Privacy Policy

Summary

1zero makes free desktop apps (1zero Browser, 1zero Code, 1zero Notetaker, 1zero File Explorer) and runs this website, 1zero.app. We don't sell data, show ads, or build profiles. The apps have no analytics libraries or crash reporting; our server only counts update checks and web searches as they arrive. Update checks are counted without knowing who sent them; web searches are counted with the IP address they came from, never what was searched. The apps work on your computer and keep your files, history, and settings there.

Some features need a server, and this policy lists each of them: update checks, web search and plugin data in 1zero Browser, support reports you choose to send, and donations. It also covers the website's anonymous analytics and download counter, and the third parties the apps talk to directly, such as Google for Gmail sign-in codes and GitHub for 1zero Code.

We've tried to describe what the software actually does, including the parts that are less flattering. If something here doesn't match what you see, tell us and we'll fix the software or this page.

What we don't do

• We don't put analytics, tracking SDKs, or crash reporting in any of the apps. The only counting happens on our server, as update checks and web searches arrive. Update check counts never include who you are; web search counts include your IP address, as described below.
• We don't log what you type into web search, and we don't receive your browsing history, open tabs, bookmarks, notes, code, or files.
• We don't receive your Gmail messages, sign-in codes, or Google or GitHub tokens. Those go between your computer and Google or GitHub.
• We don't sell or rent data, share it for advertising, or use it to train AI models.
• We don't set tracking cookies on the website.

Google user data

This section covers the Google user data that 1zero Browser accesses when you connect a Google account to its Gmail sign-in codes plugin. It applies to the 1zero Browser desktop app and the OAuth client 1zero uses to sign you in to Google. No other 1zero app or service accesses Google user data.

The plugin is off until you install it from the Plugins page and choose Connect Gmail. It looks for sign-in codes (one-time passcodes and verification codes) in mail that has just arrived, and shows them in the browser's Dynamic Island so you can copy or autofill them on the page you're signing in to.

Data we access

When you connect, you sign in on Google's own page in a browser tab and grant these permissions (OAuth scopes):

• https://www.googleapis.com/auth/gmail.readonly: read-only access to your Gmail. The browser can't send, change, label, or delete mail.
• openid and profile: your basic Google profile. The browser uses only your profile picture from it.

With these, the browser accesses:

• your Gmail address and your mailbox's current history ID (a position marker Gmail uses to report what's new);
• the list of messages added since the last check, with their message IDs and labels;
• the full content of newly arrived messages: the subject, sender, date, and the text of the body. Messages in Sent, Drafts, and Trash are skipped, and messages more than 10 minutes old are ignored. Spam is included, because codes often land there;
• your profile picture, if your Google account has one.

The browser checks for new mail every 4 seconds while one of its windows is in front, every 45 seconds otherwise, and every 2 seconds for up to 5 minutes while you're on a sign-in page. Each check reads at most 6 new messages. When you connect, it also looks through mail from the last hour (at most 10 messages). It doesn't search, read, or download the rest of your mailbox.

To know when you're on a sign-in page, the browser looks at the current tab's address and title and checks whether the page has a code or password field. This happens on your computer, never in incognito tabs, and never reads what you type.

How we use it

Google user data is used only to provide the sign-in codes feature to you:

• message content is scanned on your computer for a sign-in code;
• a found code is shown in the Dynamic Island with the sender's name and when it arrived, and can be copied or filled into a one-time code field on the page you're on. Copying each code automatically is off by default;
• choosing a code can open that message in Gmail, using its message ID;
• your email address and profile picture are shown in Settings so you can tell your connected accounts apart;
• the history ID and recent message IDs are used to fetch only new mail and never show the same code twice.

We don't use Google user data for anything else. We don't use it for advertising, don't build profiles from it, and don't read it ourselves.

How it's stored and protected

Google user data stays on your computer. It's sent between your computer and Google's servers over HTTPS, and never to 1zero's servers.

