The short version
- Browz is cloud-only: you sign in to a Browz account, and the app talks to the Browz server to sign in, sync and open profiles.
- The server can read your account details (email, plan, devices and their names), when you sign in and from which IP address, which profile is open on which device, team membership and team activity, the sizes and times of what you sync, and the support cases and files you send us. All of it is listed below.
- The server cannot read your profiles, cookies and site storage, proxy addresses and credentials, or fingerprint settings and seeds. Your devices encrypt them with a key from your password before they leave, and the server refuses anything that is not encrypted.
- In a team, the workspace owner can. The owner’s Browz holds a copy of each member’s account key, so the owner can decrypt everything that member syncs. Members are told this when they join.
- The Browz app sends us no analytics, usage data or crash reports. This website uses no cookies, analytics or third-party fonts.
Who we are
[Company legal name] (“Browz”, “we”, “us”), of [registered address], is responsible for the personal data described in this policy. It covers the Browz desktop app, this website and the Browz account service (the “server”), which every copy of the app signs in to.
For privacy questions, email [privacy@ domain]. [Data protection officer and EU/UK representative details, if required].
What the server stores and can read
The server needs these to run your account. We can read them:
| What | Why | How long |
|---|---|---|
| Your email address and when the account was created | Account identity, sign-in, security notices, billing and team invitations | Life of the account |
| A scrypt hash of a sign-in key derived from your password on your device. The password itself never reaches us, nor the separate key that encrypts your data. | Signing in | Life of the account |
| Your plan, seats, billing period and subscription status | Providing what you paid for | Life of the account, plus [accounting retention period] |
| Your devices: the name each computer gives itself (such as “Anna’s MacBook Pro”), when it was added and last seen, and sign-in sessions | Showing and revoking your devices, and “open on another device” | Until you remove the device or sign out; sessions until they expire |
| Sign-in times, the IP address and user agent of each sign-in, login alerts, and your two-factor and IP allowlist settings | Login alerts and account security | [security log retention period] |
| IP addresses of requests, kept only as short-lived rate-limit counters | Stopping abuse | Minutes |
| Launch locks: which profile (by its id) is open on which of your devices, and since when | Opening each profile on one computer at a time | Until the profile is stopped or the lock expires |
| About each synced item: its type and id, a short profile number, its version, whether it is in the trash or deleted, its size, when it changed and from which device, and for a profile whether its proxy changed (a keyed tag that does not reveal the proxy) | Syncing your devices and resolving conflicts | Life of the item |
| Teams: workspace names, members’ emails and roles, invitations, shares and rights, members’ public keys, and the team activity log (who launched or stopped which profile and on which device, shares, transfers, invitations and role changes) | Running the team and showing owners and admins its activity | Life of the workspace |
| Support cases: what you write, the kind of case, the platform and language of the app, and files you attach, such as a diagnostics bundle. The app removes secrets, addresses and names from a bundle before you send it. | Answering you | Cases: [support retention period]. Attached files: deleted 30 days after the case is closed, and never kept more than 90 days after upload, unless the case is on legal hold. Later updates to the case do not extend these limits. Files that were uploaded but never sent are deleted after 1 day. |
| Emails we send you, and whether they were delivered | Delivering sign-up, password reset, security and team emails | [mail log retention period] |
| Proxies you buy through Browz, if that is offered: the order and the proxy details we provisioned for it | Providing and re-delivering the order | Life of the account |
Card details are handled by our payment processor. We never receive or store them.
What the server cannot read
Your devices encrypt the following with a key derived from your password before it leaves them. The server stores the ciphertext and wrapped keys, which it cannot open, and it refuses any upload that is not encrypted:
- profiles: their names, notes, tags, folders and settings;
- cookies, site storage and other browser state;
- proxy addresses, usernames and passwords;
- fingerprint settings and seeds;
- automation flows and the synced settings.
Some things never leave your computer at all: your browsing history, the pages you visit or automate, and settings that describe one machine. Profiles you export are encrypted with a passphrase you choose.
Your account key is protected by your password, and by a recovery key shown to you once. We do not keep a recovery copy of our own, so if you lose your password, your recovery key and (in a team) your workspace owner’s help, we cannot restore your encrypted data.
Teams: what the workspace owner can read
When you join a workspace, your Browz wraps your account key to the workspace owner, and the owner’s Browz holds that copy. The owner’s device can therefore decrypt everything you sync with this account, not only the profiles you share in the workspace. This is deliberate, for two reasons:
- Recovery. If you forget your password, the owner’s Browz can give your key back to you, after you and the owner compare codes, so your synced data is not lost.
- Owner visibility. A workspace owner sees every member’s profiles, as in the other multi-profile browsers. The owner’s copy of your key is also what lets them share or re-key your profiles when your device is offline.
