Everything we’ve shipped

Remote checkout: open any Account from your phone

Pick an Account on your phone, paste a link and press Open: the desktop opens it on its own connection, signed in, and your phone drives it. The desktop now reconnects by itself and stays awake while Remote control is on, a link from the phone loads only on the Account’s own connection, and the phone says plainly what went wrong when something does.

Umbra 2.0 — out of beta

The first release outside the beta programme. Since the last public build, every session has been checked end to end for leaving only through its own connection; bot checks inside pages and background workers see the Account rather than your computer; the connection list tells you what each one really is — HTTPS, HTTP, dead, or deleted — and warnings say what actually happens rather than what might. The download page shows which builds are published right now; the macOS build follows once it can be notarised.

Sign in to Ticketmaster with a passkey

A Ticketmaster Account can sign in with your Mac’s passkey instead of a password, on Ticketmaster’s own page inside that Account’s session. The key stays with Ticketmaster and your device — Umbra never sees it, and deleting the Account does not remove it. It needs the signed macOS build; everywhere else the Account shows passkeys as unavailable.

Decide per Account and per site whether a website gets your location and notifications

Location and notifications stay allowed by default, and any Account can now block or allow them for every site or for just one — a blocked site is told no, as a normal browser would tell it. Decisions are kept with the Account and apply in its Umbra sessions to pages opened or reloaded after you choose; the separate external browser keeps asking for itself. The location a site can be given is always the Account’s, never your computer’s.

Bot checks inside a page see the Account, and sessions leave only through their proxy

Frames a page embeds from other sites — where bot checks run — and a page’s background workers now present the Account rather than your computer, the window sits on the Account’s screen, and the newer graphics interface names the Account’s chip. A proxy rule that let a page send certain one-word addresses out on the home connection is closed, blocklist checks travel through the proxy being tested rather than your own connection, the app’s own windows fetch nothing on their own, a session says when the hardened engine could not carry it, feedback reports are stripped of credentials, the setup card can complete, and the drop screen no longer warns about payment details it cannot see.

Opening an account twice can no longer corrupt its data

Opening one account in the external browser window twice in the same instant could start two browsers on one saved-data folder. The second open is now refused cleanly, so cookies and logins cannot be corrupted that way.

The fonts a site can find now match the Account

Font detection measures text drawn in each candidate family; it used to see the computer’s fonts, not the Account’s. A family the Account does not claim now measures as missing on the page, in canvas and in the font-loading API, with nothing visible or downloaded behind it. Umbra hides what the machine has; it cannot invent what it lacks.

A device signature that survives a closer look

The per-Account canvas and audio variation now lives only where real hardware differs — the edges of drawn text and shapes — so a flat fill reads back exactly as drawn and silence stays silent, and every way a page reads the same picture agrees. A page’s background workers run the same signature code as the page, and a phone Account no longer carries desktop-only features.

Updates install on quit, safer sync, and a key for every teammate

A downloaded update now installs when you quit. Startup always opens a window, with a way to fetch a fix if something fails, and your data is copied before an update changes it. Sync no longer deletes or brings back accounts, and two accounts can no longer be given the same exit when moves overlap. Team members get their own keys, so removing someone disconnects their computers. Team boards reconnect after a relay restart, and the Team relay line on this page turns red during a real outage. Your plan always follows what you are billed for.

On Windows and Linux, an update waits for a later quit if a session is holding a queue place or a cart. If your data was saved by a newer version, Umbra says so and changes nothing. While Umbra is locked, saving an account’s secrets is refused rather than done without them. A connection engine that stops answering is replaced on its own, and idle ones stop. Imported cookies keep the exact scope they had. Plan changes update your one subscription instead of starting a second, and a nightly check corrects anything that slipped. Umbra’s own controls now answer only Umbra’s window, never a website open in an account, and screens refresh as soon as what they show changes.

A round of fixes: the vault, team sync, exits and live pages

With the vault on, Umbra opens to its lock screen again instead of stopping before any window. Changing the team passphrase syncs first, so it can no longer drop a teammate’s accounts. Automatic rotation and de-link skip an exit a site has refused, and the address-bar picker names who holds each exit. Pages that update live connect through the connection engine. Starting a free trial works, and crypto payments are recorded to the cent.

A warning before a buy that gets cancelled

A held cart now says how many of that event the account already holds, so a per-event limit is visible while there is still time to decide rather than days later when the order is cancelled. It counts only orders Umbra captured on that account, and says what it set aside.

The cart strip tells you when the tickets arrive

Beside the countdown, a held cart now states whether its tickets can be passed on immediately, are on a delayed transfer, must be collected at the venue, or are posted — the fact that decides whether a resale makes money, read from the page’s own delivery line. Where a page states nothing, the strip says nothing rather than reassuring.

