Privacy Policy

Last updated November 3, 2026

Mosaic is local first. Your profiles, cookies, proxies, saved logins, two-factor codes, notes and downloads stay in a folder on your computer. We never receive them, and there is no cloud copy for us to lose. This page says exactly what we do hold, why, for how long and who helps us run it.

Who is responsible
What stays on your computer
What the app sends us
Your account: what we keep, why and for how long
Payments
This website
Advertising measurement, only with your consent
Processors and recipients
Transfers outside the EU
Your rights
Complaints
Children
Security
Changes to this policy

1. Who is responsible

The controller of your personal data is Enkova s. r. o., Lehotská 370/22, 972 71 Nováky, Slovakia, IČO 57610657, registered in the Obchodný register Okresného súdu Trenčín, oddiel Sro, vložka č. 57998/R ("we", "us").

Write to hello@mosaicbrowser.com, or by post to Enkova s. r. o., Lehotská 370/22, 972 71 Nováky, Slovakia, about anything on this page. We have not appointed a data protection officer; the same address reaches the people who run Mosaic.

The legal bases below are those of the GDPR: performing our contract with you or taking steps you asked for before one (Art. 6(1)(b)), our legitimate interests (Art. 6(1)(f)), our legal obligations (Art. 6(1)(c)) and, only where we ask for it, your consent (Art. 6(1)(a)). We do not sell personal data.

2. What stays on your computer

Everything you keep in Mosaic is stored in Mosaic's data folder on your computer and is never sent to us:

your profiles, their fingerprints, cookies, browsing history, bookmarks and other browser storage;
your proxies and proxy-provider accounts;
saved logins and two-factor setup keys and codes;
notes, presets, tags, projects and warm-up plans;
the files each profile downloads;
your local REST API keys and anything a script or AI assistant does through the API or MCP on your computer.

We have no access to this data. What your profiles send while you browse goes from your computer, through the proxy you chose, to the websites you visit, under their terms and your proxy seller's; we are not a party to it. Some features make your computer contact other services directly: checking a proxy asks a public address-lookup service (ip-api.com), through that proxy, where its exit is, and a profile without a proxy asks it where your own connection is, installing an extension fetches it from the Chrome Web Store, and a detection test opens the public test site it names. These requests carry no account data.

3. What the app sends us

Your account and plan. When you sign in or create an account, the app sends your email, your password and a device label naming the app's version and your operating system to our account server at accounts.mosaicbrowser.com. The server answers with a signed statement of your plan. The app asks again when it starts and every six hours, sending its session token.
Which computer you use. With each session the app sends a computer id: a salted SHA-256 hash of your computer's own hardware id, worked out on your computer. We never receive the hardware id itself. It lets us keep the device limit of your plan, and stop a session token from being carried to another computer.
The engine. When you install or update the Tesseract Chrome engine, the app asks our account server for the engine's download list with your session token. The server answers with download links that are signed for your account's plan and expire within 30 minutes; following a link downloads the files. These links carry nothing about you beyond that expiry.
Creating and opening a profile. When you create a profile, the app tells our server a random id for it, so the Free plan's creations can be counted. When you open one, the app asks our server for a short-lived launch ticket for that profile id and that computer, and while the profile is open it tells the server, every few minutes, that it is still open. So our server knows when a profile is created, when it opens and for how long it stays open, by its random id only. It never receives a profile's name, notes, fingerprint, cookies, logins, proxy, or anything you browse. On Pro, a ticket lets profiles open for up to 24 hours without a connection; on Free, every launch asks the server.
Update checks. If you turn on update checks in Settings › Updates (they are off until you do), the app asks GitHub, where we publish Mosaic's releases, whether a newer version exists, and downloads it when you choose to install it. GitHub sees your network address and the access token you entered.
Nothing else about your work. Beyond the above, the app sends no analytics, crash reports or usage data to us.

4. Your account: what we keep, why and for how long

Account

Data: your email address, a hash of your password (PBKDF2; never the password itself), your account's role, your Stripe customer ID once you open checkout, and when the account was created and last changed.
Why: your account, signing in and knowing your plan.
Legal basis: contract (6(1)(b)).
How long: until you delete your account.

