This document details the Privacy Policy and Data Security configurations for Omni Browser. Because Omni Browser is built on a strict privacy-first, on-device-first architecture, the application does not collect, monitor, store, or share any user personal information on remote servers.

1. Privacy Policy

1.1 Data Collection & Transmission

• Zero Remote Storage: RebelRoot does not host any backend databases, account servers, or analytics pipelines for Omni Browser. All browsing history, bookmarks, open tabs, cookies, and locker files remain entirely on your local device.
• No Telemetry / Analytics: All analytics and diagnostic telemetry inside secondary components have been deactivated:
  • Google ML Kit Telemetry Opt-Out: Omni Browser opts out of ML Kit telemetry tracking. No translation strings, scanner logs, or device details are sent to Google.
  • No Third-Party SDKs: The app contains no advertisement SDKs, crash reporters (like Firebase Crashlytics), or telemetry tracking code.

1.2 Permissions & Usage Disclosure

Omni Browser requests permissions only when necessary to perform core browser and utility features. All data processed via these permissions remains on-device:

1.3 Third-Party Services & Libraries

Omni Browser incorporates open-source and Google libraries for local utilities:

• Mozilla GeckoView Engine: Renders web pages. It operates locally and adheres to standard Web API protocols.
• WireGuard VPN: Operates locally to encrypt external web traffic. Omni Browser does not monitor, route, or decrypt network traffic passing through the tunnel.
• Google Play Services (Code & Document Scanners): Utilizes zero-permission clients where Google Play Services handles OCR and scanning operations locally on-device.

1.4 Data Deletion

All local data can be incinerated instantly using the built-in Fire Button (data incinerator), which executes clean database and memory wipes. Uninstalling the application completely deletes all browser records, encrypted lockers, and database files.

2. Data Safety & User Satisfaction Commitment

RebelRoot is committed to providing a secure browsing environment that prioritizes your peace of mind and satisfaction. We back this commitment with strict data safety protocols:

2.1 Zero Data Harvesting

We guarantee that Omni Browser does not collect, harvest, or share any of your personal details, browsing history, search queries, or downloaded files. Everything remains strictly on your device.

2.2 Encryption by Default

We ensure that all web traffic generated by the browser utilizes industry-standard HTTPS protocols to secure your data in transit. In addition, the application enforces TLS security for WebExtension APIs to prevent man-in-the-middle interceptions.

2.3 Complete Data Sovereignty

We empower you with full control over your digital footprint. You can instantly incinerate all browsing sessions, cookies, history, and secure locker databases with a single tap of the built-in Fire Button, or completely purge all traces by uninstalling the app.

2.4 No Device Tracking

We promise that Omni Browser never accesses, monitors, or transmits hardware identifiers (such as IMEI, MAC address, or Android ID) and contains no advertising tracking SDKs.

3. Data Security Implementation Details (Technical)

To back up the Data Safety declarations, Omni Browser incorporates the following security controls at the code level:

1. SQLCipher Database Encryption:
   All SQLite databases (history, settings, bookmarks) are encrypted using SQLCipher (AES-256) via the Android Room library. The encryption key is derived securely and stored using Android Keystore.
2. EncryptedFile Storage:
   Imported locker files are encrypted on-disk using AndroidX Security-Crypto wrapper around AES-256 GCM encryption.
3. No Cleartext Traffic:
   Cleartext HTTP requests from the Android Application layers are blocked (HTTPS enforcement).
4. Log Stripping:
   Production release builds run aggressive R8 optimizations to strip out all debug and informative log outputs, preventing sensitive browser variables from being dumped into the system logcat.