--- title: "Privacy" description: "What Scalebrowser collects, why, how long it keeps it, and the rights you have." canonical: "https://scalebrowser.net/legal/privacy" last_modified: "2026-10-23T18:22:53.000Z" --- > ## Documentation Index > Fetch the complete documentation index at: https://scalebrowser.net/llms.txt > Use this file to discover all available pages before exploring further. # Privacy Last updated: 2026-08-20 ## Controller Company: Davide Valli Address: Hirschstettner Straße 63, 1220 Vienna, Austria Email: ## What the product itself does not send us Scalebrowser runs on your own machine. Profiles, cookies, saved passwords, passkeys and the screenshots an agent takes are written to your disk and stay there. We operate no hosted execution, so none of that reaches us, and a breach on our side cannot expose a file that never left your machine. ## Account and contract To create and run an account we process your email address, a hash of your password, your sessions and, if you enable them, your second factor and passkeys. Legal basis: performance of a contract, Art. 6(1)(b) GDPR. The data is deleted when you delete your account, after the 30-day restore window has passed. If you sign in with Google or GitHub, that provider tells us your name, your email address, whether it has confirmed that address, a link to your profile picture and the id of your account there. We keep the id so that we recognise you at your next sign-in. We do not keep the access the provider grants us, and we read nothing from your Google or GitHub account after you have signed in. The provider learns that you signed in to Scalebrowser; what it does with that is governed by its own privacy terms, as an independent controller. Legal basis: performance of a contract, Art. 6(1)(b) GDPR. You can disconnect either provider under Settings, Security. While a browser runs, your installation reports this to us once a minute, because your plan sets how many browsers may run at the same time. From that we keep one line per account and day: that a browser ran that day, and how many were started. It names no profile, no machine and no time of day. We use it to see whether customers keep working with Scalebrowser after the first days. Legal basis: our legitimate interest in knowing whether the product is used, Art. 6(1)(f) GDPR. It is deleted with your account. ## Where a new account came from When you create an account, we store once, next to it, where the sign-up came from and what it was made with: a mark or campaign tags in the address of the sign-up page if there were any, the country, region and city your network address belongs to according to a free database, the name of your browser, your operating system, your device type and your preferred language. Your network address itself is not stored. We also store the value described under "How we count visits". It lets us see which of our pages that browser opened before signing up, and which site the first of those visits came from. It reaches back as far as those lines live, which is 25 months. We use this for one thing: to see which of our pages and which outside links bring customers. It is not stored on your device, no advertising network ever sees it, and it is deleted with your account. Legal basis: our legitimate interest in knowing which parts of our own site work, Art. 6(1)(f) GDPR. You can object at any time by writing to the address above. ## What you tell us after sign-up After you create an account, we ask three questions: what you want to use Scalebrowser for, what you do, and how you heard about us. We store your answers next to your account and use them for two things: to show you the setup steps that fit your goal, and to see which channels bring customers. Legal basis: our legitimate interest in helping you get started and in knowing which of our channels work, Art. 6(1)(f) GDPR. If you tick "Email me tips for my goal", we store that choice and when you made it, and we may send you a few emails while you set up. Legal basis: your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time by writing to the address above; it does not affect any other email we send you. We also note which setup steps you have completed, so the list on your dashboard can tick them off. Most of them come from records we already keep, such as your plan or the first time a browser started. One comes from the app on your computer: the moment an AI agent first uses one of your browsers, the app tells us that it happened. That message names no profile, no page and no task. All of this is deleted with your account. ## Cookies on this website This website sets two cookies that it needs to work at all. One carries your login session, so that you stay signed in between pages. The other is set only when you confirm your identity for a sensitive action, such as changing your password or deleting your account, and it expires shortly afterwards. A third cookie, named sb-vid, recognises your browser. When you open one of our pages, our server stores a random identifier in it. It contains no information about you, lasts 400 days from your last visit, and lets us recognise the same browser across visits, even when your network address changes, so that one person is counted once. It is described further under "How we count visits". A fourth cookie exists only if you ask for it. On [the opt-out page](https://scalebrowser.net/opt-out) you can tell us not to count this browser. That page sets a cookie named sb-count, which holds a fixed word, stays on this domain only and expires after one year. It also deletes sb-vid, and no new one is set while sb-count is there. We run no tracking pixels, no advertising network and no third-party scripts, and everything described here stays with us. This site does not ask for cookie consent. The first two cookies are what the service needs to function. The sb-vid cookie and our own script serve our legitimate interest in understanding how our own site is used, Art. 6(1)(f) GDPR, and you can object at any time on the opt-out page, which switches all of it off for your browser. Legal basis for the first two cookies: performance