Sessions

Data: for each signed-in app, a SHA-256 hash of its session token (never the token itself), the device label it sent, when the session started and was last used, when it expires and whether it was ended.
Why: keeping you signed in, and ending sessions when you sign out or reset your password.
Legal basis: contract (6(1)(b)); security: legitimate interest (6(1)(f)).
How long: a session expires 90 days after its last use, or when you sign out; its record is deleted with your account.

Computers

Data: for each computer you sign in on, its computer id (the salted hash described in section 3) and the device label the app sent, attached to that computer's session.
Why: your plan's device limit, and refusing a session token used from another computer (preventing piracy and account sharing).
Legal basis: contract (6(1)(b)); preventing abuse: legitimate interest (6(1)(f)).
How long: with the session it belongs to; deleted with your account.

Profile creations and launches

Data: for each profile you create, its random id, the computer id, when it was created and when it was first opened; for each profile that is open now, its random id, the computer id, when it opened and when the app last said it was still open. Never the profile's name or contents.
Why: counting the Free plan's creations and open profiles, and authorising each launch of the engine (preventing piracy).
Legal basis: contract (6(1)(b)); preventing abuse: legitimate interest (6(1)(f)).
How long: an open-profile record is deleted when the profile closes, or when the app stops reporting it. Creation records are kept until you delete your account. When you do, we keep one number per computer id, how many profiles were created on it, so that deleting an account does not reset the Free plan's count on that computer.

Free trials

Data: a record that a trial was used by an account, by a computer id and by a card (Stripe's card fingerprint, not the card number), with the trial's subscription id, date, outcome (converted, cancelled, ended) and the account's email address.
Why: one free trial per person, account and card.
Legal basis: legitimate interest (6(1)(f)).
How long: kept after you delete your account, because deleting an account must not grant another trial.

Subscription

Data: Stripe's subscription ID, its status, the price, the end of the paid period and whether it is set to end, as Stripe reports them; and the IDs and types of the Stripe notifications we handled (no personal data).
Why: knowing whether your plan is paid.
Legal basis: contract (6(1)(b)).
How long: until you delete your account.

Sign-in codes and password resets

Data: a hash of the 6-digit code we email you, when it expires and how many times it was tried; a hash of a password-reset link, when it expires and whether it was used.
Why: letting you sign in for the first time or reset a forgotten password.
Legal basis: contract (6(1)(b)).
How long: a code expires after 15 minutes and is replaced by the next one; a reset link expires after one hour. Both are deleted with your account.

Security counters

Data: counters of sign-in, sign-up, code and reset attempts, each kept under a SHA-256 hash of the email address or network address it counts, never the address itself.
Why: stopping password guessing and abuse.
Legal basis: legitimate interest (6(1)(f)).
How long: each counter starts again when its window (15 minutes or one hour) ends.

Checks for shared accounts and repeated trials

Data: for each request the app or this site makes with your account: the country it came from, and your IP address and its network (the /24 or /48 block), stored only as keyed hashes, never the address itself, with the first and last time seen that day and the computer id. At sign-up: the same hashed address and network, the country and the computer id. Sign-ins refused because the device limit was reached, and device swaps.
Why: an account is for one person and a free trial is one per person, computer and card (Terms §3–4). These records let us notice an account used by several people or several accounts used for repeated trials. A person reviews them before an account is limited; nothing is decided automatically.
Legal basis: legitimate interest (6(1)(f)): preventing abuse of the free trial and of accounts.
How long: 180 days. Request records are deleted with your account; sign-up records are kept for the 180 days even after deletion, because deleting an account must not reset the check.

Emails about using Mosaic

Data: your address, your plan and trial dates, whether you have signed in to the app and opened a profile, which of these emails we sent and when, and your email preference.
Why: a few emails that help you get started, tell you before a trial bills, and, after you cancel, what has changed. A month after a Pro subscription ends, one email may carry a discount code: we ask Stripe to make it for your Stripe customer alone, for one use, expiring after 30 days, so Stripe also holds that code with your account ID. At most one of these emails a day.
Legal basis: legitimate interest (6(1)(f)) in telling our own customers about the product they signed up for; the trial reminder and billing notices are part of the contract (6(1)(b)).
Your choice: every email except billing, security and the trial reminder has a one-click unsubscribe link, and the preference is kept with your account.
How long: until you delete your account.