• Saved on your computer, in a file readable only by your user account: your Gmail address, the history ID, your profile picture's link, the IDs of up to 200 recently checked messages, and your refresh token, encrypted with your operating system's keychain (macOS Keychain, Windows DPAPI, or the Linux secret service). If no keychain is available, nothing is saved and you're signed out when the browser quits.
• Kept only in memory, and gone when the browser quits: the short-lived access token, up to 5 recent codes with their senders' names and times, and your profile picture.
• Not kept at all: message subjects, bodies, and addresses. Each message is read, checked for a code, and discarded.

Sign-in uses Google's flow for desktop apps with PKCE, and Google sends the result back to a one-time server on your own computer (127.0.0.1), so no one else can complete your sign-in. The browser's diagnostic logs never contain your codes, email address, message subjects, senders, message text, or tokens.

Sharing and disclosure

We don't share, transfer, sell, or disclose Google user data to anyone, including ourselves. It never leaves your computer except in requests to Google. No 1zero employee, contractor, or service provider can see it.

If you choose to send a support report with logs, the logs can say that Gmail was checked, how many messages were read, how many codes were found, how long it took, and any error codes from Google. When a message looks like a code email but has none, they record only the sizes of its parts so we can improve detection. They never include anything from the messages themselves or your email address.

Retention and deletion

• Codes are kept in memory, at most 5 at a time, and are forgotten when you quit, turn the plugin off, or disconnect.
• Your saved account stays on your computer until you disconnect it. Settings → Gmail → Disconnect revokes the browser's access with Google and deletes the saved account, its token, and its codes.
• You can also remove 1zero's access at any time from your Google Account's third-party connections. The browser then stops reading mail.
• Deleting 1zero Browser's app data folder deletes everything it saved.

Since Google user data never reaches our servers, we hold none to delete. If you have questions or want help removing it, email support@1zero.app.

Limited Use

1zero Browser's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing sign-in codes feature described above.
• We don't transfer Google user data to third parties, or to our own servers.
• We don't use or transfer Google user data for serving advertisements, including personalized, retargeted, or interest-based advertising.
• We don't sell Google user data, or transfer it to data brokers or information resellers.
• We don't use Google user data to determine creditworthiness or for lending purposes.
• No human reads Google user data. The browser processes it automatically on your computer, and it never reaches us.
• We don't use Google Workspace API data, including Gmail data, to develop, improve, or train generalized or non-personalized AI or machine learning models. We don't use it to train any AI or machine learning model.

If we ever change how 1zero Browser uses Google user data, we'll update this section before the change ships and note it in the release notes.

Every app

Update checks

Every app asks 1zero.app whether a newer version exists. Our server answers with a redirect to the release files, which are stored on Cloudflare R2. The request asks for a file named after your operating system, so it reveals your platform, and later downloads reveal your processor architecture. Like any network request, it also reveals your IP address.

The update library we use (electron-updater) creates a random ID once per install, saves it in the app's data folder as .updaterId, and sends it with each check. It isn't tied to you or your device, and deleting the file makes a new ID.

To know how many installs are in use, our update route counts each check in Databuddy (our analytics provider) with the app, platform, your country, and, in newer versions, the app version and processor architecture. The country comes from our host's lookup of your IP address; the address itself isn't kept or passed on. Instead of the ID, it sends a keyed one-way hash of it, which can't be turned back into the ID without our secret key, so the counts can't be matched to the file on your computer. Databuddy stores that hash as it is, so the same install is recognized from one day to the next. Your IP address isn't sent: Databuddy only hears from our server. So each install counts at most once an hour, our server keeps that hash for an hour. Update downloads are counted the same way, without the ID.

• 1zero Browser checks 3 seconds after launch and then every 30 minutes by default. In Settings you can change the interval (from every 2 minutes to once a day, or launch only), stop checking at startup, and turn off automatic installs. With automatic installs on, updates download in the background and install when you quit or restart.
• 1zero Code checks 3 seconds after launch. Settings → Updates lets you turn off the launch check, automatic downloads, and installing on quit. It waits to install until no agent sessions are running.
• 1zero Notetaker and 1zero File Explorer check once, 3 seconds after launch. They don't have a setting to turn this off yet.

Development builds never check for updates.

No analytics libraries, no crash reports

None of the apps include analytics, telemetry, or crash reporting libraries, and none of them use Electron's crash reporter. When 1zero Browser crashes, it writes to its local log and offers to send a report, which is up to you.

