Privacy Policy

1. Information we collect

Information you provide to us:

• Waitlist application: your email address and language preference.
• Support conversations: messages you send through the in-site support chat.

Information collected automatically:

• Device identifier: a one-way hash derived from browser and device characteristics, used only to prevent duplicate beta applications (see section 2).
• Security signals: IP address and user-agent string, used for abuse prevention and rate limiting.
• Attribution: the referring page and UTM parameters, used to understand which channels bring visitors.
• Human-verification signals processed by Cloudflare Turnstile when you submit the waitlist form.
• Analytics: Google Analytics 4 events and cookies — only after you accept analytics cookies in the consent banner.

2. Device identification

When you apply for the beta waitlist, we compute a one-way hash from a combination of your browser and device characteristics (such as screen properties, time zone, and rendering features). The computation happens locally in your browser using an open-source library; the raw characteristics never leave your device.

We use this hash for exactly one purpose: preventing duplicate beta applications from the same device. The hash is stored in salted, re-hashed form and is anonymized within 90 days after the beta ends. It is never shared with, or sent to, any third party.

3. Fingerprint Lab

The Fingerprint Lab (mangobrowser.net/lab) shows you what a website can learn about your browser. Every measurement — canvas, WebGL, audio, fonts, screen, timezone, automation signals and the locally computed "fingerprint ID" — is calculated inside your browser and displayed on the page only. We do not upload, store or log these values, and no cookie is set.

Three things leave your device when you run a scan:

• One request to our own server, which echoes back the identity headers your browser sent (User-Agent, Accept-Language, Client Hints) and your IP address, so the page can compare them with what JavaScript reports.
• A lookup of that IP address with our IP-geolocation provider (see section 6) to obtain its country, city and timezone. The provider receives your IP address for the purpose of that lookup; we do not store the result beyond a short in-memory cache.
• A WebRTC connectivity check that sends a single binding request to a public STUN server (operated by Cloudflare) to learn which public address the server sees. This is the same request any video-call page makes.

Optional "Copy report" copies the results to your own clipboard; nothing is sent to us. If you accept analytics cookies, we record that a scan completed together with its score band — never the measured values.

4. How we use information

• To send beta invitations and important product announcements to your waitlist email.
• To protect the waitlist and the site against abuse, spam, and duplicate applications.
• To measure and improve the website with aggregated analytics (consent-based).
• To respond to your support requests.

We do not sell your personal information, and we do not use it for third-party advertising.

5. Cookies

• Essential cookies: remembering your language choice and security cookies set by Cloudflare. These are required for the site to function.
• Analytics cookies (Google Analytics 4): set only after you click "Accept" in the cookie banner. Declining keeps analytics off; you can also clear cookies in your browser at any time.

6. Service providers

We rely on a small number of infrastructure providers that process data on our behalf under contractual safeguards:

• Cloudflare — content delivery, security, Turnstile human verification, and the public STUN server used by the Fingerprint Lab.
• ipinfo — IP geolocation for the Fingerprint Lab timezone check (receives the visitor IP only).
• Google Analytics — consent-based website analytics.
• Cloud hosting and email delivery providers used to run the service and send waitlist emails.

7. Data retention

• Waitlist email addresses: kept for the duration of the beta program and up to 12 months afterwards, or until you ask us to delete them.
• Device identifier hashes: anonymized within 90 days after the beta ends.
• Security logs (IP, user agent): kept for a short rolling window for abuse prevention.
• Analytics data: retained according to our Google Analytics settings.

8. Your rights

You may request access to, correction of, or deletion of your personal information, and you may withdraw analytics consent at any time. Email us at support@mangobrowser.net and we will respond within a reasonable period. We may need to verify that a request comes from the email address concerned.

9. Security

All traffic to the site is encrypted in transit (TLS). Device identifiers are stored only as salted hashes. Access to personal data is limited to team members who need it to operate the service. No method of transmission or storage is completely secure, but we work to protect your information appropriately.

10. International transfers

Our infrastructure providers may process data in jurisdictions other than your own. Where that happens, we rely on the providers’ standard contractual safeguards.

11. Children

The site and the beta program are not directed at anyone under 18. If we learn that we have collected personal information from a minor, we will delete it.

12. Changes to this policy

We will post any changes on this page and update the "Last updated" date. For material changes we will provide additional notice, such as an email to the waitlist.

13. Contact

Privacy questions and requests: support@mangobrowser.net.