sBrowser privacy policy

Last updated: 29 October 2026

sBrowser is a small web browser built on Android’s system WebView. It has no accounts, no advertising and no tracking across apps or websites. It counts anonymous usage to improve the app (see Usage statistics) and reports its own crashes (see Crash reports), and it never sends anyone which pages you visit: the history it keeps for the address bar’s suggestions stays on your phone. This page explains what the app keeps on your phone, what it sends where, and why.

The websites you open

Pages are loaded by Android System WebView, directly from the website to your phone. Like any browser, each site you open (and the services it loads, such as its images, videos or ads) receives your IP address, sBrowser’s user agent and the cookies it set earlier, and may use them under its own privacy policy. sBrowser doesn’t send what you browse anywhere else.

Search and home page: text typed in the address bar that isn’t a web address is searched on Google (www.google.com) unless you pick DuckDuckGo, Bing, Startpage, Ecosia or Kagi in Settings → Search engine (or with the search engine’s icon in the address bar on the home page); that search engine receives what you typed. The same goes for text you share to sBrowser without a link in it, and for web searches other apps hand to it. The search engines’ icons ship inside the app. The home page is sBrowser’s own, made on your phone from your bookmarks, open tabs and saved pages; it loads nothing from the internet. Settings → Home page can make a web page the home page instead.
Kagi (a paid search engine) needs you signed in to your Kagi account. You can sign in on kagi.com as on any site, or paste your Kagi Session Link in Settings → Search engine: sBrowser then stores it encrypted on your phone (with a key that stays in Android’s Keystore), sends it only to kagi.com, and only when a search needs to sign in (the browser, or a private tab, has no Kagi session yet). It never appears in the address bar, saved tabs, bookmarks, shared links or the usage statistics. Settings → Search engine → Remove deletes it.
Search suggestions (off by default, Settings → Search engine → Search suggestions): while it’s on, what you type in the address bar is sent to your search engine as you type (after a short pause), so it can suggest searches: suggestqueries.google.com, duckduckgo.com, api.bing.com, www.startpage.com, ac.ecosia.org or kagi.com (without your Kagi session), under that engine’s privacy policy. No cookies go with it. Nothing is sent from private tabs, nor while you type an address starting with https:// or the like. The suggestions from your own history (below) never leave your phone.
Safe Browsing (on by default, Settings → Privacy & security): WebView checks the pages you open against Google’s list of dangerous sites, as Chrome does, under Google’s privacy policy.
In-app video player: when you follow a link, sBrowser loads that page a second time from the same site, with the same user agent and cookies, to look for a video it can play in its own player. That request goes only to the site you opened.
Password manager and passkeys: sBrowser keeps no passwords. The password manager you picked in Android (Bitwarden, 1Password, Google…) gets the sign-in fields of the page you’re on, with its address, through Android’s autofill, and a page’s passkey requests through Android’s Credential Manager, as in other browsers; it fills them and may offer to save what you type. Private tabs are left out unless you turn on Settings → Password manager in private tabs.
Links to apps: a link you tap to another site that an installed app owns (YouTube, WhatsApp, Maps…) opens in that app, which gets the link, as in Chrome (Android 11+; Settings → Open links in apps, on by default; never from private tabs). Links like tel: or mailto: open the phone or email app.
Ad blocker: the list of blocked hosts ships inside the app, and once a week sBrowser downloads the current version from GitHub (raw.githubusercontent.com, the StevenBlack/hosts project). That request is the same for everyone and carries nothing about you or what you browse.

Reader view

Reader view works on the page you’re already looking at, on your phone. Only when an article in reader view looks paywalled, and Settings → Reader view → Full text of paywalled articles is on (the default), sBrowser asks wallhop.io, the Wayback Machine (web.archive.org) and archive.today (archive.ph) for the article’s full text. Those services then receive the article’s address, like when you visit them yourself.

Saving an article in reader view to read offline downloads its pictures from the sites that serve them, as showing the article does.