Shared theme and background

Your theme and background image are shared between the apps through files in a 1zero folder in your system's app data directory. The background setting stores the location of the image you chose (the image isn't copied) and up to 12 recent choices. None of this leaves your computer.

1zero Browser

Web results as you type

When this is on (the default), what you type in the command center is sent to 1zero.app along with your app's language. Addresses and !bang shortcuts aren't sent. Suggestions are requested shortly after you pause typing, and full results once you've typed two or more characters. At most 256 characters are sent.

Our server fetches the results from third-party search engines on your behalf, so they see our servers, not you. Results come from our own SearXNG instance, which asks Google, Bing, Brave, DuckDuckGo, Mojeek, Qwant, Yahoo, and Wikipedia, and uses DuckDuckGo for suggestions. If it fails or finds nothing, we ask the Brave Search API instead. SearXNG's metrics are switched off.

• We never log query text.
• Each search for results that reaches our server is counted in Databuddy with its language, country, whether it found anything, and the IP address it came from (suggestions only when they fail). We need the IP address to moderate the platform: if someone abuses our search systems, for example by sending automated or excessive searches, it lets us find and block where that traffic comes from. We also use the addresses to see how many people search. Never the query, and never any ID from your computer. Searches answered from the cache don't reach our server, so they aren't counted.
• Answers are cached so identical queries aren't sent twice. Suggestions are cached for an hour and may be served for up to a day after that while they refresh. Results are cached for 10 minutes and may be served for up to an hour after that. The cache is keyed by the query and language, not by who asked.
• The browser also keeps answers in memory for 5 minutes, and forgets them when it quits.
• Icons for results and bangs that aren't already in your tabs or history are loaded through 1zero.app, which tells our server the site's domain. Our server gets the icon from DuckDuckGo's icon service, so the site itself isn't contacted.
• This setting also applies in incognito windows. Turn web results off in Settings to keep typed text on your computer.

Searching from the address bar

When you press Enter on a search, the browser opens your default search engine in a tab, like any browser. Google is the default. You can choose DuckDuckGo, Bing, Brave, Kagi, Ecosia, or up to 50 engines of your own. That engine then receives your search under its own privacy policy. We don't.

Gmail sign-in codes

This optional plugin reads new Gmail messages on your computer to find sign-in codes. Everything it accesses, how it's used, stored, shared and deleted is described in Google user data.

Plugins

• The catalog. The Plugins page downloads the catalog from 1zero.app at most every 10 minutes, and only while the page is open.
• Install counts. Installing or removing a plugin sends only the plugin's name and +1 or −1, without cookies or any device ID, so we can show how many people use it. We don't record your IP address with it.
• Stocks. Market data comes from our server, which gets it from Alpha Vantage. Everyone receives the same answer, and your watchlist and settings are applied on your computer.
• News. News topics are fetched from our server, which asks the news engines in our SearXNG instance (Google, Bing, DuckDuckGo, Brave, Qwant, and Yahoo news). Story images for topics are loaded through our server so the publishers don't see you. RSS feeds you add are fetched directly from those sites, not through us, so we never learn which feeds you follow.
• Currency. Exchange rates are fetched at most once an hour, only when you type a currency question. They come from our server, or straight from the European Central Bank if ours can't be reached. What you typed isn't sent.
• Focus mode makes no network requests. Your blocked sites, schedules, current session, and daily totals (minutes, sessions, and how many times a site was blocked, kept for 90 days) stay on your computer.
• Media and food delivery. The Dynamic Island reads what's playing and order pages from your open tabs on your computer. Album art is downloaded from the image's own server without cookies.

Discord status

If you install the Discord plugin, the browser talks to the Discord app on your computer, not to any 1zero server, and Discord shows the status on your profile. By default it says only “Browsing the web”. If you choose to share supported sites (YouTube, YouTube Music, Spotify, Netflix, Prime Video, Twitch, SoundCloud), their titles, artwork, and links are shared too. The status always includes the 1zero icon and a link to 1zero Browser that includes your browser version. Incognito windows are never shared, and the status clears while you're in one.

