For the same answers in plain words — what is on your device, what syncs, where it is stored and for how long — see Data & Security.

1. Introduction

Liminal ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our browser application and website.

2. Information We Collect

Account Information

When you create an account, we collect your email address and encrypted password. We do not store passwords in plain text.

Usage Data

We collect product usage events to improve the app: the name of the action, whether it succeeded, the app version and build, the platform and the plan. Each event carries an identifier — random until you sign in, your user id afterwards. Fields that look like a secret or an identity (passwords, tokens, cookies, sessions, API keys, device and machine ids, hostnames, serial numbers, MAC addresses, fingerprint values, IP addresses, proxy credentials, file paths, email addresses) are removed before an event is sent, and values that look like a token, an email, an IP or a path are replaced with a redaction marker. Events are sent to an EU endpoint with IP capture switched off.

Our server also records the events of your account itself — that it was created, that its address was confirmed, that an installer was issued to it, that an invoice was made, that a payment was confirmed and that a paid term ended — and sends them to the same analytics service under your user id. They carry the plan, the term and the amount of a payment, the language of the account, the answer you gave in the app’s first-run setup, and where you first came to this website from: the campaign tags of the link, the host of the referring site and the page you landed on. They carry no email address, no IP address and no browser details, and they are sent to the same EU endpoint with IP capture switched off. They are sent whether or not you accepted analytics on this website: the cookie banner governs what is loaded and stored in your browser, not what the service you have an account with records about that account.

Profile Data

Browsing history, saved passwords, open tabs, site data, cache and extensions of your profiles stay on your device; we do not receive them, apart from the page addresses and the network log that diagnostics carry, described below. On the paid plans your catalog syncs so a second machine can pick it up: profiles with their fingerprint configuration, workspaces and folders, proxies, account cards and app settings. If you import cookies onto an account card, those cookies sync with the card and their values are encrypted before they are stored. On the free plan nothing syncs.

Diagnostics (Liminal Trace)

So that we can find and fix what goes wrong, the app sends us technical diagnostics. They are on by default, on every plan and before you sign in. They record your actions in the app and how each ended; how a profile opened or why it did not; the fingerprint values it opened with; each page’s address without its parameters, the response code and the proxy it went through; requests stopped from going past the proxy; proxy failures and connection checks with the exit IP; warnings and errors of Chromium and of Liminal; and crash reports. Email addresses are cut out of log lines, and your system user name out of paths.

A crash, a profile that fails to open, a 403 or 429 response from a site, a verification page, a request past the proxy, a process without its fingerprint or a message through Send Feedback also sends a package: the network log of every profile for the last 10 minutes, the log of the same minutes, the profile’s state — its proxy without login and password, exit IP and country, fingerprint — and metrics, the version, the system and the graphics card.

We deliberately leave out proxy logins and passwords, cookies, Liminal sign-in tokens, Local API keys, the passwords you use on sites, the contents of pages and responses, what you type on sites, screenshots, the clipboard and profile names. Two exceptions apply: a crash report is Chromium’s standard dump, which carries the address of the open page, and the stacks of its threads can hold fragments of the process’s memory; and the network log and log lines keep addresses whole, with their parameters.

Diagnostics go to our own server in Frankfurt, Germany, which runs Sentry, and are deleted after 30 days; daily backups of that server roll over in about a week. We do not sell them or hand them to third parties for their own use. Our team reads them to find and fix problems, including with the AI tools we build Liminal with. Reports carry a device and a session number, the id of the profile and, once you sign in, your user id; the address they came from is not stored, while a proxy’s exit IP stays in the data.

To turn them off: Settings → General → Privacy → Send diagnostics. That stops the logs and the sending and deletes what is still on your computer; a dump Chromium writes while it is off is not sent and goes at the next launch. What has already reached the server stays until its 30 days are up. Turning it on again sends neither what was deleted nor crashes from while it was off.

Messages You Send Us

When you write to us through the feedback form or by email, we keep your message, the address to answer and the files you attach. A message sent from this site carries nothing about your browser or device. Attachments are deleted after 90 days; the message itself is kept so that we can find it when you write again. A new message is announced to our team in Telegram, and when we open a task for it the text goes into our issue tracker (Linear) without your email address.

3. How We Use Your Information

To provide and maintain our service
To process your subscription and payments
To send you important updates about our service
To provide customer support
To improve our product based on usage patterns
To find and fix problems from diagnostics

4. Data Security

All traffic between the app, this website and our API is encrypted with TLS. Account passwords are stored as bcrypt hashes and cannot be read back. Proxy passwords and imported cookie values are encrypted with AES-256-GCM before they are written to the database; the key is held by us, so that protects them against a stolen database rather than against us. Your profile folders stay on your own machine, under the protection your operating system gives them.

5. Third-Party Services

Our API, database, downloads and diagnostics server run on DigitalOcean in Frankfurt, Germany. We use NOWPayments for crypto payments, Resend for account email, Mixpanel (EU ingest) for product and website analytics, and Telegram and Linear for the messages you send to our support. These services have their own privacy policies governing the use of your information.

6. Your Rights

You have the right to:

Access your personal data
Correct inaccurate data
Request deletion of your data
Export your data
Opt out of marketing communications

Settings → Account in the app opens your account page, where both live: “Export my data” downloads everything we store for your account as a JSON file, diagnostics apart, and “Delete account” removes the account and everything stored with it — profiles, proxies, account cards and their cookies, settings and sessions — the moment you confirm, with no grace period. Two kinds of records stay without a link to you: the security log of sign-ins, and records of payments you made — their date, plan, amount and status. Daily backups of the database are kept for about a week, after which the deletion is gone from those too. Diagnostics follow their own 30 days, whether or not the account is deleted.

7. Cookies

This website uses essential cookies for authentication and session management. It also loads product and website analytics — but only after you accept them in the cookie banner; until then no analytics script is loaded and nothing is written for them. Once accepted, the analytics service sees the pages you open on this website and where you came from, and derives an approximate location from the request. Declining keeps all of that off; it does not stop the account events our server records, described under Usage Data. We run no advertising trackers and do not share data with advertisers.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

9. Contact Us

If you have any questions about this Privacy Policy, please contact us at [email protected]