Email with us

Data: your address and the text of the emails we send you (sign-in codes, password resets, billing and account notices), and email you send us.
Why: running the service and answering you.
Legal basis: contract (6(1)(b)); legitimate interest (6(1)(f)).
How long: email you exchange with us, two years after the conversation ends; our mail provider's delivery log, as short as it allows.

When you delete your account, its account, session, subscription, code and reset records are erased, and an active subscription is canceled at Stripe first. Payment records stay for the period in section 5.

5. Payments

Pro is paid through Stripe Checkout, and you manage the subscription in Stripe's billing portal, opened from Settings › Account. Stripe receives your email, billing details, payment method, the plan and the amount; your card details go to Stripe only, and we never see them. We receive from Stripe the subscription's status and dates, and the records accounting and VAT law ask for: invoices and amounts, your billing country, and, if you buy as a business, its name and VAT ID. We also keep any cancellation or withdrawal statement you send us, with your name, email and when we received it.

Why: billing, accounting, VAT, and proving your order, cancellation or withdrawal.
Legal basis: contract (6(1)(b)); legal obligation (6(1)(c)).
How long: 10 years, as accounting and VAT law require; after you delete your account, these records are no longer linked to it.

6. This website

Page views, without cookies

We count visits per page and per source (for example "came from a search engine", the referring site's domain, or a campaign's UTM tags). To count a visitor once a day, we use a keyed hash of the network address and the kind of device (phone, tablet or computer), made with a random value that changes every day and is deleted after two days, after which visits can no longer be linked. We do not store your network address, and nothing is stored on your device for this.

Legal basis: legitimate interest (6(1)(f)) in knowing which pages help people.
How long: the hash and the day's random value 2 days; the counts are kept as totals with no visitor identifier.

The waitlist

If you join the waitlist we keep your email, the form you used, the first source that brought you to the site (UTM tags, a referral code, the referring domain and the page you landed on, and, only with advertising consent, the ad platform's click ID), the country your connection came from and your browser's identification string. Your browser also remembers that you joined (in its own storage, under mosaic:waitlist), so the form does not ask again.

Why: emailing you once, when Mosaic is ready, and knowing which sources bring people.
Legal basis: your request (6(1)(b)); the source: legitimate interest (6(1)(f)).
How long: until we have told you Mosaic is ready, or until you ask us to delete it.

Emailing yourself the link

On a phone, the site offers to email you the link to Mosaic so you can open it on your computer. If you use it, we send that one email through our mail provider and keep your address in the waitlist list above (with the same details and the same terms), plus a record of each email we sent: the address, the page you asked from, when, and the mail provider's message id and result.

Why: sending the email you asked for, and limiting how often one address can be sent one (at most one in ten minutes and three a day).
Legal basis: your request (6(1)(b)); the limit: legitimate interest (6(1)(f)).
How long: the send records, 30 days; the address, as for the waitlist.

Support messages

The support form keeps your email, your name if you give it, the topic, subject and message, the Mosaic version and computer if you report a bug, and the first source that brought you to the site, as for the waitlist.

Why: answering you and fixing what went wrong.
Legal basis: contract (6(1)(b)) and legitimate interest (6(1)(f)).
How long: two years after the conversation ends.

Your browser's storage

The site keeps a few things in your browser, which are never sent to us on their own: the light or dark look you chose (mosaic:theme), that you joined the waitlist (above), and, for the current tab only, the source that brought you there so a form can carry it. Closing the tab or clearing site data removes them. Cookies are described in the Cookie Policy.

7. Advertising measurement, only with your consent

When we advertise on Google, Meta (Facebook, Instagram) and Reddit, we want to know which ads bring people who find Mosaic useful. If an ad platform is configured, the site asks you once, with Reject and Allow side by side; the site works the same either way. Until you choose Allow, Google's consent mode is set to denied and no Google, Meta or Reddit script loads.

