Privacy Policy

Who is responsible

Browseo, the operator of browseo.app, decides why and how your personal data is processed (the data controller, "veri sorumlusu" under the KVKK). The legal name and registered address of the operator will be added when the legal review is complete. You can reach us at [email protected].

What this policy covers

The website browseo.app, the account you can create there and the Browseo desktop app. The pre-test invite form has its own, shorter notice: the pre-test privacy notice. How cookies are used is in the cookie notice.

The desktop app: what stays on your computer

Browseo analyses the pages you open on your own computer. Pages, reports, snapshots, history, bookmarks and profiles are stored locally. The app sends no telemetry and no crash reports, and the analysis does not send page content or page addresses to us.

The app contacts our servers or other servers only in these cases:

• Account: when you sign in, the app exchanges your credentials for tokens and fetches your plan as a signed licence (an entitlement lease) so that Pro features keep working offline. We receive your sign-in details and the name and an identifier of the device.
• Updates: the app downloads a signed release list to check for a new version. The update server sees the technical data every web request carries, such as your IP address.
• PageSpeed Insights (optional): only after you allow it, the address of the page you test goes to Google, directly with your own API key on Free or through our server on Pro.
• Search Console (Pro, optional): after you connect your Google account with read-only consent, requests for your properties and addresses go through our server to Google.
• AI analysis (Pro, optional): only the findings you picked, their short evidence and the page address as domain and path without query parameters, after you confirm a preview. They go through our server to Anthropic.

The data we process

• Website visit: the technical data of every request (IP address, time, requested path, browser type), used to deliver the pages and protect the service. The site runs no analytics or advertising trackers, and the public pages set no cookies.
• Account: e-mail address, username, display name, language, and the time you accepted the terms. Your password is stored only as a salted Argon2id hash. If you sign in with Google, we also receive your Google account identifier and the e-mail address Google gives us.
• Sessions and devices: for each device you sign in on, its name and an identifier, and when its session was created, last used and ended, so that you can see and sign out your devices.
• Plan and payment: your plan, subscription status and billing period, and a customer identifier from Stripe. Stripe collects your card details on its own page; we never see or store them.
• Usage counters: how many PageSpeed Insights, Search Console and AI requests you made this month, to apply your plan's quota.
• Search Console connection: if you connect it, the access token (stored encrypted) and the label of the Google account.
• Security log: events of your account such as sign-ins, password changes and device sign-outs, without the content of requests.
• Messages: what you write to [email protected].

Why we process it, and on what legal basis

• To provide the website, your account, your plan and the app features you use: performance of a contract (Article 6(1)(b) GDPR; Article 5(2)(c) KVKK).
• To keep the service secure and prevent abuse, with rate limits and a security log: our legitimate interests (Article 6(1)(f) GDPR; Article 5(2)(f) KVKK).
• To process payments and meet accounting and tax duties: contract and legal obligation (Article 6(1)(b) and (c) GDPR; Article 5(2)(c) and (ç) KVKK).
• Optional features that send data to Google or Anthropic: your explicit consent, given in the app when you connect or confirm (Article 6(1)(a) GDPR; Article 5(1) KVKK). You can withdraw it at any time.
• Answering your messages: our legitimate interests and, where you ask about your account, the contract.

Who receives your data

We do not sell your data and do not use it for advertising.

• Our hosting: servers we operate in the European Union.
• Stripe, for payments, only if you buy a plan.
• Google, for Google sign-in, PageSpeed Insights and Search Console, only if you use them.
• Anthropic, for AI analysis, only if you use it and only what you confirmed in the preview.
• Our e-mail provider, to send you messages such as the address verification e-mail.

Transfers outside the EU and Turkey

Some of the providers above, such as Stripe, Google and Anthropic, may process data in other countries, including the United States. We rely on the safeguards the law provides, such as an adequacy decision or standard contractual clauses. The details of these safeguards will be completed during the legal review.

How long we keep it

• Account data: for as long as your account exists. When you delete your account in the account portal, your account data is deleted. Billing records and a minimal security trail may be kept for as long as the law and the security of the service require.
• Sign-in sessions: up to 30 days; ending a session or deleting the account ends it sooner.
• Pre-test invites: until the pre-test ends or you withdraw consent, at most 12 months after your request.
• Server logs: for a short period for security purposes. The exact periods will be completed during the legal review.

Your rights

You can ask us to tell you whether we process your data and give you a copy (access), correct it, delete it, restrict or object to its processing, and receive your data in a portable form. Where we rely on your consent you can withdraw it at any time, which does not affect processing before then.

You can export your account data and delete your account yourself in the account portal. For anything else, e-mail [email protected]. We answer within one month (GDPR) and in any case within thirty days of a KVKK application (Article 13 KVKK).

You can also complain to a data-protection supervisory authority where you live. In Turkey this is the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

KVKK notice

This policy is also the information notice required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (KVKK). Your rights are listed in Article 11 KVKK. You can apply to us in writing or by e-mail to [email protected].

How we protect it

• Passwords are stored as Argon2id hashes, never in plain text.
• Connections to the site and the API use HTTPS.
• Search Console tokens are stored encrypted. Sign-in tokens in your browser are in HttpOnly cookies.
• The desktop app keeps your pages and reports on your computer.

Changes to this policy

When this policy changes, we update the date at the top. For substantial changes we also tell account holders by e-mail.