgrounds, 2 simultaneous soundscape layers (no saved custom mixes free), 3 of 8 color tints, 5 custom quotes, 2 trackers, 1 link group.

Free, but requires a signed-in account: cross-device sync (moved out of the paid tier entirely as of 2026-07-27 — Flocus and Freedom still charge for syncing your own data, while Momentum, like Meelio, syncs on a free signed-in account, checked August 2026), Google Calendar or an ICS feed, Google Tasks. Basic weather also needs a signed-in account (the weather API requires a session) — but location comes from Cloudflare’s coarse network-level geolocation at the CDN edge, not GPS and not a browser location permission, so Meelio never asks for or stores a precise position.

Requires an account and a paid plan: Ask AI (a focus assistant, not a writing tool — calls api.meelio.io), advanced hourly weather, PM-tool sync with Todoist, Asana, ClickUp, GitHub. Pro is $4/month, $40/year, or $99 once, 14-day trial, no card.

On permissions: Meelio’s manifest requests storage, alarms, tabs, webNavigation, and the declarativeNetRequest pair up front — all local, nothing here phones a server. tabGroups, bookmarks, notifications, topSites are optional, requested only when the relevant feature is turned on. The one broad ask — optional access to all URLs — exists because the blocker has to match any domain you tell it to block, requested when you first configure a blocklist, not silently at install.

What leaves your device, at a glance

FAQ

Which of these is the most private, honestly? Bonjourr — no account ever, nothing collected beyond what an enabled feature needs, GPL-3.0 so the claim is checkable. Tabliss is close behind on the same logic.

Is Meelio actually private, or just “private enough”? The core is local-first, no analytics SDK, no account requirement — as clean as Bonjourr’s. Where it’s behind: an optional account layer for sync, calendar, integrations, and paid features, and a CWS disclosure that reflects that broader surface even though the signed-out default doesn’t touch it. If “no account layer could ever exist” is your bar, Bonjourr clears it and Meelio doesn’t.

Do Momentum or Flocus sell my data? Both state in their own policies that they don’t sell personal data to third parties. Neither is local-first, though — both default to an account and cloud storage, with named vendors doing the processing.

Does “open source” actually mean anything for privacy? It means the claim is checkable. Bonjourr and Tabliss publish their code; Meelio, Momentum, and Flocus don’t. It doesn’t guarantee good behavior, but it’s the difference between “trust us” and “here’s the diff” — and it’s a real point in Bonjourr’s and Tabliss’s favor on this list. For closed-source tools, the fallback checks are the store’s data-collection disclosure and your own devtools network tab.

If I want blocking and task management, not just a clean new tab, does the privacy-first pick still hold? Not from this list alone — Bonjourr and Tabliss are start pages, not focus tools. Meelio is the one here built around a real blocker and task manager on the same local-first storage; see best new tab extensions for productivity if the blocker and timer matter as much as the privacy story.