Extensions

On a new install, the browser installs uBlock Origin Lite from the Chrome Web Store. Extensions you add, or import from another browser, are downloaded from Google's extension servers too. Those requests tell Google which extension is being installed and the Chrome version the browser is based on. Extensions themselves run under their own developers' privacy policies and can see whatever you allow them to.

VPN and proxy extensions can route your tabs' traffic. The browser's own requests, such as update checks, web search, and Gmail, may not go through them.

What websites see

Websites you visit see your requests, IP address, and cookies like in any browser. A few details are specific to 1zero Browser:

• It identifies itself as Google Chrome and sends Chrome's detailed browser hints (such as platform version, processor architecture, and full browser version) with every request, where Chrome sends them only to sites that ask. Google sign-in pages are shown a Firefox identity instead, so Google lets you sign in.
• It doesn't currently send Do Not Track or Global Privacy Control signals, and it doesn't block third-party cookies by default. uBlock Origin Lite blocks many trackers and ads.
• Sites ask before using your camera, microphone, location, or notifications, and your answer is saved per site. Full screen, pointer lock, and copying to the clipboard are allowed without asking.
• Site icons in the sidebar and Settings are fetched from the site itself, with your cookies for that site.

Features from Chromium

1zero Browser is built on Electron, which includes Chromium. Like Chrome, it downloads Google's Widevine module so protected video (such as Netflix) can play. Spell checking is on by default and may download dictionaries for your language from Google's servers. Passkeys and security keys are handled by your operating system and the key itself. 1Password connects to its own desktop app on your computer. We never see any of these.

Importing from another browser

You can import history, cookies, open tabs, and extensions from Chrome, Chromium, Brave, Edge, Opera, Opera GX, Vivaldi, Arc, Firefox, Zen, LibreWolf, and Waterfox. The import reads that browser's data on your computer, decrypts cookies there, and sends none of it anywhere. Extensions are downloaded again from the Chrome Web Store. To let you undo an import, the browser keeps a record of what it changed, with any replaced cookies encrypted by your keychain.

What's stored on your computer

The browser keeps its data in its app data folder (on macOS, ~/Library/Application Support/browser). Files are readable only by your user account. They include:

• your settings, including support contact details, custom search engines, privacy mode's words and names, and focus mode lists;
• history (address, title, time, and icon) for up to 90 days or 20,000 entries;
• open tabs, downloads, site permissions, site icons and colors, and cached news, stocks, and plugin data;
• cookies and site data, in Chromium's usual storage.

Most of these files are plain text, protected by your account's file permissions and your disk encryption rather than by the browser. Only the Gmail token and imported cookie backups are encrypted by the browser. It doesn't save passwords or bookmarks. Use a password manager for passwords.

Incognito windows

Incognito windows use a separate, in-memory profile. They write no history, aren't restored with your session, don't list downloads, and keep permission answers only in memory. Everything is wiped when the last incognito window closes. Files you download stay where you saved them. Web results as you type still work in incognito if they're on.

Diagnostic logs

The browser keeps logs to help fix problems. They stay on your computer unless you send them with a support report. They're stored in ~/Library/Logs/1zero Browser on macOS, and in a logs folder in the app data folder on Windows and Linux. Files rotate before 5 MB and the last five are kept, so about 25 MB at most.

• They record what the browser does, such as tab and navigation events, extension and download activity, and errors.
• Page addresses keep the site and path, but query values, fragments, and passwords in addresses are removed.
• In incognito, addresses, sites, and file names are replaced with “[incognito]”.
• They never contain what you type, page titles, form contents, privacy mode's words, focus lists, or passwords.
• They do contain download file names, extension names, and the paths of local files you open.

1zero Code

GitHub

Signing in with GitHub is optional. It uses GitHub's device sign-in between your computer and GitHub, and asks for the repo and read:user permissions. The token is encrypted with your operating system's keychain and stored with your GitHub name and picture link in the app's data folder. If no keychain is available, the token isn't saved. We never receive it.

With the token, 1zero Code asks GitHub's API for your repositories' commits and check runs, and loads contributor pictures from GitHub. Your repositories' own remotes are contacted by git: 1zero Code runs a quiet git fetch when you open a project, when the window regains focus, and every 5 minutes, and pushes or pulls when you ask.