The copy is encrypted to the owner’s own key, so the server still cannot read your data, or the owner’s copy of your key. If you leave the workspace, its copy of your key is deleted from the server; a copy the owner’s device already holds cannot be taken back. If ownership is handed to someone else, the copies move to the new owner. Browz tells you this when you join the workspace. If you do not want a workspace owner to be able to read your data, use a separate account for that workspace.
What the app connects to
Apart from the websites you browse, the app itself makes these connections:
| Connection | When | What it can see |
|---|---|---|
| The Browz server | Signing in, syncing, opening a profile, team actions and support | Your IP address and what is listed under “What the server stores and can read” |
| IP lookup services: ipinfo.io, and ip-api.com if you enable it | When the app checks where a proxy exits | The proxy’s exit address, not yours, because the check goes through the proxy |
| MaxMind (download.maxmind.com) | Only if you add your own MaxMind account to keep the GeoLite2 database current | Your MaxMind account and your IP address, under MaxMind’s privacy policy |
| Google Chrome | Only for Installed Chrome profiles | Google Chrome is Google’s software, and Google’s privacy policy applies to it |
The current version of the app sends us no analytics, usage data or crash reports.
If you contact us or join the beta
We keep your email address and whatever you choose to tell us, such as how many profiles you run, what you use them for, and which computer you use.
Analytics and cookies
The app contains no analytics or telemetry. If we ever add any, it will be off by default and opt-in. It will be limited to counts and yes/no feature usage, with no identifiers and no site names, and crash reports will have file paths removed. Nothing listed under “What the server cannot read” will ever be collected. We will update this policy before any change, not after.
This website sets no cookies, runs no analytics or advertising scripts, and serves its font itself, so loading it makes no requests to third parties.
Why we’re allowed to use your data
Where data protection laws such as the GDPR apply, we rely on these legal bases:
- Contract: to provide your account, plan, sync, teams and support.
- Legitimate interests: to keep accounts secure, prevent fraud and abuse, and enforce our Acceptable Use Policy.
- Legal obligation: to keep financial records and respond to lawful requests.
- Consent: for anything optional, such as product news. You can withdraw consent at any time.
Who we share data with
We name the services we use rather than describing them as “trusted partners”. Each receives only what it needs:
- Hosting: [hosting provider and region].
- Email delivery: [email provider], for sign-up, password reset, security alerts and team invitations.
- Payments: [payment processor], which handles card data directly.
- Helpdesk: [helpdesk provider]. Support cases are forwarded to the helpdesk we configure, which is one of Intercom, a signed webhook to our own helpdesk tooling, or a support email inbox. It receives your email address, what you wrote, the platform and language of the app, and any file you attached.
None of them receives anything listed under “What the server cannot read”, because we cannot read it.
We may also share data with professional advisers, or with authorities when the law requires it. If we receive a lawful request for profile contents, we cannot provide them, because we do not hold them in readable form. If Browz is involved in a merger or acquisition, your data may transfer to the new owner, and we will tell you before it does.
We do not sell your personal data or share it for advertising.
International transfers
[Where data is stored and processed, and the safeguards used for transfers, e.g. standard contractual clauses].
How long we keep data
- Active accounts: for as long as the account exists, except where the table under “What the server stores and can read” gives a shorter period.
- Support attachments: deleted 30 days after the case is closed, and never kept more than 90 days after upload, unless the case is on legal hold; never-sent uploads after 1 day.
- After you cancel: your data remains available for you to export. A lapsed subscription never deletes your profiles.
- After you ask us to delete your account: removed from live systems within [number] days, and from backups within [backup rotation period].
- Suspended accounts: kept and exportable for [retention period], so the owner can contest the decision and the evidence survives.
- Beta enquiries: until the beta ends, or sooner if you ask.
How we protect data
Proxy credentials are encrypted at rest on your computer. Exported profiles are encrypted with scrypt and AES-256-GCM using your passphrase. The app’s local API listens only on your own computer and requires a token you can rotate. Your password never reaches our servers: your device derives a sign-in key from it, and we store only a scrypt hash of that key. What you sync is encrypted on your devices before it is uploaded, and the server refuses anything that is not. [Server-side security measures and breach notification process].
No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to withdraw consent. You can also complain to your local data protection authority.
To exercise a right, email [privacy@ domain]. We will reply within [30] days, and may need to confirm your identity first.
Export works even if your subscription has lapsed. Your ability to leave with your data does not depend on billing.
California residents: we do not sell or share personal information as defined by the CCPA, and you have the rights to know, delete and correct described above.
Children
Browz is not for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We will update this policy before we change how we handle data, not after. For material changes, we will notify you by email, or in the app if you have no account, before they take effect. The date at the top shows when this policy last changed.
Contact
[Company legal name]
[registered address]
Email: [privacy@ domain]