Last updated: October 2, 2026
This Privacy Policy explains what information Velocity Digital Labs LLC collects when you visit our website or use JustBrowser, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It is written to be read. If anything here is unclear, write to [email protected].
JustBrowser is operated by Velocity Digital Labs LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA ("we", "us", "our"). We are the controller of the personal data described in this policy.
This policy covers the JustBrowser desktop application for Windows (x64) and macOS (Apple Silicon), the web dashboard at justbrowser.app, cloud sync, team workspaces, profile sharing, the in-app proxy marketplace, and our support channels (together, the "Service"). It also covers visits to our public website at justbrowser.app, whether or not you have an account. "You" means the person visiting the website or using the Service.
Your use of the Service is also governed by our Terms of Service (/terms), Acceptable Use Policy (/acceptable-use) and Refund Policy (/refund). Cookie details are in our Cookie Policy (/cookies). Security practices are summarised in /security.
Last updated: October 2, 2026.
We collect only what is needed to run the Service, plus the website analytics described in section 2.11. The full list follows. If a type of data is not listed here, we do not collect it.
When you create an account we collect your email address, your name, and your authentication credentials. If you sign up with a password, we store a hash of it, never the password itself. If you sign in with Google, we store the account identifier Google returns to us and the sign-in tokens Google issues for that link; we do not receive your Google password.
When you register, we also record the IP address, user agent and email address of the request that created the account, as a fraud-prevention record.
Payments are processed by Stripe. We store the Stripe customer id and subscription id for your account. We do not receive or store card numbers.
JustBrowser offers one trial per person, enforced per account and per payment card. An account that has already had a trial gets none at checkout. A card that has already been used for a trial on another account is refused a new one: as soon as we learn of the card, which is after checkout completes, the new subscription is cancelled without any charge, we tell you in the dashboard and by email, and you can subscribe again without a trial. To support this, when a trial starts we ask Stripe for an opaque fingerprint of the card — not the card number — and keep it (section 10).
If you use cloud sync, the archive of each synced profile is uploaded to our storage on Amazon Web Services S3. A profile archive contains that profile's cookies, active sessions and browser storage. This is sensitive data: it can include logged-in sessions for the websites you use inside that profile.
Alongside each encrypted archive we also store a profile summary in our database so your other devices can list the profile before downloading it: the profile's name, notes, tags and folder names, its fingerprint settings, its proxy host, port and username, and the site addresses and usernames of any saved logins. Proxy passwords and saved-login passwords in this summary are stored in encrypted form (section 11). We use this summary only to display your profiles to you and to sync them.
We store the archives so you can restore a profile on another device. We do not open, read, index or analyse the archives themselves. They are encrypted at rest (section 11). The archive is deleted when you delete the profile or your account; see section 10 for what happens to the profile summary.
When you sign in to the desktop app, it registers a device session with us: the IP address it connected from, its user agent, the device name and operating system it reports, the app version, and when it was last seen. These are shown to you in your account's sessions list so you can see which devices are signed in and revoke any of them. Signing in to the web dashboard does not create a session record; the dashboard keeps you signed in with a signed session cookie (section 6).
A session record is kept while the session is active. When you revoke a session, or we revoke it, the record is marked revoked and drops out of your sessions list after 7 days; the record itself, including its IP address and user agent, is deleted 30 days after revocation. A device that has not checked in for 90 days is deleted. These deletions run the next time your account registers a device or a signed-in device checks in — there is no scheduled job — and always with your account.
If you create or join a team workspace we store team membership and the invitations you send or receive. A seat may only open profiles that the owner has shared into the workspace; every member sees the same shared set. If you share a profile directly with another user, we record who shared what with whom, and whether the share carries view-only or launch permission, so we can enforce access.
If you create an API token in the dashboard, we store that token against your account so calls made with it to our cloud API can be authenticated, and so you can revoke it. We also record when each token was last used. The desktop app's local REST API is different: it listens only on your own machine (127.0.0.1) and is protected by a separate token the app generates and stores locally; that token never leaves your device.
If you buy proxy access through the in-app marketplace we record the purchase (what was bought, when, and the amount), the identifier the provider returns for your allocation, your remaining balance on it, and the proxy endpoint we issue you (host, port, username, and the password, which we store encrypted).