One search that finds your accounts

⌘K now searches the things in Umbra, not just its actions: an account by name, group or tag — offering both of its open buttons — and every settings pane by what it does rather than what it is called. Screens answer to every name the app uses for them. The title bar carries a visible Search field instead of an unlabelled icon.

Umbra now opens compact

The tighter spacing added last update is now the default, so roughly a third more fits on every screen. The roomier spacing is one click away under Appearance & alerts, and anyone who already chose a setting keeps it.

Compact now tightens the spacing too

Every padding, margin and gap sits on one scale, and Compact tightens it alongside the type — an account row drops from 57 pixels to 44, so ten rows fit where seven did. Comfortable is pixel-for-pixel unchanged and stays the default, and nothing with a fixed size moves at either setting.

A text size switch

Appearance & alerts now offers Comfortable or Compact. Comfortable is unchanged and stays the default; Compact pulls the whole type scale in together so screens read quieter and long names stop wrapping. It moves text rather than padding, so row heights are the same either way.

Your first account can no longer open on your own connection

The welcome screen’s one button created an account with no connection and opened it immediately, so a brand-new install’s first page load came from the operator’s own internet. It now gives that account a free connection from the pool, or refuses and writes nothing. Creating an account without a connection on purpose is unchanged — it is still offered as an explicit choice on the New account form.

Every session an account holds, in one place

An account’s Cookies tab now lists the sites it has a session with, the soonest of them to expire, and the cookies inside each one — never their values. You can clear a single site, remove a single cookie, or hand one site’s sign-in to another account, with the consequence stated before you accept it.

See what the house holds, beside the page

A Session that is on an event page now shows what is on sale in the dock: sections grouped into the venue’s real levels, with seats, rows, price span and whether the stock is the box office’s or a resale listing. It reads the page’s own answers — no extra requests, nothing stored — and says so when a read is only partial.

The interface is back to the one you had

A run of layout changes has been undone in full. Every screen is as it was, with one keeper: both browsers open from an account’s own row.

Open an account in either browser from its row

Every account row and tile now offers both browsers side by side, with the same choice in the row menu, the bulk bar and from the keyboard, and the result shows where you are looking. The first step of a usability pass across the whole app: fewer hidden steps, one obvious action per screen.

The second browser records the order at once and keeps the account honest

A confirmation read in an account’s second browser lands in the Ledger the instant it is seen, a sign-out there signs the account out in the in-app session too, and one tab that stops answering no longer holds up the others. The Register fits the window.

Open an account in a second, purpose-built browser

Beside Open session, an account can now open in a separate browser on your own machine, built for the job: its own profile folder, its assigned connection, its device persona set when the browser starts rather than applied afterwards, and signed in with the account’s own cookies, which flow back as it goes. Everything the in-app session reports is reported from the window too: a refused checkout marks the account and its connection, a queue place or held cart holds rotation off it, and a confirmation lands in the Ledger and fires the success webhook. For the buying itself, when a site keeps refusing checkouts from the in-app session. Umbra installs nothing and says when that browser is missing.

A connection the site refused is not handed to another account

When a checkout is refused, Umbra now remembers it on the connection the account was using. Automatic picks skip that connection from then on; you can still choose it by hand, and every picker says why you might not want to.

Your register follows you between machines

Where each account stands — buying fine, asked for verification, shut, still waiting on an inbox — now travels with the account itself when you sync, along with the history behind it. Mark an account on the laptop and the mark is there on the desktop. Two machines that both wrote while apart keep both sides: neither rolls the other back, and the history is joined rather than overwritten. Your sign-ins and addresses still never leave the machine that holds them.

The Register — every account you hold, on one page

The spreadsheet you were keeping on the side is now part of Umbra. Records → Register lists every account with the sign-in, inbox, phone and address you need to get into it, and the connection it browses from — one row each, with the name pinned on the left and where the account stands pinned on the right, so nothing you need scrolls out of sight. Click any value to copy it; a password stays masked until you ask for it, and the clipboard clears itself 45 seconds later.

Three views of the same book: a grid for scanning hundreds, a record page for one account in full — with a dated history of everything that has happened to it — and a board that sorts every account into what it needs from you next. Accounts asked for identity verification are kept apart from ones that are shut and ones with no account yet, because they need different things from you; an account still waiting on an inbox keeps what the provider actually said when it refused, and how many times you have tried.

