Privacy Policy — Novel Browser

Last updated: 2026-10-25

1. Overview

Novel Browser ("the App") is a web browser with AI-powered translation capabilities. This Privacy Policy explains how your data is handled when you use the App.

2. Data We Collect

The App processes data only as described in this Policy. Translation text may pass through our translation service and an AI provider as described in Section 3. Hashed device identifiers and quota or rewarded-ad usage records are handled as described below.

2.1 Device Identifier (Translation Usage Limits)

When you use translation through our translation service (free or subscription), the App collects your device's Android ID, hashed with SHA-256 before transmission. The original value is never stored or sent. We store the hashed identifier and the amount of translation usage associated with your device on our translation service servers until you request deletion (Section 9). The base free allowance is not reset on a daily schedule. Rewarded-ad allowance is tracked separately from the base free allowance and may include a limited carryover period.

Purpose: To provide fair-use translation limits without requiring user account creation.

2.2 Rewarded Advertising (Optional)

If you choose to watch rewarded ads, Google AdMob may collect your Advertising ID (AAID) and related data for ad delivery. Completing a rewarded ad may increase your translation allowance through our translation service. We store ad view counts and rewarded-ad allowance usage associated with the hashed device identifier to apply and enforce that allowance.

2.3 Usage Analytics (Optional)

You choose whether this is sent. Nothing is sent unless you select the optional "I agree to send usage data." checkbox during initial setup or turn on the switch in Settings → Privacy & Data. The checkbox is unchecked by default. Leaving it unchecked does not change the App's features. Your choice, its time and the Policy version are stored on your device.

When it is on, the App sends the following to PostHog in the EU region (https://eu.i.posthog.com), under a random analytics ID that is not derived from your name, account, Android ID or advertising ID:

Events: consent granted (Policy version) and consent withdrawn (one deletion request per ID); app launch (whether it is the first launch, and how the app was opened: cold start, warm start, or right after choosing to send), onboarding completion (number of steps, onboarding mode), how a URL was entered (address bar, bookmark, history, opened from another app, or shared to the App), page load success (load time, restored or not), page failure (reason category, SSL or not), reader opened (paragraph-count bucket, extraction time) or failed (reason category), translation started (target language), translation completed (duration, character-count bucket, number of chunks as a whole number, outcome) or failed (reason category), quota exhaustion (kind, plan), rewarded-ad grant (placement), and the purchase screen appearing (product, what triggered it).
Numbers: timings in milliseconds (page load, reader extraction, translation, launch); session length in seconds; URL length, paragraph count and character count as coarse buckets; and per-session counts of chapters read and translations completed.
App information: app version, build number and Android major version.

We never send, for usage analytics: page URLs, domain names, page titles, page text, translated text, text you type, your search queries, your reading log, or your advertising ID.

Processor and location. PostHog, Inc. (service name PostHog) processes this data on our behalf, under our instructions. The data is stored on servers in the European Union (https://posthog.com/privacy). PostHog, Inc. is a US company. PostHog keeps each analytics ID as a person record so that the events can be grouped and deleted together with it. That record holds the random analytics ID and the event properties listed above — no name, email address, account, Android ID or advertising ID. We do not sell or share this data.

IP address. Our PostHog project is configured to discard client IP addresses, and the App also sends the IP field as 0.0.0.0 with IP-based geolocation disabled. As a result, the events we store do not contain your IP address.

Legal basis (EEA, UK, Switzerland): your consent (GDPR Article 6(1)(a)). You can withdraw it at any time.

Retention: we delete an analytics ID together with all of its events once it has not been used for 11 months. A daily job collects the IDs that have asked for deletion and the IDs that have been inactive that long, and deletes them in PostHog; these events are not copied anywhere else. If an analytics ID keeps being used, its older events can stay in PostHog for longer than a year.

Turning it off: you can turn it off at any time in Settings → Privacy & Data. Sending stops immediately. When you turn it off, the App sends one deletion request for each Analytics ID this device used — outside the normal analytics path, containing only that analytics ID, the time it is sent, and a random id used to avoid duplicates — so that we can delete what was already sent. If it cannot be sent (for example while offline) the App keeps it and retries on the next launch or when the device is back online until it is accepted. Settings → Privacy & Data keeps showing every Analytics ID this device has used. We submit the deletion as soon as the request reaches us and aim to finish within 30 days, without waiting for you to ask; if your device was offline, the request reaches us when it reconnects. PostHog processes deletions asynchronously, so they can take longer to complete, and we keep checking each request until it is done.

Purpose: to see where the App fails and which features are not used, so we can improve them.

How we can show your consent: an analytics ID is generated only after you opt in to sending usage data, and the App then sends one consent_granted event with the version of this Policy. Together with the record kept on your device, this shows which version you agreed to and when. The device record is never sent.

3. Data Sent to Third-Party AI Providers

When you use translation, text visible on the current page and selected for translation is sent off your device for processing. The App cannot determine whether that text contains personal or sensitive information. Depending on your plan:

Free Tier & Subscription Plan (translation service): Your text is routed through our translation service and processed by contracted cloud infrastructure and AI processing providers solely to provide translation.
BYOK (Bring Your Own Key): Available with a paid subscription. Your text is sent directly to the AI provider you configure (OpenAI, Anthropic, Google Gemini, OpenRouter, or a custom endpoint) without using our translation service.