We store the notifications we show you inside the Service (for example, a team invitation or a sync result) so they can be displayed and marked as read.
When you email us, we keep the correspondence and any information you include in it so we can answer you and refer back to it.
Our servers use your IP address transiently to rate-limit requests. Rate-limiting keys are short-lived and are not kept as a record of your activity.
We measure how our website is used with two tools: Google Analytics 4, provided by Google, and Cloudflare Web Analytics, provided by Cloudflare, our network provider (section 7). Neither is part of the desktop app, and neither runs on /check or /newtab, the pages the app opens inside your profiles.
Google Analytics: our measurement ID is G-TVZHQ99TZW. Google Analytics is started by a script in the head of the pages of justbrowser.app, including the web dashboard. Whether it loads depends on where you are and on your choices:
Wherever you are, you can turn Google Analytics off at any time with Cookie settings, in the footer of our website and at the bottom of the dashboard's sidebar. We keep your choice in a cookie for 6 months (section 6). Our server works out which group applies from the country that Cloudflare associates with your IP address, so a VPN or proxy can change it.
Google Analytics never runs on /check, /newtab, /reset-password, /invite/… or /fingerprint-checker, on any page whose address contains token= or totp=, or on any page whose next or callbackUrl parameter points to an invitation or password-reset page. If a browser tab loads /check, /newtab or /fingerprint-checker, Google Analytics stays off in that tab until you close it.
When it runs, Google Analytics receives:
No event carries your email address, name, team names, tokens or Stripe identifiers. Google Analytics data redaction is switched on for our website. It is designed to remove text that looks like an email address from event data, and the values of the URL parameters email, token, session_id, callbackUrl and next from the page, referrer and link addresses it records. It works in your browser before the event data is sent to Google, on a best-effort basis, and it does not cover what your browser sends in request headers. In those headers, our pages give other websites only https://justbrowser.app as the referring address, and pages that carry a token give none.
We use Google Analytics only to measure our website. It is not linked to Google Ads, Google signals is off, and its advertising signals are switched off. Event-level and user-level data is deleted after 14 months (section 10). For how Google uses information from sites that use its services, see "How Google uses information from sites or apps that use our services" (https://policies.google.com/technologies/partner-sites).
Cloudflare Web Analytics: Cloudflare adds its Web Analytics script to the pages of our website as they are delivered. We have set Cloudflare not to add it for visitors who connect through its data centres in the EEA, the United Kingdom or Switzerland. For everyone else, it runs on our pages except /check, /newtab and /fingerprint-checker, and the banner, Cookie settings, GPC and DNT do not switch it off. It sets no cookies. The script loads from static.cloudflareinsights.com and reports each page view to Cloudflare through an address on our own domain, justbrowser.app/cdn-cgi/rum. A report contains the address of the page and of the page you came from, both without the part after a "?" or "#", your browser and operating system versions, and performance measurements, such as how quickly the page loaded and how quickly it responded to a click or key press, with the page element involved. As with any web request, it reaches Cloudflare with your IP address and standard browser information. Cloudflare's reports also record the country you visit from and your device type (desktop, mobile or tablet). Cloudflare says Web Analytics does not log query strings, to avoid collecting potentially sensitive data. Cloudflare also says the script does not store any data in your browser, and that Cloudflare discards your IP address at its nearest data centre and does not store it in its core databases or logs (https://developers.cloudflare.com/speed/observatory/rum-beacon/).
We do not collect browsing history or page content from inside your profiles. What you do on websites inside a JustBrowser profile stays between you and those websites.
The desktop app sends us no usage analytics or telemetry. There is none in the app, and neither of the website analytics tools in section 2.11 runs on the pages the app opens inside your profiles.
We do not collect error or crash reports.
Our website runs no analytics other than those described in section 2.11, and it sets no advertising cookies.
The desktop app keeps your profiles, generated fingerprints, proxy settings, saved logins and local settings in a database on your computer. That database is a local file under your control. You can delete any profile from within the app, and uninstalling the app removes the application itself; profile data directories can then be deleted like any other file.
Browser profile cookies and site data are stored in isolated, per-profile directories on your device. They leave your device only if you sync that profile (section 2.3, which also describes the profile summary that sync stores with the archive).