AI agents

1zero Code runs AI agents (Claude, Codex, Gemini, Cursor, and any you add) by starting their command-line tools on your computer. Those tools send your prompts, code, and files to their providers under your own account and the providers' terms. 1zero Code doesn't call any AI service itself and never sends your work to 1zero. Some agents are started with npx, which may download them from the npm registry.

When you ask it to name a session or write a commit message, 1zero Code sends the conversation or diff to the agent you've chosen. To show which account each agent uses, it reads the email from those tools' local sign-in files. That stays on your computer.

Agents talk to 1zero Code's review and task tools through a connection that only accepts requests from your own computer and requires a random secret.

Remote sessions

Hosting is off by default. When you turn it on, your devices connect to each other directly over your local network, or over Tailscale if you enable it. Connections are encrypted end to end with the Noise protocol, and pairing uses an 8-digit code that expires after 2 minutes and locks after 5 wrong tries. No 1zero server relays or sees them.

• While hosting, the app announces itself on your local network with a random ID. Your device name is shared only with devices that complete the encrypted handshake.
• Paired devices see your computer's name, its CPU and memory use, and the sessions you share with them.
• Each install has a device key, stored encrypted by your keychain (or readable only by your user account if no keychain is available).

Built-in browser

1zero Code includes a browser for previewing your work and reading docs. Searches typed into it go to Google. Websites see you as they would in any browser. Sites opened in it get the permissions they request, such as camera, microphone, and location, without being asked, so use 1zero Browser or another browser for sites you don't trust. Like 1zero Browser, it downloads Google's Widevine module for protected video. Bookmarks are saved on your computer.

Icons for search shortcuts and MCP servers are loaded from Google's favicon service, which tells Google the domain. Pinned websites load their own icons, and images in agent replies and rendered Markdown load from wherever they're hosted.

Read aloud

Read aloud runs entirely on your computer. The first time you use it, its voice model (Kokoro, about 92 MB) is downloaded once from Hugging Face. What it reads is never sent anywhere.

What's stored on your computer

1zero Code keeps your settings, projects, full agent transcripts, paired devices, and a record of recent commands in its app data folder, and tasks, reviews, notes, pasted images, and worktrees in ~/.1zero/code. These are plain files on your disk. Only the GitHub token and device key are encrypted. 1zero Code doesn't write log files.

1zero Notetaker

Your notes, categories, and images are stored as files in the app's data folder on your computer. Notetaker doesn't record meetings or use AI services, and makes no network requests apart from the update check.

The /dictate command uses the speech recognition built into Chromium. We don't receive any audio, but Chromium's speech recognition may send it to Google to transcribe.

1zero File Explorer

File Explorer makes no network requests apart from the update check. Previews and thumbnails are made on your computer. It doesn't index or upload your files. Your places and view settings are stored in the app.

To let you undo moves and deletes safely, it keeps a hidden .1zero-file-explorer folder in the folders you work in, readable only by you. Its contents are removed after 7 days.

The website

• Analytics. We count page views and referrers with Vercel Web Analytics and Databuddy. Databuddy also records page load speed, script errors, and a few actions: links you follow off the site, sending a link to your computer, the browser you compare against, keyboard shortcuts, and that a donation went through (not its amount). It keeps a random id in your browser to group these. Neither uses cookies, knows who you are, or follows you across sites.
• Download counts. Our server counts each download in Databuddy with the app, platform, version, processor (when you pick one), and your country, from our host's lookup of your IP address. The address itself isn't sent or stored, and nothing identifies you or your device, so downloading twice counts twice. Downloads that look like bots or crawlers aren't counted.
• Rate limits. To limit abuse, search, news, icon, stocks, exchange rate, and support requests are rate limited by IP address. The address is kept only in the memory of the server handling it, for the length of the limit window, and is never written to storage.
• Server logs. Our servers process your IP address and browser details to answer each request. Our own code doesn't log them. Our hosting provider, Vercel, keeps standard request logs under its own policy.
• Cookies and storage. The site sets no tracking cookies. Your light or dark theme choice is saved in your browser's local storage.
• Fonts and embeds. Fonts are served from 1zero.app, and the site embeds no videos, maps, or other third-party content. Searching the docs happens on our server and isn't logged.

