Privacy Policy & Cryptographic Model

1. Zero-Knowledge Cryptographic Architecture

Tabvoro operates on a strict zero-knowledge architecture for all sensitive browser artifacts. Before any runtime profile data (including HTTP cookies, IndexedDB records, localStorage, passwords, bookmarks, and browsing history) is uploaded to the cloud sync servers, it is encrypted locally on the client machine using AES-256-GCM.

The master cryptographic key is derived entirely from the operator's client credentials using PBKDF2 with SHA-256 and high iteration counts. Tabvoro cloud servers, database workers, and network engineers do not possess the private keys and are mathematically incapable of decrypting profile content stored at rest or in transit.

2. Collected Account Metadata

To provide subscription licensing, authentication, and fleet synchronization, Tabvoro collects and stores only the following minimal account metadata:

Authentication Identity: Account email address and Argon2/PBKDF2 salted password hash.
Subscription Status: Plan tier (Starter, Professional, Enterprise), renewal timestamp, and billing state.
Fleet Metrics: Profile identifier UUIDs, last synchronization timestamps, and encrypted payload byte sizes.
Audit Logs: Authentication timestamps and IP addresses for enterprise fraud mitigation and unauthorized login detection.

3. Local Runtime Isolation & Non-Collection

Tabvoro never collects, logs, monitors, or analyzes:

Specific URLs, domains, or web traffic traversed within browser profiles.
Unencrypted usernames, plaintext passwords, or credit card autofill records.
Keystrokes, clipboard entries, or DOM page contents.
Private internal network topologies or unconfigured local IP addresses.

Each profile operates within an isolated macOS/Windows application sandbox with dedicated Chromium memory spaces and process boundaries.

4. Network & Proxy Telemetry

Proxy hostnames, ports, and authentication credentials configured inside profiles are stored locally in the desktop manager's encrypted state database. Proxy traffic is routed directly from the client profile to your configured egress proxy endpoint. Tabvoro infrastructure never acts as a proxy man-in-the-middle or inspects data packets traversing your proxy tunnels.

5. Data Retention, Portability & Cryptographic Erasure

Users maintain full sovereign ownership over their profile data. When an operator deletes a profile or closes an organization account:

The encrypted cloud snapshot blobs are permanently purged from Cloudflare edge caches and R2 storage buckets within 60 seconds.
The corresponding cryptographic salts and key identifiers are zeroed out in key storage databases.
Local profile sandbox directories on the operator's machine can be sanitized with one-click secure unlinking.

6. Regulatory Inquiries & Contact

Because of our zero-knowledge cryptographic model, Tabvoro cannot comply with requests to produce unencrypted profile contents, browsing logs, or session tokens under any circumstances, as such data does not exist in intelligible form on our infrastructure.