Proxy connections run from your device to the proxy server. Your proxy traffic does not pass through our servers.
If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases.
The website and dashboard set these strictly necessary cookies to sign you in and protect your session: __Host-authjs.csrf-token (expires when you close the browser), __Secure-authjs.callback-url (expires when you close the browser), and __Secure-authjs.session-token (30 days from your last visit, extended each time you use the dashboard). If you sign in with Google, one further cookie, __Secure-authjs.pkce.code_verifier, is set for up to 15 minutes while the Google sign-in is in progress, to protect that sign-in; it is discarded when the sign-in completes. The session cookie cannot be cancelled remotely; signing out deletes it from that browser. If you sign in with Google from the JustBrowser desktop app, one more cookie, jb_dg_nonce, is set for up to 10 minutes while that sign-in is in progress, to protect it; it is deleted when the sign-in completes.
When you make a choice about Google Analytics, in our banner or in Cookie settings, our website stores it in one first-party cookie, jb_consent, for 6 months unless you or your browser delete it sooner. It holds only your choice, the date you made it and a version number, and we treat it as strictly necessary. If it expires or you delete it, we treat you as not having chosen yet.
Where Google Analytics runs (section 2.11), it sets two first-party cookies on justbrowser.app: _ga, which holds a random identifier for your browser, and _ga_TVZHQ99TZW, which keeps track of your current session. They are not strictly necessary. They last up to 2 years from your most recent visit unless you or your browser delete them sooner. Blocking or deleting them does not affect signing in.
No other first-party cookies are set, we set no advertising cookies, and as of the date of this policy none of our infrastructure providers sets a cookie on justbrowser.app. Cloudflare Web Analytics (section 2.11) sets no cookies.
If you are in the United Kingdom, Switzerland or the EEA, we ask for your consent with a banner before Google Analytics sets any cookie. Elsewhere, Google Analytics cookies are set without asking you first, and, wherever you are, we will ask before setting any other non-essential cookie. Wherever you are, you can turn Google Analytics off at any time with Cookie settings, in the footer of our website and at the bottom of the dashboard's sidebar, and it does not load if your browser sends a Global Privacy Control or Do Not Track signal.
The dashboard does not currently store anything in your browser's localStorage. If it does in future, it will only be interface preferences, such as a chosen layout, which never leave your browser.
Some pages keep a value in your browser's session storage, which belongs to a single tab and is cleared when you close it. The password-reset page (jb_reset_token) and the team-invitation page (jb_invite_token) keep the code from the link you followed while you finish; the code is sent to us only when you complete the reset or accept the invitation. The /check, /newtab and /fingerprint-checker pages keep a flag (jb_ga4_off) that keeps Google Analytics off in that tab.
Cookies stored inside your JustBrowser profiles are set by the websites you visit, not by us, and are covered by section 3. Full details are in our Cookie Policy (/cookies).
We use the following service providers (sub-processors) to run the Service and our website. Each is bound by contract to process data only on our instructions.
We also use Google Analytics, provided by Google LLC (United States), to measure how our website is used (section 2.11). Where it runs, Google receives the page views, events and technical data described in section 2.11 and the random identifier in the _ga cookie. Google provides Google Analytics to us under its terms. We have turned off all of Google Analytics' data-sharing settings, including the one that would let Google use our data to improve its own products and services. Google says that, with these settings off, the data is used only to provide, maintain and protect the Google Analytics service.
We may disclose information if the law requires it, to respond to a valid legal request, to enforce our Terms of Service or Acceptable Use Policy, or to protect the rights, property or safety of our users or others. If Velocity Digital Labs LLC is involved in a merger, acquisition or sale of assets, your information may transfer to the successor, who will be bound by this policy.
We do not sell, rent or trade personal information, and we have not done so.
Our servers and storage are in the United States. If you use the Service from outside the United States, your data is transferred to and processed there.
For users in the European Economic Area, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the safeguard for those transfers. For users in the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs. You can ask us for a copy of the relevant clauses at [email protected].