of a contract, Art. 6(1)(b) GDPR; for the opt-out cookie, carrying out your objection, Art. 21 GDPR. ## How we count visits We count how often our public pages and our documentation are opened, and we count on our own server. There is no cookie for it, no advertising network and no service of anyone else. One line is written per page view. It holds the path you opened, the address of the page that linked you here without its query part, campaign tags in the address, how long our server took to answer, and a few details our server derives from the request: the country, region and city your network address belongs to according to the free DB-IP Lite database, the network operator behind that address and whether it is known to belong to a data centre, the Tor network or a VPN, what kind of network it is (an internet provider, a company, a university, a public body or a hosting provider) according to the free ipverse database, the name of your browser, your operating system, your device type and your preferred language. It also notes a few facts your browser states in its request: which platform and compression formats it announces, whether you arrived from another site, typed the address yourself or opened a link inside an app such as Instagram, and which app that was. If your address is on a list a search engine or AI provider publishes for its own crawlers and agents, or your request carries such a provider's signature, the line names that service; the signature is checked against the key the provider publishes. Your network address itself is not stored. A small script of our own runs on the page and reports how long it stayed visible, how long it was used, how far you scrolled, the size of your window, your time zone and whether your device asks for a dark or a light appearance. It also answers a few yes or no questions that tell a person from a program: whether the browser reports that software is driving it, whether it draws graphics without a graphics card, which kinds of input reached the page (pointer, touch, scroll wheel, keyboard) and whether pointer input came from a real device. It sends only to us, and the page works the same without it. The same script also records each click on a page: the name of the button or link (never what you typed into a field), where on the page and in the element you clicked, and your window width. It reads stable properties of your device (screen size, pixel density, processor cores, memory, time zone, languages and the name of your graphics chip), and our server stores only a keyed hash of them, which we use to suggest that two browsers on the same device probably belong to one person. To show where people click, our server fetches a copy of the public page without any scripts. Once you interact with one of our public pages, our script also records the session: how the page looked, pointer movements, scrolling and clicks. It sends the recording to our server only. Everything you type is masked before it leaves your browser, and nothing is recorded on the free check, your dashboard or your settings. Recordings are deleted with the visit they belong to, and after seven days if the visit was not made by a person or an AI agent working for someone. From these answers the server files each visit as a person, an AI agent working for someone, an automated program, or unproven. The numbers we look at count people only. The filing is kept with the visit and deleted with it. To tell visitors apart, the line carries the identifier from the sb-vid cookie and a value computed from your network (over IPv6 only the first half of the address), the family of your browser, your operating system, your device type and a secret that only our server knows. The value cannot be turned back into any of that, and it stays the same for as long as those stay the same. Because lines are deleted after 25 months, that is also the longest a browser can be recognised. If you are signed in, the value is computed from your account instead. Programs that read our documentation in a machine format, such as llms.txt, are counted the same way as a separate kind of line. What remains after those 25 months are daily totals, and they carry no such value at all. When a visit is not counted, for example because you opted out, our server keeps a keyed hash of its network for two days. Programs that read our documentation from the same network within a day are then not counted either. The network address itself is not stored. We use all of this for one thing: to see whether the pages we publish bring people and how they use them, which needs telling people apart from programs. Legal basis: our legitimate interest in knowing whether our own site works, Art. 6(1)(f) GDPR. You can object at any time under Art. 21 GDPR: open [the opt-out page](https://scalebrowser.net/opt-out) to stop counting this browser, delete the sb-vid cookie and switch that script off, including the click capture and the recording, or write to the address above. ## Payment Payments run through Stripe. We do not see or store card numbers; Stripe processes them as the payment provider and returns only what we need for billing and for the subscription state. Legal basis: performance of a contract, Art. 6(1)(b) GDPR, and our legal obligation to keep invoices, Art. 6(1)(c). ## The free check The check measures the browser you visit it with and shows you the result. Measuring starts when the page opens, because measuring is the service you came for. The values are sent to our server to be judged there and are not kept from that request. Legal basis for that step: Art. 6(1)(b) GDPR, performing what you asked for. The measurement then joins a reference set, so that the rarity figures beside your result come from real traffic rather than from a cited study, and so that the tool can tell you when it recognises a device it has seen before. Every feature is stored as a keyed hash and never in the clear; separately, a plain counter records how often a value like a screen size occurs, which carries no route back to any measurement. No record holds an IP address, a cookie, an account or any identifier of