This page explains what Browzr Ltd. ("Browzr", "we", "us") collects when you use browzr.net, our browser extension, or our mobile app, why we collect it, who handles it for us, and what you can do about it. It is written to be read, so if anything is unclear, ask us.

1. What we collect and why

Your account. When you sign up, we store your email address and sign-in details. If you sign in with Google, Google shares your name, email, and avatar with us. We need this to run your account.

Your profile. Display name, bio, and avatar, if you choose to fill them in. These can be public, and you can edit them any time from your profile page.

Things you post. Community posts and comments, votes, site submissions, friend connections, and site recommendations are stored and linked to your account. Posts and comments are public by nature. If you submit a site for the catalog, we keep the contact email you give us so we can follow up.

How you use Browzr. If you accept analytics cookies, we record page views, which sites and games you interact with, and how long you spend, so we can improve the discovery feed. If you are signed in, some of this is linked to your account so the product works (your play history, for example, or not showing you the same site twice). If you are not signed in, it is tied to a random session id.

Personalisation. For signed-in users, we build interest scores from what you interact with so the discovery feed gets better at showing you things you will actually like. This is profiling, in the plain sense of the word, and it only ever shapes what we show you on Browzr. We do not sell this data or share it with advertisers.

Affiliate links and ads. Some links on Browzr are affiliate links or house ads. If you accept marketing cookies and click one, we record the click (with a hashed IP address for affiliate links, not the real one) before sending you on to the destination. If you reject marketing cookies, the links still work and nothing is recorded.

Games. Game scores and settings live in your browser's local storage and stay on your device. If you start a multiplayer battle in one of the guessr games, the display name you type and the game state go through Supabase Realtime so the other player can see them.

AI enrichment. When a site is submitted to the catalog, and when we process our own accounting receipts, content is sent to a language model (via OpenRouter) to summarise or extract it. This is about catalog and business records, not about profiling you.

2. The legal bases we rely on

UK GDPR says we need a lawful basis for each thing we do. Ours, in plain English:

• Contract: running your account, your profile, and the features you use (posts, votes, friends, play history).
• Consent: analytics and marketing cookies, and anything that only happens after you press Accept on the cookie banner, such as Google Analytics.
• Legitimate interests: improving the discovery feed, keeping the service secure, preventing fraud and abuse, and moderate record-keeping about how the product is used. We balance this against your privacy, which is why the optional tracking sits behind the banner.
• Legal obligation: business accounting records, which HMRC requires us to keep.

3. Cookies and browser storage

We keep this simple. There is exactly one necessary cookie, and one analytics family you can refuse.

Cookies we set on browzr.net

You can change your mind any time: the "Cookie preferences" button in the footer of every page re-opens the banner.

Things that live in your browser but are not cookies

Your browser also stores some data locally (localStorage / sessionStorage). This data never leaves your device on its own:

• Your cookie banner choice (browzr-consent), so we do not ask you every visit.
• Scores, settings, and progress for the mini games (PokeGuessr, F1Guessr, MMAGuessr, PlantGuessr, Flushy Turd, Fibr).
• A one-time flag so the intro tutorial only shows once.
• A session-only note of whether you arrived from a search engine, so we can tell if search traffic turns into signups. Deleted when you close the browser, and only written if you accept analytics.

What we count on our own servers (no cookie involved)

If you accept analytics cookies, our own servers keep counts of page views, which mini apps get played and for how long, and ad impressions. If you accept marketing cookies, we also record which affiliate links and ads get clicked; affiliate clicks are stored with a hashed IP address, not the real one. If you press Reject, none of these are recorded.

4. Who handles your data

We do not sell your data. We do use a small number of processors to run the service:

• Supabase (USA, region us-west-1): our database, authentication, file storage, and the realtime channel behind multiplayer game battles. This means your data is stored in the US, not the EEA; the transfer is covered by the standard safeguards Supabase offers (the UK extension to the EU-US Data Privacy Framework and standard contractual clauses).
• Hetzner (Germany, EEA): hosts our API server. Data passes through it transiently whenever you use the site.
• Google (USA): sign-in with Google, and Google Analytics 4 only if you accept analytics cookies.
• Purelymail (USA): our email provider, for account and contact email.
• OpenRouter (USA): the language-model gateway we use for AI enrichment of submitted sites and our own accounting receipts.
• jsDelivr (global CDN): serves the Supabase JavaScript library to the guessr games, but only when you explicitly start a multiplayer battle.
• Perenual: the plant data API used by PlantGuessr during gameplay; your browser contacts it directly.

Affiliate partners and the share buttons (Twitter/X, Reddit, Facebook) are destinations you choose to visit, not processors acting for us. Affiliate clicks are logged on our own servers before you are redirected.

5. How long we keep it

• Account and profile data: kept while your account is active, and deleted when you ask us to erase it.
• Community posts and comments: kept while your account is active, and deleted with it. Deleting your account removes your posts, comments, and roadmap posts for good.
• Usage and analytics records (page views, discovery signals, play sessions, funnel events, ad clicks): kept for up to 13 months, then aggregated or deleted. Signed-in play history stays with your account.
• Affiliate click records: kept for up to 13 months.
• Security and admin audit logs: kept for up to 12 months.
• Site submissions: the contact email on a submission is removed 90 days after the submission.
• Moderation reports: kept for up to 12 months after they are resolved.
• Multiplayer battle rooms (display names and scores): cleared within 7 days of the game finishing.
• Business accounting records (expenses and receipts): kept for 6 years, because HMRC requires it.

6. Your rights and how to use them

Under UK GDPR you can:

• Ask for a copy of the personal data we hold about you.
• Ask us to correct anything inaccurate. Your display name, bio, and avatar you can simply edit yourself on your profile page.
• Ask us to delete your account and personal data.
• Object to or restrict how we process your data, including the personalisation described above.
• Ask for your data in a portable format.
• Withdraw consent for analytics or marketing cookies at any time via "Cookie preferences" in the footer. This never affects the necessary sign-in cookie.

For anything you cannot do yourself from your profile, contact us through our contact page or email contact@browzr.net. We will respond within 30 days. There is no charge, and we will not treat you differently for asking.

7. If you are not happy

Talk to us first and we will do our best to sort it out. If you are still not satisfied, you have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:

• Online: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

8. Changes and contact

If we change this policy in a way that matters, we will say so on the site and update the date at the top. For any privacy question, reach us via the contact page or at contact@browzr.net.