Privacy Policy

Welcome to Browser.lol (the "Service"), operated by Zesiger.net ("we," "us," or "our"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy ("Policy") explains how we collect, use, disclose, and safeguard your information when you visit our website https://browser.lol, use our services, or interact with us in any other way. It also describes your data protection rights and how you can exercise them.

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP, revised version in force since 1 September 2023), the EU General Data Protection Regulation (GDPR) where it applies to us, the UK GDPR, and other applicable data protection laws. We apply Privacy by Design and Privacy by Default principles: the Service is built so that the content of your browser sessions is not monitored or stored by us, and the data we do keep is limited to what is needed to run the Service.

This Policy is a factual description of what we do today. Where we state targets or aims, they are targets and not guarantees unless a binding document says otherwise.

Under the Swiss FADP, processing of personal data by private parties does not require a specific legal basis for every operation; it must comply with the processing principles of Articles 6 and 8 FADP, and any overriding of a data subject's interests must be justified (Art. 31 FADP). Where the GDPR or UK GDPR applies, we rely on the following legal grounds under Article 6(1):

• Performance of a Contract (Art. 6(1)(b) GDPR): Creating and operating your account, providing browser workspaces and the integrated mail service, processing payments, and providing support.
• Legal Obligation (Art. 6(1)(c) GDPR): Bookkeeping and tax record-keeping (Art. 957 et seq. of the Swiss Code of Obligations) and responding to lawful requests from authorities.
• Legitimate Interests (Art. 6(1)(f) GDPR): Securing the platform, preventing fraud and abuse, enforcing our terms, defending legal claims, measuring and improving the Service, and funding the free tier through advertising on our website. When relying on legitimate interests, we balance them against your interests and fundamental rights.
• Consent (Art. 6(1)(a) GDPR): Only where we ask for it for a specific purpose. We do not rely on consent for any processing that is necessary to run the Service.

We do not process special categories of personal data (Art. 9 GDPR) as part of operating the Service.

5.1. Automated Abuse Detection and Decision-Making

We use automated systems to detect abuse of the platform, such as rate-limit enforcement, IP reputation checks, and automated analysis of resource and traffic patterns. An automated system may temporarily block access (for example, refuse a registration or a workspace start) if highly suspicious activity is detected. Where such a decision significantly affects you, you have the right to obtain human intervention, to express your point of view, and to contest the decision (Art. 22 GDPR; Art. 21 FADP): contact legal@browser.lol and we will review the decision manually. We do not perform automated decision-making that produces legal effects beyond these security measures, and we do not use profiling for advertising decisions about you.

5.2. Data Retention and Deletion

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements, or as long as necessary for the establishment, exercise, or defense of legal claims.

5.3. Data Security

We have implemented technical and organizational security measures (TOMs) appropriate to the risk to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These include:

• Encryption in transit: TLS (minimum version 1.2, TLS 1.3 preferred) for connections to our website and API; WebRTC media streams are additionally protected with DTLS-SRTP.
• Encryption at rest: Block-level encryption on our primary storage in Helsinki; passwords are stored hashed with bcrypt.
• Isolation: Each browser workspace runs in an isolated, ephemeral container with its own filesystem and network namespaces, destroyed at the end of the session.
• Access control: Role-based access on the principle of least privilege; administrative access is restricted and logged.
• Operations: Logging and monitoring of relevant system events, regularly exercised backup and recovery procedures, and a documented incident response process.

We are transparent about our certification posture: we are not ISO/IEC 27001 certified, we do not hold a SOC 2 report, and we do not claim any certification or external audit that does not exist. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. In the event of a data breach we follow the process described in Section 10.

5.4. Privacy by Design

• Data Minimization: We collect and process only the personal data necessary for each specific purpose; the content of your browsing sessions is deliberately not stored.
• Purpose Limitation: Personal data is processed only for the specific, explicit, and legitimate purposes for which it was collected.
• Storage Limitation: Data is retained only as long as listed in Section 5.2.
• No data mining: We do not mine, profile, monetise, or use the content of your workspace sessions or mail for advertising or to train models.