Website analytics data (section 2.11) is also processed by Google, for Google Analytics, and by Cloudflare, for Cloudflare Web Analytics, and may be processed outside your country, including in the United States. Google states that, for its advertising and analytics products, it relies on the EU-U.S. Data Privacy Framework for transfers of personal data from the EEA to the United States and, in certain circumstances, on the UK Extension to that framework and the Swiss-U.S. Data Privacy Framework for transfers from the United Kingdom and Switzerland, and that it may rely on Standard Contractual Clauses where no such framework applies (https://business.safety.google/adsdatatransfers/). For Google Analytics data, we rely on those safeguards. For Cloudflare Web Analytics data, we rely on the safeguards in Cloudflare's Data Processing Addendum, which provides for transfers under the Data Privacy Framework and under the Standard Contractual Clauses, with amendments for the United Kingdom and Switzerland (https://www.cloudflare.com/cloudflare-customer-dpa/).
We have not appointed a representative in the European Union under Article 27 of the GDPR or in the United Kingdom under Article 27 of the UK GDPR. Data subjects in the EU or UK can contact us directly about any privacy matter at [email protected], and we will respond in the same way and within the same time as we would through a representative. If we appoint one, we will update this section.
We keep personal data only as long as needed for the purpose we collected it. Periods by data type:
Here is exactly what we do, without overstating it.
Proxy credentials and saved logins are encrypted with AES-256-GCM using a per-account key issued to your account after you sign in. Because the key is per account, not per device, a synced profile can be opened on another machine where you are signed in. Our server derives that key from your account id and a server-side secret and sends it to the app after sign-in, so it is not an end-to-end key: it protects these fields on your device and in sync archives, but we could reconstruct it. We do not use it to read your data.
The local database on your computer is not encrypted as a whole. It is a local file under your control, protected by your operating system's user account and disk encryption if you have enabled it. Anyone with access to your user account on that computer can access it.
Synced profile archives are encrypted at rest on Amazon S3 using server-side AES-256 encryption.
All traffic between the desktop app, the dashboard and our servers uses TLS.
Passwords are stored as hashes. We never see or store the password itself.
The local REST API listens only on 127.0.0.1 and requires a bearer token, so other machines on your network cannot reach it.
Our installers are not yet code-signed; signing is in progress. Until then, download JustBrowser only from justbrowser.app.
We have not had an independent security audit and hold no security certification. /security states plainly what we do and do not have.
No system is perfectly secure. If we learn of a breach affecting your personal data, we will notify you and any regulator as the law requires. To report a security issue, email [email protected]. More detail is in /security.
Wherever you live, you can view and change your account details, review and revoke desktop device sessions, revoke API tokens, and delete profiles and their synced archives from within the Service. You can also delete your account yourself from Settings in the web dashboard: deletion takes effect immediately and cancels any active subscription at the same time. If you prefer, email [email protected] from the address on the account and we will delete it for you within 30 days. Either way, the trial card fingerprint token described in section 10 is retained.
If you are in the EEA, the UK, or another jurisdiction with similar rights, you also have the right to:
You can turn Google Analytics off at any time with Cookie settings, in the footer of our website and at the bottom of the dashboard's sidebar. If you are in the United Kingdom, Switzerland or the EEA, it runs only if you accept it, and if your browser sends a Global Privacy Control or Do Not Track signal, it does not load anywhere. You can also delete the _ga and _ga_TVZHQ99TZW cookies in your browser (/cookies). Deleting them only resets the identifier: outside the United Kingdom, Switzerland and the EEA, Google Analytics sets new ones on your next visit unless you have turned it off in Cookie settings. In the United Kingdom, Switzerland and the EEA, it does the same if you have accepted it. You can also use Google's opt-out browser add-on, which according to Google stops Google Analytics from being used in your browser (https://tools.google.com/dlpage/gaoptout). None of these switches off Cloudflare Web Analytics, which sets no cookies (section 2.11); to stop it in your browser, block scripts from static.cloudflareinsights.com.
Website analytics data is not linked to your account, name or email address. In Google Analytics it is linked only to the random identifier in your browser's _ga cookie, and Cloudflare Web Analytics sets no cookies. This means we usually cannot find your website analytics data from your email address. To see or delete your Google Analytics data, email [email protected] with the value of your _ga cookie, which you can find in your browser's site data for justbrowser.app. We will tell you what Google Analytics holds against it and, if you ask, delete it with Google's user-deletion tool. Deletion does not remove figures already counted in aggregated reports, such as the number of visits to a page. Cloudflare Web Analytics reports carry no lasting identifier for your browser, so we cannot find or delete yours.
