Privacy Policy

Last updated: 28 March 2026

1. Who We Are

Tobava ("we", "us", "our") operates tobava.com and related services including Tobava Search, Tobava Browser, Tobava Health, and Tobava Ledgr. Our contact email is [email protected].

2. What We Collect

Tobava Browser is private by design. No browsing history, no search history, and no personal identifiers ever leave your device. The browser may send the following non-personal data:

• Anonymous usage analytics — on startup, the browser may send your app version and operating system to tobava.com to count active users. No personal data, IP addresses, or device identifiers are stored. You can disable this in Settings > Privacy > Anonymous Usage Analytics.
• Crash reports — if the browser crashes, an anonymous crash report may be sent to help us fix bugs. These contain no personal data or browsing activity.
• Permissions — websites may request access to your location, camera, or microphone. The browser always asks your permission first and never grants access automatically. You can disable these entirely in Settings > Permissions.
• AI Page Summary — if enabled in Settings, page content (text only) is sent to our server to generate a summary. You can disable this entirely in Settings > AI Features. When disabled, no page content is sent to any server.
• Free VPN — if you enable the Free VPN in Settings, your web traffic is routed through proxy.tobava.com. We do not log, inspect, or store your browsing traffic. The proxy is used solely to provide the VPN service.

Tobava Search collects nothing. Searches are routed through SearXNG. We do not log, store, or link queries to any user or device.

If you create an account (optional): We store your email address and a hashed (bcrypt) version of your password — the minimum required to log you in. We never store your password in plain text.

If you contact us: We receive your message and optionally your reply email address. This is used only to respond to you.

3. How We Use It

• Your email is used only to log you in and send MFA codes from [email protected]
• Contact messages are used only to reply to you
• Nothing is used for advertising, profiling, or sold to anyone

4. Email Communications

We send transactional emails only — account verification codes and password reset links. We do not send marketing emails without your explicit consent. All transactional emails are sent from [email protected].

5. Third-Party Services

• SearXNG — self-hosted search engine. Search queries are not shared with third parties.
• Google AdSense — may display ads on some pages. Google may set cookies. See Google's Privacy Policy.
• ip-api.com — used for country-level geo-lookup at login for security purposes only.
• Mailcow — self-hosted email server at mail.tobava.com. Your email address is stored on our own infrastructure.
• OpenStreetMap Nominatim — used for reverse geocoding (converting your coordinates to a city name) for the weather widget. Your approximate location is sent to nominatim.openstreetmap.org only if you grant location permission. See OSM's Privacy Policy.
• Tobava Proxy — self-hosted SOCKS5 proxy at proxy.tobava.com. Used only when the Free VPN is enabled. No traffic is logged or inspected.

6. IP Addresses

We do not store IP addresses in our systems. Third-party services may process IP addresses as part of their operation.

7. Data Storage and Security

Your data is stored on secure cloud servers. We use bcrypt password hashing, JWT authentication, and HTTPS encryption for all data in transit. We do not sell or share your personal information with third parties for marketing purposes.

8. Data Retention

Account data is retained while your account is active. MFA codes are deleted immediately after use or expiry (10 minutes). You may request deletion of your account and associated data by emailing [email protected].

9. Your Rights

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and personal information

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

10. Cookies

Tobava Search and tobava.com use minimal cookies for session management. Google AdSense may set advertising cookies. You can disable cookies in your browser settings, though some features may not function correctly.

11. Children's Privacy

Our services are not directed at children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users by email of material changes. The updated date at the top of this page will always reflect the latest version.

13. Contact Us

For any privacy-related questions or concerns, contact us at [email protected] and we will do our best to resolve it promptly.