Privacy Policy

1. Data we collect

• Account information: email address, display name, password (stored only as a one-way hash that we cannot read), and phone number or Telegram handle if you choose to provide them.
• When you sign in with Google: your email address, name, profile picture and Google account identifier.
• Device information when you use the app: machine ID, device name, operating system, app version, IP address and user agent, used to bind licenses to devices and manage sign-in sessions.
• Transaction information: amount, transfer description, transaction reference, payment method, and plan and license history. We never collect or store card numbers.
• Affiliate program: payout account details (for example a bank account number or wallet address) when you request a withdrawal.
• Customer support: the content of support requests and messages you send us.
• Security logs: sign-in times, IP addresses and important account actions.
• Website visit statistics: the pages you open, your country, the site that referred you and your device type, used to count visits. No IP address is stored for this (only an irreversible hash that tells visits apart) and no third-party tracking tool is used.

2. Google user data

When you choose “Sign in with Google”, we request only the basic openid, email and profile scopes. We never receive your Google password and do not access Gmail, Google Drive, contacts or any other data in your Google account.

Your email, name, profile picture and Google identifier are used only to create your account, sign you in and display your account details. We do not sell or rent this data, do not use it for advertising and do not share it with third parties beyond what is necessary to operate the Service.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke access at any time at myaccount.google.com/permissions.

3. How we use data

We do not sell personal data and do not send marketing emails without your consent.

• To provide and maintain the Service, authenticate accounts and activate licenses.
• To process top-ups, plan purchases, renewals and affiliate payouts.
• To send transactional emails: verification codes, password reset codes, security and account notices.
• To provide customer support and resolve complaints.
• To detect and prevent fraud and abuse and to keep our systems secure.
• To comply with legal obligations.

4. Sharing with third parties

We share data only as needed to operate the Service, with:

• Google: authentication when you sign in with Google.
• Resend: delivery of transactional emails (verification and password reset codes).
• Cloudflare: DNS, protection and delivery of the website.
• The cloud hosting provider that runs our servers.
• Banks and payment reconciliation partners: confirmation of your bank transfers.
• Competent authorities, when legally required.

5. Cookies and browser storage

• Secure HttpOnly sign-in cookies keep you signed in.
• Browser storage (localStorage) keeps your language, light/dark theme and affiliate referral code.
• The Google sign-in button may set Google cookies under Google's own policies.
• We do not use advertising or third-party tracking cookies.

6. Storage, security and transfers abroad

• Data is stored on cloud servers outside Vietnam (in Asia) and transmitted over encrypted HTTPS connections. The partners listed in section 4 (Google, Resend, Cloudflare) may process data in several countries. By agreeing to this Policy, you consent to your personal data being transferred abroad to the extent needed to provide the Service.
• Passwords and verification codes are stored only as one-way hashes; verification codes expire after 15 minutes.
• Access to data is limited to the people who need it to operate the Service; servers are protected by a firewall and key-based authentication and are backed up regularly.
• If we detect a personal data breach, we will handle it and notify the competent authorities and affected users within the time required by law.
• We keep account data while your account is active. When an account is deleted, personal data is deleted or anonymized within 30 days, except transaction records we must keep for accounting and tax purposes.

7. Consent and your rights

We process personal data only with your consent, given by ticking the consent box when registering or by continuing with Google sign-in, except where the law allows processing without consent.

Under Vietnamese personal data protection law, you have the right to be informed, to give or withdraw consent, to access and correct your data, to request deletion, to object to or restrict processing, and to lodge complaints. Withdrawing consent does not affect processing carried out before, but may mean we can no longer provide the Service to you.

You can update your details on your account page. For other requests (such as withdrawing consent or deleting your account), email [email protected] from your registered address; we will verify the request and respond within the time required by law.

8. Children

The Service is not intended for anyone under 16. We do not knowingly collect children's data and will delete it if we become aware of it.

9. Changes to this policy

We may update this Policy. The new version takes effect when published on this page; for significant changes we will notify you by email or within the Service.

10. Contact

• Email: [email protected]
• Telegram: t.me/purbrowser