We share personal data with third-party service providers (processors) only where this is needed to deliver the Service. These providers are contractually bound to protect your data and may only use it for the purposes for which we disclose it to them. We do not sell your personal data. The complete, current register of our vendors — including their roles, locations, and transfer safeguards — is published in our Subprocessors List; the most important ones are:

• Hetzner Online GmbH — primary hosting of all durable data in Helsinki, Finland (EEA), including databases, object storage and encrypted backups.
• OVHcloud and FiberState, LLC — ephemeral edge compute capacity for browser workspaces outside Europe (no durable storage of your data).
• Cloudflare, Inc. — DNS, delivery of the web frontend, bot protection (Turnstile), and inbound email routing for the integrated mail service.
• Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.) — card payment processing, receipts and invoices.
• NOWPayments — cryptocurrency payment processing for one-time purchases.
• Google — "Sign in with Google" (OAuth), the Google Workspace SMTP relay used to send transactional email from noreply@browser.lol, Google Web Risk hostname checks, and Google Analytics 4 on our website.
• Microsoft Corporation — "Sign in with Microsoft" / Entra ID single sign-on for organizations that enable it.
• OpenRouter, Inc. — AI gateway used for optional mail summaries (routing to the configured model provider, currently Google Gemini). This is the only channel through which mail content reaches an AI provider.
• OpenAI OpCo, LLC — automated anomaly detection over aggregated server-side operational logs. The content of your workspace sessions and your mail is never sent to this provider.
• Axiom, Inc. — server-side log aggregation; log events can include IP addresses and user/session identifiers.
• Reoon — email address verification at registration.
• Playwire LLC — advertising on the free, ad-supported tier of the Service (see Section 7.2).

We may also disclose your personal data if required by law, regulation, legal process (e.g., a court order), or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud. In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal data may be transferred as part of that transaction, subject to this Policy and notification where required by law.

Under the Swiss FADP and the GDPR (for individuals in the EU/EEA) and the UK GDPR, you have the following rights regarding your personal data:

Our Service is not directed to individuals under the age of 16 (or a higher age threshold where applicable local law requires one). We do not knowingly collect personal data from children under 16. If you are a parent or guardian and you believe that your child has provided us with personal data, please contact us using the details in Section 2. If we become aware that we have collected personal data from a child under 16 without verifiable parental consent, we will take steps to delete that information promptly.

We have implemented procedures to detect, investigate, and respond to personal data breaches. Where a breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it (Art. 33 GDPR); where notification is made later, it will be accompanied by reasons for the delay. Under Swiss law, we notify the FDPIC as soon as possible of breaches that are likely to lead to a high risk for data subjects (Art. 24 FADP).

Our Service may contain links to other websites that are not operated by us, and you can use browser workspaces to visit any website you choose. If you visit a third-party site, that site's own privacy policy applies to the data it collects from you. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. Websites you visit inside a browser workspace see the workspace's IP address and environment rather than your own device, but any data you actively submit to them (such as logging into your accounts) is governed by their terms and policies.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post any changes on this page and update the "Last Updated" date. We encourage you to review this Privacy Policy periodically.

Change Notification: For significant changes that materially affect your rights or the way we handle your personal data, we will provide prominent notice (e.g., at least 30 days' advance notice via email to registered users and/or a clear notification in the Service) before the changes take effect. For less significant changes, updating the "Last Updated" date and posting the revised policy is sufficient. Where a change requires your consent under applicable law, we will ask for it.

Last Updated: 2026-06-11

This Privacy Policy and any disputes arising out of or related to it shall be governed by and construed in accordance with the laws of Switzerland, without regard to its conflict of law provisions.

Any disputes arising from or in connection with this Privacy Policy that cannot be resolved amicably shall be subject to the jurisdiction of the competent courts at our seat in Schmiedrued, Switzerland. This does not affect mandatory data protection rights or forum rules of the country in which you habitually reside, and it does not affect your right to lodge a complaint with a data protection supervisory authority as described in Section 8.