If you allow it, your browser loads the Google tag (Google Ireland Limited), the Meta Pixel (Meta Platforms Ireland Limited) and the Reddit Pixel (Reddit, Inc.), which set their own cookies (listed in the Cookie Policy) and receive your network address, details of your browser, the pages you visit and the ad you came from. With your consent, our server may also tell them that a visit led to a sign-up, a trial or a purchase, with the ad click ID from your link if there was one; Meta also receives your email address, only as a one-way hash. Google, Meta and Reddit use this data under their own terms, as independent controllers.

Why: counting and paying for our ads.
Legal basis: your consent (6(1)(a); for the cookies, Article 5(3) of the ePrivacy Directive as applied in Slovakia).
How long: your answer is kept in the mosaic_consent cookie for six months; the platforms' cookies as the Cookie Policy says.

You can change your answer at any time with Cookie settings at the bottom of any page. Withdrawing consent does not affect what happened before.

8. Processors and recipients

These companies process data for us under data processing terms, except where we say one acts as its own controller. Nobody else receives your data from us unless the law obliges us to hand it to an authority.

Cloudflare, Inc. (USA) hosts this website and our account server (Workers and the D1 database). It receives everything those keep (sections 4 and 6), and your network address with each request.
Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. (USA) takes payments for Pro and runs the billing portal. Stripe is also its own controller for fraud prevention and its legal duties (stripe.com/privacy). It receives what section 5 describes.
Resend (Plus Five Five, Inc., USA) sends our emails, such as sign-in codes and password resets. It receives your email address and the email's text.
GitHub, Inc. (USA) stores our app releases. Update checks you turn on go from your computer to GitHub (section 3).
Google, Meta and Reddit, only if you allow advertising measurement, as independent controllers (section 7).

9. Transfers outside the EU

Cloudflare, Stripe, Resend, GitHub, Google, Meta and Reddit are based in, or use, the United States, so data can reach the US. Each transfer rests on the EU–US Data Privacy Framework (the European Commission's adequacy decision of July 10, 2023) where the company is certified under it, and otherwise on the European Commission's Standard Contractual Clauses (Decision 2021/914) with the safeguards they require. You can ask us for a copy of the safeguards at hello@mosaicbrowser.com.

10. Your rights

Under the GDPR you have the right to:

access your data and get a copy of it (Art. 15);
have it corrected (Art. 16) or erased (Art. 17);
restrict its processing (Art. 18);
receive it in a machine-readable form and take it elsewhere (Art. 20);
object to processing based on our legitimate interests (Art. 21);
withdraw any consent at any time, without affecting what came before.

We make no decision about you by automated means alone that has legal or similarly significant effects (Art. 22).

To use any of these rights, including deleting your account, write to hello@mosaicbrowser.com from your account's address. You can set a new password in the app at any time, with a code we email you. We answer within one month; if a request is complex, we may extend that by two months and tell you why. Data on your own computer is yours to export or delete: removing Mosaic's data folder deletes it, and we cannot do that for you.

11. Complaints

Please tell us first, and we will try to put it right. You can also complain to the supervisory authority where you live or work, or to ours:

Úrad na ochranu osobných údajov Slovenskej republiky, Galvaniho 7/B, 821 04 Bratislava, Slovakia; dataprotection.gov.sk; statny.dozor@pdp.gov.sk; +421 2 3231 3214.

12. Children

Mosaic is not for anyone under 16, and we do not knowingly collect data from them. If you believe a child under 16 has given us their data, write to us and we will delete it.

13. Security

Connections to our servers use HTTPS. Passwords, session tokens, sign-in codes and reset links are stored only as hashes, so a copy of our database signs nobody in. Sign-in attempts are limited, and only the people who run Mosaic can reach the account server's data. On your computer, Mosaic encrypts its store and cookie jars; with app lock turned on, nothing decrypts without your password. If a breach puts your data at risk, we tell the authority within 72 hours and, where the law requires, you.

14. Changes to this policy

When we change this policy, we update the date at the top. When a change matters to you, we tell account holders by email before it takes effect. Earlier versions are available on request.