Privacy Policy — Candy Browser and Candy Sync
Last updated: 11 September 2026

Full policy: https://sk2andy.github.io/candy-browser/privacy/

Candy Sync is optional and self-hosted. You provide the server endpoint and credentials and decide which supported data types to synchronize. Server endpoint and username are stored locally. The server password is sent to your selected server during enrollment and not retained by the extension afterward. The E2EE passphrase is used locally and is not sent to the server or persisted. Device name and icon are encrypted locally before upload.

When tab sync is enabled, eligible HTTP and HTTPS tab URLs, titles, order, pin state and supported group metadata are encrypted on the device before transmission. Private tabs, browser-internal pages and local files are excluded. Your selected server stores encrypted payloads and necessary routing metadata; its operator may separately process IP addresses and request logs. Remote servers require HTTPS/WSS.

The extension includes no content scripts, advertising code or remotely executed code. You can disable sync scopes, revoke permissions, remove the extension or delete self-hosted server data. Local data remains until cleared or removed, subject to platform backup behavior. Server retention follows your selected server operation and backup policy. Losing the E2EE passphrase makes encrypted workspace data unrecoverable.

Privacy contact: https://github.com/sk2andy/candy-browser/issues