The Ledger, rebuilt around your orders

The order list is now a fast, sortable table that tells the whole story of every order on one line — cost, what it sold for, and the profit between them in green or red — instead of hiding the sale behind a tiny line of text. Sort by profit or cost straight from the column headers, filter to just what you are still holding, and scope the whole view to a date range. An order that sold across several marketplaces opens up to show each sale on its own line, split prices and all. And an Export that stamps its file with the date range makes handing a whole year to your accountant a single click.

Your ledger keeps itself up to date

Once the tool you list on is connected, the Ledger now tops itself up in the background — new orders and new sales appear on their own, added to what you already have without touching a thing, and a note lands in your notifications telling you how many. A sale that closes while you are away from your desk is in your books by the time you look. Nothing is ever overwritten, and a full reset is still one button when you want it.

Your sold prices fill the Ledger by themselves

Connect the tool you list your tickets on and the Ledger fills itself in: every buy and every sale, the price each went for, the account it was bought on and the seats — read-only, without a row of manual entry. A purchase that sold as several sales at different prices is stitched back to the buy it came from, so your realized profit per order comes out right without a spreadsheet. Umbra only ever reads your sales record — it never lists, prices, or changes anything on your behalf. A sale it can’t place against a buy is set aside for you to look at, never guessed.

See where your money is, three ways

The Ledger now opens on three pictures of your money, each answering a different question. One plots every order you’ve sold by what it cost against the multiple it came back for — so a glance shows whether your small orders carry the margin, and how often something sells under cost. One shows where every ticket you’ve bought ended up, sold against still held, across your whole book. And one sorts every order best to worst and draws your profit accumulating — so you can see how few orders carry most of a season, and what the loss-making tail costs you. A per-currency table beneath states spend, realized profit, unsold stock and sell-through at a glance. Every money figure is per currency and ties out to the penny — Umbra never adds a pound to a euro.

Open Performance detail for the figures the pictures don’t spell out, per currency: how much of your spend went to fees and tax, how long stock sits before it sells, each account ranked by what it actually returned, your budget line, and realized profit week by week.

Resolve stock from an event that has passed

Seats you’re still holding after the event date has gone by — because the order was cancelled and refunded, or it simply never sold — can now be settled with a plain either/or from the order menu. Marking it cancelled records a break-even: your money came back, so no gain and no loss. Marking it unsold writes it off as a full loss of what it cost. Either way the order stops counting as live stock you still hold, and it’s one click to undo.

Warm your whole fleet at once

Warming used to prepare one account at a time; now it prepares every account you select at once — each in its own sealed session — so a fleet is ready in about the time a single account takes, instead of that time over and over again. Each account still starts at its own moment and browses its own way, so what a site sees is ordinary traffic rather than a fleet moving in lockstep. Warming a large number at once opens that many live background browsers on your machine, so past ten Umbra asks first: run them all together, or a handful at a time while the rest wait their turn.

A warning before you reuse a burned exit

Every proxy that has ever been attached to an account — even one you have since deleted — is now marked in red wherever you choose a proxy: the account picker, the per-Session picker, and the Connections list. Reusing an exit that a burned account browsed from carries that risk onto the fresh one, so the warning sits right at the moment of choice, never after. The mark never names the old account. Open the exit to read a private history of which accounts it carried and when — so an account you lose can be rebuilt from the record of the exit that held it.

Recover a stuck page without restarting

If a Session’s page ever goes blank and won’t load — most often right after a purchase — you no longer have to restart Umbra to get it back. Tools → Session now has “Rebuild connection & reload”, which rebuilds just that account’s secure connection and reloads its tabs. Every other account keeps its page and its place in any queue.

A history of what your fleet did

The notifications bell now keeps a durable "Recent activity" feed that survives a restart — warm-ups and how each ended, queue crossings, and bot-checks, newest first. So the morning after an overnight run you can scroll back to what happened and when, not just what is still on screen. Each entry carries an account name and what happened — never a web address, proxy, or login.

Recent activity leads the bell — and clears when you want

The durable activity feed now sits at the top of the notifications bell, newest first, instead of below the live alerts — so the first thing you see is what your fleet actually did. A Clear button wipes the history for a clean slate; it asks first, since it can’t be undone.

Check for updates whenever you want

Settings now has a “Check for updates” button under the version, so you can check on the spot instead of waiting for the periodic check or relaunching. If a newer version is found, Umbra offers to restart into it — it never restarts on its own, so a session or cart is never closed out from under you.

Warming never gets stuck — and tells you how it ended

Warming an account can no longer freeze on "finishing…": if a page stops responding, the warm-up moves on and Stop always works. And every warm-up now reports how it ended — warmed, you stopped it, ran out of time, the site kept blocking it, or hit a problem — with how far it got, so a run that stopped short tells you why instead of going quiet.

See every session stuck on a check

During a drop, the Go screen now gathers every account that has hit a bot-check into one board — so a wall on account nine of fifteen no longer hides until you tab to it. Jump straight to a stuck session to solve it, or prime the token harvester for that challenge. Umbra surfaces the check and never solves it for you.

The Tools panel’s tabs all fit

The Tools panel beside a live page kept its last tab and its close button reachable only on wide windows — on a narrower one they were pushed off the edge. The tab row now fits the panel, so Snippets, Codes, Watch and Session are always one click away.

Warming, rebuilt

Warming a cold account is now a real browsing session — it scrolls, follows links and settles in for a few minutes to build a believable history, rather than loading a list of sites and waiting. Choose how deep to go, schedule it ahead of a drop, and see proof of what each run actually did.

A Light / Thorough / Ticketmaster style covers a quick top-up through to a fuller history; scheduled warm-ups now keep the same proof a manual one does, so a fleet warmed overnight reads as prepared in the morning.

Account Heat

The Accounts screen now shows how hard each Account has been worked — a month of opens and buys, warming from quiet to hot. The ones running hot are the ones to rest before the next drop, and an Account that needs to cool down is flagged so you lead with a fresh one instead.

Hover any day for its opens and buys, or open the log for the whole month as a table. You can also flag an Account as needing to rest by hand — shown distinctly from the ones Umbra spotted for you.

Reports, redesigned

Every Reports tab now leads with the one thing it exists to say: Summary opens on what you spent this window (always per currency, never one merged number), Drops reads as a timeline — each drop under the day of its latest order, outcome stated first — and Compare ranks a live sale like the race it is: the account nearest the front leads, and jumping to it is one click.

Merging a split identity also got a proper picker: every buyer in your ledger listed, type to filter, likely match first — and it’s still always your click, never a guess applied for you.

Card security codes now autofill

Autofill fills the card security code even when the checkout keeps it in its own payment box — the field that used to need typing by hand now fills with the rest. And if a field can’t be filled, Umbra names it rather than claiming a success it didn’t have.

Link split accounts in the ledger

When one buyer shows up as several rows in Reports — after you renamed the Account, or when a checkout only captured the email — you can now merge them into one from the by-account chips. Nothing is guessed for you, and you can unlink any time.

The by-account chips are also ranked biggest-buyer-first and fold behind a “+N more” count, and clicking one filters the ledger to that Account.

Snippets, saved without leaving the page

The session dock now lets you save a snippet on the spot, beside the live page, instead of sending you off to the Snippets screen and back mid-checkout.

Updates check while you work

A running copy of Umbra now looks for new versions every few hours, not only at launch, so you hear about a release the day it ships. The download still waits until nothing is at stake before it offers to restart.

Realized profit, on a timeline

The Money tab now charts realized profit per week — proceeds minus the cost of the seats that sold — from the sale dates already in your ledger. A good week is a green bar above the line, a losing week a red bar below it, per currency.

A row appears once it has both a payout and a sale date; a realized gain with no date is still counted and called out as “undated” rather than dropped. Currencies are never merged.

Queue & bot-wall alerts to your channel

A webhook channel can now be subscribed to two more events: an account reaching the front of the queue (or bypassing the waiting room), and an account hitting a bot-wall / CAPTCHA that needs a human. So you can step away from the boards and still be told the moment something needs you.

Each event is opt-in per channel — an existing channel never starts posting a new event on its own. What crosses is only the account name, the page, and the moment; never a URL, proxy, or secret. A CAPTCHA alert is a “come back” ping — Umbra never solves one.

Watches that survive the tab

A restock or price watch armed on a saved Account is now durable — closing the Session pauses it instead of ending it, it survives a restart, and it re-arms automatically the next time you open that Account on the same page. Watches on throwaway Sessions still end with the tab.

Umbra never opens a Session on its own to keep a watch running — a watch reads and alerts only while its Session is live, and re-arming changes nothing about that. The close warning now says a watch will pause, not that it is lost for good.

Prove a proxy doesn’t leak

Every exit now has a Verify button: it opens a throwaway session routed through that exit and runs a WebRTC leak check on it, then tells you plainly — no leak seen, couldn’t confirm, or leaking. It never probes a direct connection; a proxy that can’t be routed is refused, not tested against your real network.

A probe that couldn’t run says so rather than reading as clean, and a rotating exit that surfaces an unfamiliar public address is called out as unconfirmed instead of a false alarm. In the Proxies detail panel.

