Privacy

Your account: email address, name if you gave one, and a hashed password. Never the password itself.

Your licence: plan, status, a hardware ID per activated machine and the computer name it reported when activated, so a licence cannot be silently shared. The hardware ID is a derived identifier, not a hardware serial.

Card payments: handled by Stripe. We store their customer and subscription identifiers. We never see or store your card number.

Crypto payments: the transaction hash you give us, the plan and the amount, so a payment can be checked by hand and matched to your account. A transaction hash is already public on the blockchain. You never connect a wallet to us — you send from your own, and the hash is the only thing you hand over.

Support messages you choose to send from inside the app, and what the app attaches to them: your licence key if you have one, a device ID, your computer's name, your plan, the app and operating-system version, and the last errors from the app's log (file paths, passwords, emails and keys removed; site and proxy names in those errors stay).

An update check when the app starts and every six hours while it runs, unless you turn it off in Settings: your IP address, platform and release channel — which also tells us the app is still running. Not your licence or version.

A readiness report, every 20 seconds, while the app runs with an active licence: your licence key, a derived device ID, your computer's name, the build you are running, and — for each Account signed in to a ticket site — its name, which site, and whether that sign-in is ready. It exists for the Umbra web console. We keep it only for licences that use the console and refuse it from every other licence, but it is sent either way, and in this version of the app there is no setting that stops it.

Requests for work from the web console — every 3 seconds for offers and every 15 seconds for commands, while the app runs with an active licence. Each carries your licence key, device ID and the IDs of offers already on screen, so together they tell us when the machine is on. When you act on an offer or a command runs, we receive its progress and result. There is no setting that stops these requests in this version either.

Each purchase Umbra records in one of your Accounts: the order number, section, row, quantity, per-ticket cost and currency, the site, and the console offer it came from. Not the Account's name, card, address or email. A report we do not accept is retried for up to 7 days.

Your sales ledger, if you connect Lysted and have imported it: after each background top-up, every 30 minutes, up to 5,000 rows — event, venue and date, section and row, quantities bought and sold, cost, proceeds and profit, when bought and sold, the marketplace and the order number. Disconnecting Lysted stops it.

We keep the readiness report, purchases and ledger only for licences that use the Umbra web console, and refuse them from every other licence — but the app sends them either way.

Team board, if you connect to a team. Each open tab's title, page address and Account name, with its queue position and cart timer, goes to the team relay — by default ours, at relay.umbrabrowser.com — without end-to-end encryption, so the relay can read it. Remote-control screen frames are sealed on your device and are not readable by the relay. You can point the Team settings at a relay you run instead.

Cloud sync is encrypted on your device. Every account and proxy is sealed on your computer before it is uploaded, with a key derived from a passphrase you set that is never transmitted. We hold ciphertext we cannot open — not the contents of your accounts or proxies.

What sync does reveal to us: each item's random identifier and how many you have, the size of each sealed record and when it was last edited, the identifier and time of anything you delete, your licence key, and which of your devices synced when. Not names, not credentials, not proxy details. Because your synced workspace is tied to your licence, it is encrypted, not anonymous.

It is encrypted on your device, but it is not zero-knowledge: your passphrase is the only thing protecting the sealed copy, and anyone who obtained the stored data could test guesses against it offline. Choose a long, unguessable one. And if you lose it, we cannot recover your synced data for you — nobody can.

Your browsing, cookies, logins, autofill data, card labels and the contents of every Account. Umbra does not route your traffic through our servers — it goes through whichever proxies you supply, directly.

Secrets stored locally are encrypted with your operating system's keystore where your system provides one. Where it does not, they are stored encoded rather than encrypted, and the app is explicit about that rather than pretending otherwise.

Stripe for card payments, Resend for transactional email, and Vercel and Neon for hosting the site and its database. Each sees only what it needs to do its job. We do not sell data to anyone, and there is no advertising or analytics tracking on the desktop app.

When you press measure on a handshake check, the app contacts tls.peet.ws, a public TLS-fingerprint checker, twice in the same second: once through the Account's proxy and once from your own connection as the comparison. We are not party to that exchange, but it does show that service your address next to the Account's proxy exit.

Email us and we will export or delete your account data. Deleting your account cancels any subscription and removes your licence and synced blob; what is on your own computer stays yours, and you can export it from the app at any time.

If you are in the UK or EU, the usual rights of access, correction, erasure and portability apply, and you can complain to your data protection authority.