이 페이지는 아직 사용하시는 언어로 제공되지 않습니다. 영어 원문을 읽고 계십니다.
Legal
What the server holds about you
The account itself
An account row holds the email you signed up with, a hash of your password rather than the password, the language you chose and the codes that let you verify the address or reset the password.
Beside it sit the things an account needs to work: the plan you are on, the devices you signed in from, the sessions that keep you signed in, and the payments and subscriptions behind the plan.
Profile settings, and only settings
A profile row holds its name, its scenario, its group, its fingerprint template and the generation that template belongs to, its proxy, its tags and its notes.
That is the whole list. The values a site actually reads are not among them: a fingerprint is derived from the profile identifier every time the profile opens, so there is nothing to store and nothing to leak.
The template, not the fingerprint
A template is a name like the macOS Chrome family. The screen, the cores, the card and the fonts are worked out from it and from the profile identifier at launch.
The generation travels with the profile
A profile keeps the generation it was created under, so the same profile describes the same machine on a second computer.
Locks, so two computers do not open one account
Who holds a profile, from which device and until when. It expires on its own.
What never reaches us
Cookies stay in the profile directory on your disk. The login and password a profile uses to sign in to a site stay there too, sealed by your operating system.
Nothing about what you browsed reaches us: no addresses, no page content, no history. The server has no place to put them and no code that asks.
Proven by running, not by saying
The one secret we do hold
A proxy is different from the rest, because the server has to hand it back to the app for the app to route through it. The proxy password and the address-change link are stored, sealed with a server key.
They are returned only when a caller asks for secrets, which the app does and an ordinary listing does not. If the server has no key configured, the value is stored as it came and the server log says so rather than pretending.
The workspace log
An entry holds who did it, whose workspace it was in, what the action was, when it happened and a small block of details.
The log outlives the row it names. That is the point of it: a team can see who deleted what after the thing is gone.
How to check this page
Every claim above has a file behind it, and they are listed below. The database schema is the shortest way to see the whole picture: a field that is not there cannot hold anything.
What this page does not cover
- It does not say how long each row is kept. Retention belongs to the terms of sale, and those are not written yet.
- It does not describe what a site you visited keeps about that visit. That is theirs, and nothing here reaches it.
- It does not cover the folder you choose for session sync. That folder is yours, on a service you picked, and we never see it.
- It is not legal advice and does not claim compliance with any regime by name.
Where this is decided
Each line is a file you can open.
- Every field the server can hold, in one place
- apps/server/prisma/schema.prisma
- The sign-in pair never leaves the machine, checked by running the app
- apps/desktop/test/login-stays-local.js
- A fingerprint is derived rather than stored
- packages/shared/src/index.js
- Proxy secrets are sealed at rest and returned only on request
- apps/server/src/proxies/proxies.service.ts · apps/server/src/common/crypto/secret-box.ts
- What an entry of the workspace log holds
- apps/server/src/common/audit/audit.service.ts
Questions
- Do you store the fingerprint of each profile?
- No. The template and the generation are stored; the values are derived from the profile identifier each time it opens.
- Do my cookies go to your server?
- No. They stay in the profile directory on your disk. They travel only inside a transfer archive you make yourself, or through the sync folder you chose.
- Why is the proxy password stored when the site password is not?
- Because the server hands the proxy back to the app so the app can route through it. A site password is never needed by anything but your own machine.
- What does a teammate see?
- The profile settings shared with them. Not your cookies, not your sign-ins, and not the secrets of a proxy unless they are asked for by the app.
- Can I get a copy of what you hold?
- Write to us and ask. The list above is what there is to copy.
Nearby
Something here worries you?
Write to us with the line that worries you. A page like this is worth only as much as its weakest sentence.