you. Legal basis: our legitimate interest, Art. 6(1)(f) GDPR. Records expire after 90 days. You can object at any time under Art. 21 GDPR by writing to the address above. A shared copy of a result is different: it holds the full reading in the clear, it only exists because you clicked to create it, and you can revoke it from its own page. The captcha test at /check/captcha loads Cloudflare Turnstile, Google reCAPTCHA, hCaptcha and MTCaptcha only after you click to load them. Cloudflare, Google, Intuition Machines (the company behind hCaptcha) and Sun Spray Technology (the company behind MTCaptcha) then receive your IP address and signals from your browser, as on any site that uses their captchas. Google describes that processing in its [privacy policy (opens in a new tab)](https://policies.google.com/privacy), Cloudflare in its [Turnstile privacy addendum (opens in a new tab)](https://www.cloudflare.com/turnstile-privacy-policy/), Intuition Machines in the [hCaptcha privacy policy (opens in a new tab)](https://www.hcaptcha.com/privacy), Sun Spray Technology in the [MTCaptcha plugin privacy policy (opens in a new tab)](https://www.mtcaptcha.com/legal-privacy-captcha). The token a widget returns goes to our server only so that the provider can confirm it, and is not kept. Legal basis: Art. 6(1)(b) GDPR, performing what you asked for. Three tools work with something you type in. The proxy checker at /check/proxy-checker uses the proxy and its login you enter to connect through it to our own servers; the login is used for that one check and is neither stored nor logged, and your proxy provider sees the connections. The bot protection checker at /check/bot-protection fetches the website you name once from our server, so that site sees our server, not you; the result is kept in memory for ten minutes under the site's address only, with no link to you. The token counter at /check/token-counter counts the text you paste on our server and does not keep it. Legal basis for all three: Art. 6(1)(b) GDPR, performing what you asked for. ## Error diagnostics When something fails, the application reports the error to a collector we host ourselves. Those reports carry no identifier: no account id, no email, no IP address. Values that could identify a person are removed before sending, and again on arrival. Legal basis: our legitimate interest in a working service, Art. 6(1)(f) GDPR. You can object to this at any time, and in the desktop app you do not even have to: crash reporting is off until you switch it on, under Settings, Error reports. Turning it back off takes effect immediately and costs you no functionality. ## Profile sync Your installation encrypts each profile on your own device and uploads only the result, so that it survives a lost machine and your other machines can fetch it. This runs from the moment you sign in: the key is created on your device, never reaches us, and we therefore store data we cannot read and cannot hand to anyone. Legal basis: performance of a contract, Art. 6(1)(b) GDPR. You can switch it off, in the desktop client under Settings, and you can keep individual profiles out of it. What we hold then is nothing at all; what we hold while it runs is the encrypted block, its size, when it changed and an opaque identifier per profile. For this one feature we act as your processor rather than as the controller. The terms of that are in our [data processing agreement](https://scalebrowser.net/legal/dpa), which applies without you having to sign it. ## Processors We use the following processors, each under a data processing agreement: * Contabo GmbH, Munich: the servers, the database and the error collector we run ourselves. Located in the EU. * Cloudflare: DNS, TLS, inbound email, and the object storage holding the encrypted backups and the encrypted sync data * Amazon Web Services: transactional email, sent from eu-central-1 * Stripe: payments and invoicing Some of these are US companies. Where data reaches a third country, the transfer is covered by the EU standard contractual clauses. ## Server logs Our servers keep the usual access logs: the requested address, the time, the response code, the browser string and the IP address. We need them to run the service and to notice an attack, and we do not use them to build a profile of you. Legal basis: our legitimate interest in a working and secure service, Art. 6(1)(f) GDPR. They are deleted after seven days. ## How long we keep things Account and contract data: until you delete the account, plus the 30-day window in which it can still be restored. Invoices: seven years, because Austrian tax law requires it (§ 132 BAO). Visit records of our website: 25 months, so that each month can be compared with the same month a year earlier. Measurements from the free check, and a report you chose to share: 90 days. Error reports: 90 days. Server logs: seven days. Encrypted backups: 35 days, so a copy can survive there for that long after deletion before the rotation passes over it. ## Two things we are asked to state Providing your email address is not required by law, but it is required by the contract: without it we cannot create an account, and without an account there is no subscription and no download. Everything else is optional and you can see which, because it is behind a switch. We make no automated decisions about you in the sense of Art. 22 GDPR, and we do no profiling. Nothing here scores you, ranks you or decides anything about your contract by itself. ## Changes to this notice If what we process changes, this text changes with it, and the date at the top moves. If a change matters to you, for example a new processor or a new purpose, we tell you by email rather than leaving you to notice. ## Your rights You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interest. Where we rely on your consent, you can withdraw it at any time with effect for the future, without that making the processing before it unlawful. Write to and we will answer within one month. You also have the right to complain to a supervisory authority. In Austria that is the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna.