What we can & can’t see

What it's for

This is the honest map of where your data lives and what, if anything, leaves your machine. Read it once, so nothing about how Umbra stores things surprises you on a bad day.

On your machine vs on our servers

Almost everything stays on your computer: your Accounts' cookies and storage, their Fingerprints, your proxies, your one-time codes. Our servers get less than that but more than a licence check, and the full list is below: checking your licence, a readiness report the app sends while it runs, and (only if you switch it on) syncing an encrypted copy of your Accounts between your own devices.

What the app reports while it runs

These leave from your own connection, not through any Account's proxy. Settings → Security & privacy → What's here, what leaves lists every one, and Umbra's own build fails if the app posts to our server somewhere that list does not name.

The app also asks our server for work from the web console — every 3 seconds for offers and every 15 seconds for commands, for as long as it runs with an active licence. Each request carries only your licence key, your device id and the ids of offers already on screen, but together they tell our server, to within a few seconds, that this machine is on. An offer or command that arrives opens one of your Accounts on an event page through that Account's own proxy; it never carts or checks out. There is no setting that stops these polls in this build.

Two more reports carry your buying and selling:

Like the readiness report, our server keeps these only for licences that use the web console and refuses them from every other licence — after they have been sent.

When you send feedback from the app, the report carries more than your words: your licence key if you have one, your device id and computer's name, your plan, the app and operating-system version, and the last errors from Umbra's log — file paths, passwords, emails and keys are removed first, but site and proxy names in those errors stay. The dialog says so before you press Send.

If you connect to a team, the team board — each open tab's title, page address and Account name, with its queue position and cart timer — goes through the team relay in the clear. Unless you change the address in the Team settings, that relay is ours (relay.umbrabrowser.com). Only remote-control screen frames are sealed so the relay can't read them.

Sync is encrypted, not zero-knowledge

When you turn Sync on, the contents of your Accounts and proxies are encrypted on your machine before anything uploads, with a key derived from a passphrase you choose. We store what we cannot read.

What the server can read

Encryption hides the contents — not the fact that they exist. To sync at all, the server necessarily sees some things in the clear.

If you've ever read "the server only learns ids and counts," that's the sentence to distrust — sizes, licence and device identifiers are visible too. The honest line is narrower: the server can't read your Accounts' contents.

The captcha harvester is shared

Here is one place isolation is deliberately looser, and you should know it before a drop. When a site throws a CAPTCHA (or a Google sign-in), the solve runs in a single, shared helper Session — not behind the Account's own exit.

The handshake baseline uses your real IP

The other one: when you press measure on an Account's Scorecard, measure open Accounts before GO, or measure in Reports, Umbra makes two connections to the third-party checker tls.peet.ws in the same second — one through the Account's own proxy, and a plain comparison from your own connection.

If that pairing matters for a sensitive Account, skip the handshake check on it.

Lose the passphrase, lose the backup

The flip side of us not being able to read your backup is that we can't recover it for you either.