Stored on your device

Bookmarks: the title, address and a small picture of each page you bookmark.
Zoom: the sites you give a zoom of their own (⋮ → Zoom), with the zoom, so they keep it. Zoom chosen in private tabs is forgotten when the last private tab closes.
Open tabs: the address and title of each normal tab, and a small picture of its page for the tabs page, so they’re back after a restart. Private tabs are never saved.
Settings: home page (and what sBrowser’s home page shows), search engine, theme, the ad blocker’s allowed sites, the sites you turned JavaScript off or third-party cookies on for, zoom, reader view’s text size and the other options in Settings.
History: the address, title, number of visits and time of the last visit of the pages you open in normal tabs, and the words you search for from the address bar, so the address bar can suggest them while you type. Kept only on your phone, never sent anywhere; never from private tabs. Pages and searches not used for 90 days are deleted (and at most 5,000 pages are kept). Settings → History → Remember history turns it off (nothing new is kept, and the address bar stops suggesting what was); Settings → History → Clear history, or Settings → Clear browsing data, deletes it; long-pressing a suggestion removes that page or search.
WebView data: the cookies, site storage (DOM storage) and cache that websites save, the same as in any browser. Settings → Clear browsing data deletes them (with the history above, and your answers to sites’ permission requests) at any time; tapping the lock in the address bar and then Clear deletes one site’s cookies and site storage. Settings → Clear cookies when closing (off by default) deletes all cookies, or only session cookies, when you leave the app, except while background playback is running.
Private tabs: keep their cookies, site storage and cache apart from your other tabs, and all of it is deleted when you close the last private tab or leave the app. They’re never saved, and Android keeps them out of screenshots and the recent-apps preview.
Downloads: files you download are saved by Android’s download manager in your phone’s Downloads folder (or the app’s own folder on Android 8 and 9), where they stay until you delete them.
Saved pages: articles and pages you save to read offline (their text, pictures and address, a small picture and when you saved them) stay in the app’s own storage on your phone until you delete them. Nothing from private tabs can be saved.
File uploads: when a page asks for a file, Android’s file picker opens and only the file you choose is given to that page.
Kagi Session Link (only if you paste it): encrypted, see The websites you open.
The random statistics identifier (see below).

If Android backup is on, your bookmarks, open tabs, history and settings are included in your Google account’s device backup and in transfers to a new phone. Cookies, site data, the cache, the saved copies of saved pages and your Kagi Session Link are never backed up (their list is stored with your bookmarks, and entries whose copy didn’t come back are removed). Uninstalling the app deletes everything above except your downloads.

Background playback

When you start background playback, sBrowser shows a notification so the audio or video keeps playing while the app is in the background (Android requires one, and asks for permission to show notifications). The notification shows the app’s name only; the page address is added only if you turn on Settings → Show the page in the notification. The notification stays on your phone; nothing about it is sent.

Usage statistics

sBrowser uses Umami, a privacy-focused analytics tool, on a server run by the developer (umami.codeskraps.com). It records which screens and features are used: the browser, bookmarks, settings and video screens, that an address was entered, that a bookmark was added, edited, opened or deleted, that tabs or bookmarks were put in a new order (not which ones), that a bookmark, another tab or a saved page was opened from the home page (or its “See all”), that an article or a page was saved to read offline, or a saved one opened or deleted, that the video player or background playback was started or stopped, that a suggestion under the address bar was opened (only its kind: open tab, bookmark, visited page, past search or the search engine’s suggestion), that browsing data or the history was cleared, that a Kagi Session Link was saved or removed or stopped working (never the link), that the password manager was asked to fill a page from the menu or Android’s password manager settings were opened (never what was filled, nor which password manager), that a tab was moved between private and normal tabs (never which), that a site’s zoom was changed (never which site), and which setting was changed, in Settings, with the home page’s button or from the address bar (with its new value for switches and lists, never for text you type such as the home page or the allowed sites).

Each event carries:

the event and screen names, and small details such as the setting’s name;
the app version, your phone’s operating-system version and model, and its language;
a shortened random identifier created when the app is first used, so repeat use can be counted. It isn’t linked to your name, account, advertising ID or any other app.

It never includes the addresses or titles of the pages you visit, what you search for or type, your history, your bookmarks or your downloads. Umami doesn’t use cookies or fingerprinting, and the data isn’t sold or shared. The server sees your IP address for each request, as any web server does; Umami doesn’t store it, but uses it to estimate an approximate country, region and city for the statistics. Statistics are only sent by the published app (not by development builds).

Crash reports

When the app crashes, it sends a report to GlitchTip, an error-tracking tool, on a server run by the developer (crash.codeskraps.com). A report contains:

what went wrong: the error and where in the app’s code it happened;
the app version, your phone’s model and manufacturer, operating-system version, screen size, and technical state such as free memory and storage, battery level and whether it’s charging or online.

It never includes the addresses or titles of the pages you visit, what you search for or type, your history, bookmarks, downloads or passwords: addresses, host names and page details are removed from error messages before a report is sent, and the app sends no record of what you did before the crash (no screens, taps or requests), no screenshots and no time zone. Reports carry no identifier for you or your device and aren’t linked to the usage statistics. The server sees your IP address as any web server does; GlitchTip keeps it with its last part removed. Crash reports are only sent by the published app (not by development builds); they are used only to fix the app, and aren’t sold or shared.

Children

The app is not directed at children and doesn’t collect personal data: the usage statistics and crash reports above are anonymous.

Changes

If the app starts sending something new, this page will say so before that version is published, with a new date at the top.

Contact

Questions about this policy: me@codeskraps.com, or open an issue on the project repository.