An exit history for every Account

Each Account now keeps a read-only record of every exit its sessions actually left through — written when a session opens or is re-pointed, never when a proxy is merely assigned. A session that left on your real connection is recorded too, loudly: the record is honest because it would show the bad day.

The list states its own bounds — when recording began, and how many older rows fell past the cap — so it can never quietly claim more than it holds. Read it in the Account inspector’s Connection card.

The fleet safety line

The Sessions screen now leads with the question the product exists to answer: how many of your open sessions are proxied. A one-line readout counts them, and when any session is the exception — on your home internet, or with a degraded device signature — a chip appears that filters straight to it.

The counts and the filters read from one derivation, so the number a chip claims and the sessions it shows can never disagree. The line reports facts, never a verdict — it will name the two sessions on your real connection; it will not tell you "all safe".

Follow-the-system theme, and a cart you can hear

Appearance gains a System option that follows your operating system’s light/dark preference live. And the cart guardian now rings as a held cart runs down — once at two minutes, one minute and thirty seconds, sharpening each time — so an expiring hold is heard even when you’re working in another screen.

Account notes, and safer duplicates

Every Account now carries a free-form Notes field — searched along with names, groups and tags, synced and exported with the Account — so the side-spreadsheet can retire. And duplicating an Account now always mints a fresh identity: the copy gets its own fingerprint and no connection, rather than ever sharing the original’s exit.

The duplicate change closes a real separation gap: a copy that inherits its source’s exit puts two Accounts on one IP, which is exactly the linkage the separation report exists to catch. Copies now arrive unconnected and clearly flagged until you assign or distribute an exit.

Passphrase strength, judged on your device

The sync passphrase field now shows a strength estimate as you type — judged entirely on this machine, with nothing sent anywhere. It errs on the harsh side on purpose: your passphrase is the whole margin protecting a synced backup, so over-rating one would be the expensive mistake.

Sessions say when they need you

A session that hits trouble — an expired hold, a sign-out, a bot-check — now says so on its card on the Sessions board, not just on the wall view. And any session holding something it can’t get back (a cart, a place through a queue) wears a small padlock on its card and its tab, so you know not to refresh before the warning has to stop you.

The padlock reads from the same judgement the close/reload warning uses, so the marker and the guard can never disagree. Trouble badges carry the same words everywhere they appear.

Proxy upkeep at a glance

Connection health now ages honestly — a test result older than a week says so on the row. A needs-attention count leads the Proxies screen and filters straight to the exits that want a human, bulk selections can move to a group without losing test results, and the one failure automation can’t fix — an Account stuck on a dead exit with nothing to move to — can raise a desktop notification.

The age marker and the needs-attention count read from the same judgement the assignment engine uses, so the screen can never disagree with what rotation would actually do. Group moves change the group and nothing else: no re-test, no lost region readings, no touched credentials.

Clearer resale books

The spend ledger now states your sell-through rate at a glance, the Reports summary shows what you’re still holding unsold, and CSV export follows the filter you’re looking at — with a filename that says so when it’s a partial file.

Sell-through and stock-on-hand are computed across your whole ledger, never a reporting window, so the morning glance answers "how much of what I bought has actually sold" without adding anything up yourself. Exports mirror the screen: filter to one event or stage and the file holds exactly those rows, in the order shown.

Wider checkout coverage

Ready-made checkout help now runs on more ticketing sites out of the box — TicketWeb, Eventbrite, DICE, See Tickets and Gigs and Tours join the built-in list, tidying the page so the fields you need stay reachable.

These join Ticketmaster, AXS, SeatGeek and Live Nation. The shared checkout tidy-up works on each from day one; site-specific touches are added as each is observed. As always, this never presses buy — the committing click stays your hand.

Device-signature hardening

A deep pass over how each Account presents to a site — tightening the coherence of the device signature so it holds together under close, professional inspection.

Covered the reported graphics, fonts, media devices, screen and network signals, and — the part that matters most to a modern check — how consistently they agree with one another across every part of a page. The result is a signature that reads as one ordinary machine from more angles than before.

Remote checkout

Drive a live Session from your phone, paired to your desktop over a secure channel — for the moment a drop opens while you are away from the machine.

Pair a phone to a desktop Session and take the wheel from anywhere: the live view streams to your phone and your taps drive the real Session. The committing buy click stays yours, as it always does — nothing is automated on your behalf.

Steadier team relay

Team boards and remote control now run on always-on hosted infrastructure, so a shared board stays live without anyone keeping a window open.

Faster session warming

Quicker, calmer warm-ups before a drop, and a clearer go-screen countdown so the whole fleet reads at a glance.

New guide, billing and support

A full product guide, self-serve billing, and in-app support — all reachable from the site and your dashboard.