Privacy Policy

1. Who we are

CloudBrowser.tv operates this Service from the United States. This policy covers our website, account, billing and hosted browser service. For privacy questions and requests, contact [email protected]. Websites you visit inside a cloud browser and agent providers you choose have their own privacy practices.

2. Information we process

• Account information: authentication identifiers, verified email, name and profile image supplied through Auth0, plus workspace membership and plan.
• Browser data: browser names, lifecycle state, saved Chrome profiles, cookies, local storage, files and desktop content processed by the hosted runtime and viewer transport.
• Access and usage records: API-key and connection-grant records, permissions, link names, runtime usage, operations, connection counts and last-use times. Live View owners can see a signed-in viewer’s name, avatar, recent viewing time and approximate online status. CDP activity identifies a link rather than a verified person.
• Billing and support: Stripe customer and subscription identifiers, invoices, usage charges, payment status and information you send us. Payment card entry is handled by Stripe; our application does not store full card numbers.
• Technical and measurement data: network and device information processed by hosting and security providers, operational errors and limited website analytics, as explained in our Cookie Policy.

3. How we use information

We use this information to authenticate accounts, provide and persist browsers, carry out lifecycle and sharing instructions, enforce permissions, meter usage, collect payment, provide support, investigate abuse and operate and improve the Service. Where applicable law requires a legal basis, these purposes rely on performing our agreement with you, complying with legal obligations, legitimate interests in operating and securing the Service, or consent where required.

4. Providers and disclosures

Our current providers include Auth0/Okta for authentication, Sandbox0 for browser runtime and profile infrastructure, DigitalOcean for application hosting, Supabase for PostgreSQL storage, Cloudflare for DNS, traffic delivery and security, Stripe for payments, and Google Analytics for limited website measurement. Providers receive the information needed for their role. See Okta’s privacy policy, Stripe’s privacy policy and Google’s privacy policy for their practices.

We also disclose data to people and tools you authorize, when legally required, to investigate abuse or protect rights and safety, and in connection with a business transfer subject to applicable protections. We do not sell personal information or use it for cross-context behavioral advertising. Browser contents are not sent to our website analytics.

5. Shared browsers and agents

Anyone you authorize to control a browser may be able to read its page content, use logged-in accounts and change or export data. A fork inherits saved profile data. Agents and external websites receive information through the actions you authorize. Removing a shared browser from your own list removes your access relationship; it does not delete the owner’s browser. Owners can revoke source links. Avoid placing other people’s information in a browser without appropriate authority.

6. Cookies and measurement

We use essential authentication and viewer cookies and local interface preferences. Google Analytics currently measures selected public pages and limited registration success/failure events. Public page measurements use canonical paths and omit query strings and fragments; registration events use a generic public location rather than the private Console path. Google Signals and advertising personalization are disabled. Legal pages are outside the page-view allowlist. See cookies and your controls.

7. Retention and deletion

We retain information as needed to provide the Service, maintain security, resolve disputes and meet billing and legal obligations. Retention depends on the type and purpose of the record; no fixed browser archival period is promised. Paused profiles remain stored and are not deleted merely by pausing. Deleting a browser initiates runtime deletion and removes access, while associated database metadata, billing records, security records and backups may remain. Deletion from all provider backups is not immediate. Contact [email protected] to request account closure, personal data deletion or details about retention for your account. We may retain records where required or permitted by law.

8. Security and international processing

We use account authorization, scoped connection permissions and protected session cookies to restrict access. Sensitive connection secrets are stored as hashes or encrypted values according to their purpose. No system is completely secure; protect credentials and revoke exposed links. The Service and its providers may process data in the United States and other countries with different privacy laws. Contact us before using the Service if your organization requires a data processing agreement, a specific processing region or transfer terms; this policy does not itself provide those agreements or guarantees.

9. Your choices and rights

You can edit or remove browser resources, revoke your links and cancel subscriptions through the Console. Depending on where you live, you may also request access, correction, deletion, a portable copy, restriction or objection to processing, or withdrawal of consent where processing relies on it. Send requests, including an appeal of a request decision, to [email protected]. We may verify identity and authority before acting and will respond as required by applicable law. You may contact your local privacy regulator. We do not discriminate for exercising applicable privacy rights. Browser settings and Google’s opt-out tools provide additional analytics controls.

10. Children and changes

The Service is intended for adults and is not directed to children under 18. Contact us if you believe a child has provided personal information. We will update this policy as our practices change, publish the revised date and provide notice of material changes through the Service or email where appropriate or required.