Our translation service does not store translation text. The currently contracted AI processing service states that it does not store inputs or outputs and does not use customer data to train, retrain, or fine-tune hosted models.

Text is sent only when you activate translation or a translation setting you enabled triggers it. Do not translate pages containing sensitive information unless you agree to this processing.

For BYOK, processing and retention are also governed by the policy of the provider you configure: - OpenAI: https://openai.com/policies/privacy-policy - Anthropic: https://www.anthropic.com/legal/privacy - Google Gemini: https://policies.google.com/privacy - OpenRouter: https://openrouter.ai/privacy

4. Data Stored on Your Device

The following data is stored locally on your device and is not transmitted to us as personal data:

API Keys: Stored encrypted using Android Keystore (AES-256-GCM).
Translation Cache: Previously translated text is cached locally to reduce API costs on repeat visits. You can clear this cache at any time in Settings.
Glossary Terms: User-managed term translations stored in a local database.
Browsing History & Bookmarks: Stored locally. You can delete them at any time.
Reading Log: Page URL, title, domain, reading time, and session timestamps are stored locally for Reader statistics. Page text, translated text, and full page contents are not saved. You can delete the reading log at any time in Settings.
Domain Preferences: Per-site translation and glossary settings.
Subscription Status: Your Play Billing entitlement status is stored locally.

5. Cookies and Site Data

The App uses GeckoView (Mozilla's browser engine) to render web pages. Websites you visit may set cookies and store site data as they would in any browser. You can clear cookies and site data at any time in Settings.

6. Third-Party Services

The App may use third-party components for browsing, advertising, payments, optional crash reporting, usage analytics, and translation routing. Each provider handles data under its own policies. Usage analytics is processed by PostHog, Inc. (service name PostHog, EU region, https://posthog.com/privacy) as our processor, on our instructions, for the purposes in Section 2.3; for that purpose we never send page content, URLs, or anything you type.

7. Data Sharing

We do NOT sell, rent, or share any user data with third parties for marketing. The data that leaves your device for our service consists of:

The hashed device identifier and usage data for quota management (Section 2.1).
The text you explicitly choose to translate, sent via our translation service or directly to the AI provider you configure.
Advertising identifiers processed by Google AdMob when you interact with ads.
Action events when you enable usage analytics (Section 2.3). Our analytics processor acts on our behalf, so this is not sharing.

8. Children's Privacy

The App is not directed at children under 13. We do not knowingly collect data from children.

9. Your Rights

Since most data is stored locally on your device, you can delete it at any time by:

Clearing browsing data in Settings → Privacy & Data
Clearing translation cache in Settings
Uninstalling the App (removes all local data)

Server-side quota data includes hashed device identifiers, translation service usage records, ad view counts, and rewarded-ad allowance usage. It is retained until you request deletion. Email badmumyo@gmail.com (subject: Data Deletion Request) with your Deletion Request ID from Settings → Privacy & Data, or see https://badmumyostudio.github.io/data-deletion.html

Upon deletion, we erase server-side usage records. To prevent abuse, we retain a hashed device identifier and a flag indicating that the free tier was previously used. This data cannot identify you personally and is kept only for fraud prevention. Free translation quota is not restored after deletion.

Usage analytics stops sending as soon as you turn it off. Use of the sending ID ends; all IDs remain on your device as history for deletion requests. The App automatically sends one deletion request per ID through a separate path and retries on the next launch or when back online until accepted. We submit the deletion as soon as the request reaches us and aim to finish within 30 days, without waiting for you to ask, and keep checking it until it is done; if your device was offline, the request reaches us when it reconnects. You can also email badmumyo@gmail.com (subject: Analytics Deletion Request) with all Analytics IDs from Settings → Privacy & Data. EEA, UK and Swiss residents may request a copy of the data in Section 2.3 and complain to their local supervisory authority.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected in the App and on our website.

11. Contact

For questions about this Privacy Policy, please contact us at: badmumyo@gmail.com

12. Google Play Data Safety Disclosure

For the Google Play Data Safety section, we declare the following:

Translation text: Sent off-device only when translation is used, for app functionality. It is processed for the real-time request and may contain personal or sensitive information from the page.
Web browsing history and reading activity: stored on device only, not transmitted. With usage analytics on, only per-session counts (chapters read, translations completed) are sent — never URLs or titles.
Crash logs and diagnostics: crash reports go to Sentry only when a Sentry DSN is configured in the build, which it is not in the build we publish. Performance timings (load, extraction, translation, launch, session length) are sent with usage analytics and declared as Diagnostics.
Device or other IDs: a SHA-256 hashed Android ID is used for translation usage limits and is required for that feature; the analytics ID is random and only sent with your consent.
Usage data (optional): the events and numbers in Section 2.3 with a pseudonymous analytics ID, sent to PostHog, Inc. (EU region) only after you opt in to sending usage data. No URLs, domain names, page titles, page text or typed input. Processed on our behalf as a service provider, not shared. Declared as App activity (App interactions), App info and performance (Diagnostics) and Device or other IDs; collected, not shared, optional, for Analytics, and not processed ephemerally.