Email [email protected] from the address on your account, or tell us which account you mean. We will respond within 30 days. We may ask you to confirm your identity before acting, and we will not delete data we are legally required to keep. Exercising these rights is free unless a request is clearly unfounded or excessive.
This section applies if you are a California resident. It adds to, and does not replace, the rest of this policy.
We collect this information directly from you, from your use of the Service, from Stripe (billing references and the trial card fingerprint token), and from your browser through the website analytics described in section 2.11. We use it for the purposes in section 4: providing the Service, billing, security and abuse prevention, support, website analytics, and legal compliance.
We do not sell personal information. We do not share personal information for cross-context behavioural advertising. We have not done either in the preceding 12 months, and we do not use personal information for targeted advertising. We disclose personal information only to the service providers listed in section 7, for business purposes, under contracts that restrict their use of it.
We do not knowingly sell or share the personal information of anyone under 16.
Email [email protected]. We will confirm your identity by matching the request to the email address on your account and, where needed, asking you to confirm from that address. We will respond within 45 days, or tell you if we need up to 45 more.
You may use an authorised agent to make a request for you. We will ask the agent for written permission signed by you, and we may still ask you to verify your identity directly with us.
Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a request to opt out of the sale or sharing of your personal information. We do not sell or share personal information, so in that respect honouring the signal changes nothing. On our website, the signal also stops Google Analytics from loading, wherever you are (section 2.11).
Do Not Track (DNT): there is no accepted standard for how websites should respond to DNT signals. On our website, a DNT signal stops Google Analytics from loading, as GPC does. We do not otherwise respond to Do Not Track signals. We do not track you across other websites.
Neither signal switches off Cloudflare Web Analytics, which sets no cookies (section 2.11).
Third parties: where Google Analytics runs, Google collects information about your visits to justbrowser.app over time, as described in section 2.11, and the _ga cookie lets Google Analytics recognise your browser on later visits to our site. Google says each _ga cookie is unique to the Google Analytics property that sets it, so it cannot be used to track a browser across unrelated websites (https://policies.google.com/technologies/cookies). We have not turned on Google signals or linked Google Analytics to Google Ads. Cloudflare also receives information about your visits to our pages through Cloudflare Web Analytics (section 2.11). The websites you visit inside a JustBrowser profile are operated by third parties, and those websites may collect information about your activity over time and across different sites. Their collection is governed by their own privacy policies, not this one.
The Service is not directed to anyone under 18 and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has given us personal information, email [email protected] and we will delete it.
If you are unhappy with how we handle your personal data, please tell us first at [email protected] so we can try to put it right.
You also have the right to lodge a complaint with a supervisory authority. In the European Economic Area, that is the data protection authority of the member state where you live, work, or where the alleged infringement took place; the European Data Protection Board publishes the list of authorities. In the United Kingdom, it is the Information Commissioner's Office (ico.org.uk). In Switzerland, it is the Federal Data Protection and Information Commissioner (edoeb.admin.ch). In California, you may contact the California Privacy Protection Agency or the California Attorney General.
We may update this policy. When we do, we will post the updated version at /privacy with a new "Last updated" date and, for changes that narrow what you may do or reduce your rights, notify account holders by email before they take effect. The current version is always at /privacy.
Privacy questions, data subject requests and account deletion: [email protected]
Abuse reports, refunds and legal notices: [email protected]
Vulnerability reports and security disclosures: [email protected]
Post: Velocity Digital Labs LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA.
We'd like to use Google Analytics, a Google service, to understand how our website is used. It sets two cookies in your browser and runs only if you click Accept. You can change your choice at any time with Cookie settings. Cookie Policy
Sign-in cookies and the cookie that remembers this choice are always on; the website needs them to work.
Google Analytics, a Google service, helps us understand how our website is used. It sets two cookies, _ga and _ga_TVZHQ99TZW. It is now onoff in this browser. If your browser sends a Global Privacy Control or Do Not Track signal, it stays off. Cookie Policy