Cefrium Browser - Privacy Policy

Data we collect

None. Cefrium Browser has no analytics, no advertising SDKs, and no account system. We do not have any backend that receives information about you or your browsing.

Data stored on your device

Like any browser, Cefrium Browser stores data locally on your device so the web works: browsing history, bookmarks, cookies and site data, cache, and your settings. This data never leaves your device through Cefrium, and you can remove it at any time (the in-app Clear cache action, or clearing the app's storage in Android Settings).

Permissions

Cefrium Browser requests Android permissions (such as location, camera, microphone, contacts, Bluetooth, and notifications) only to hand them to the websites you choose to grant them to, through standard web APIs (for example a site asking for your camera). Cefrium itself does not use these permissions to gather data, and nothing is sent to us. A site only receives a capability after you allow its prompt.

Network connections

• Pages you visit are requested directly from those websites; your requests go to them, not through us.
• Search queries are sent to the search engine you select (default: DuckDuckGo), subject to that engine's own privacy policy.
• If you enable ad blocking, the app downloads a public filter list (EasyList) from its distributor. This is a file download; it does not send your browsing data.
• The Chromium engine keeps its own security data up to date. In the background it contacts Google's component update service (update.googleapis.com) and downloads data files such as the certificate revocation list, Certificate Transparency log metadata, the download file-type policy, TLS error diagnostics and the ad filtering ruleset. The request states which component versions the app already has, plus the platform and a random per-component install identifier; it contains no account, no page you visited and no personal data. These updates are how the browser inherits Chromium's security fixes between releases.
• The engine also queries Google's time service (clients2.google.com/time) roughly once a day to detect a badly set device clock, which would otherwise make valid HTTPS certificates look expired. The request carries no identifier.
• What the engine does not do in Cefrium: no usage statistics or metrics are uploaded (Chromium's UMA/UKM reporting is off and has no consent recorded), no crash reports are uploaded (the crash reporter is not configured, so it is never started), no Chromium field-trial/"variations" seed is fetched, and Google Cloud Messaging is disabled in our build. Cefrium is also built without Google API keys, so the engine's Google account and sync backends are inert.

If you are an SDK integrator who needs the engine to make no background requests at all, see Trademark & Forks for how to reach us -- the engine supports disabling component updates, at the cost of losing the security data refreshes above.

Third parties

The websites you visit and the search engine you choose are operated by third parties and have their own privacy policies. Cefrium Browser is built on the Chromium engine but is an independent project, not affiliated with, sponsored by, or endorsed by Google or the Chromium project.

Children

Cefrium Browser is a general-purpose web browser and is not directed at children under 13.

Changes to this policy

If this policy changes, the effective date above will be updated.

Contact

Questions about privacy: cefrium@proton.me