Support reports

When you send an issue or feedback from 1zero Browser, we receive:

• your message (up to 5,000 characters);
• the email address or Discord username you choose to give, if any;
• the app version, Electron and Chrome versions, operating system and version, architecture, and language;
• up to five images or videos you attach, with their file names;
• for issues, your diagnostic logs if “Include logs” is on (it is by default). See Diagnostic logs for what they contain.

If the browser crashes and you choose “Send logs”, the report includes the error, with your home folder's name replaced by ~, and your logs.

Reports are posted to our team's Discord through a webhook and stored in a private Cloudflare R2 bucket. We don't store your IP address with them. We use them only to fix problems and answer you. Don't include passwords or anything you don't want us to read.

Donations

Donations are processed by Stripe, as one-time gifts or monthly subscriptions. Stripe collects your payment details and email address under its own privacy policy. We never see your card number.

For each Stripe customer, we keep the name you chose for the supporter wall (or “Anonymous”), your total given, and whether to show you. We also note whether the donation started from the browser or the website. We don't copy your email address out of Stripe. The wall in 1zero Browser shows only donors who gave a name. It never shows amounts, though bigger gifts get bigger circles. You can cancel a monthly donation from your Stripe receipt or by emailing us.

Service providers

These companies process data on our behalf, only to provide the features above:

• Vercel hosts 1zero.app and provides its analytics.
• Databuddy provides the website's analytics and counts update checks, downloads, and web searches, including the IP address of each counted search.
• Upstash stores plugin install counts, cached stock data, and donor records.
• Cloudflare R2 stores app releases and support reports.
• Discord receives support reports through a webhook.
• Unkey hosts our SearXNG search server.
• Stripe processes donations.

Our server also sends requests to these services, without anything that identifies you: the search engines listed above and the Brave Search API for web search and news, DuckDuckGo's icon service, Alpha Vantage for stocks, and the European Central Bank for exchange rates.

Separately, the apps talk directly to services you choose to use, under those services' own policies: Google (Gmail, extensions, Widevine, spelling dictionaries), GitHub, Discord's desktop app, Hugging Face, the npm registry, your AI providers, and the websites you visit. We never sell or share your data for advertising.

Where data is processed

Our service providers' servers may be outside your country, including in the United States. Everything the apps keep on your computer stays there.

Security

• Everything between the apps and 1zero.app is encrypted with HTTPS.
• Tokens for Gmail and GitHub are encrypted with your operating system's keychain, and app data files are readable only by your user account.
• Support reports are kept in a private bucket readable only by our team. Attachments can only be uploaded with a signed token issued for the report.
• Remote sessions in 1zero Code are encrypted end to end.

No system is perfectly secure. If you find a vulnerability, please email us before disclosing it.

How long we keep it

• Support reports: kept as a record, and not deleted automatically. Ask and we'll delete the report from both storage and Discord.
• Download counts: in Databuddy, for as long as we show them. They hold no IP address or device id.
• Plugin install counts: totals only, for as long as we show them.
• Donor records: until you ask us to remove them.
• Cached search answers: up to a day for suggestions and up to about an hour for results, as described above.
• Rate-limit entries: in memory, for the length of the limit window.
• Web search counts, with their IP addresses: in Databuddy, under its retention for our analytics. Ask and we'll remove what we can for your address.

Your choices and rights

You can turn off web results, update checks in 1zero Browser and 1zero Code, and log sharing in support reports. You can uninstall plugins, disconnect Gmail, sign out of GitHub, and turn off remote hosting at any time. Deleting an app's data folder removes everything it stored on your computer.

Depending on where you live (for example under the GDPR or CCPA), you may have the right to access, correct, delete or export your data, or to object to how we use it. To do so, email us. Because we collect so little, we may need the report id or Stripe receipt to find your data. We don't sell or share personal information as the CCPA defines those terms. You can also complain to your local data protection authority.

Our legal bases are your consent (support reports, donations, Gmail sign-in codes), what's needed to provide a feature you use (web search, updates, plugins), and our legitimate interest in running and securing the services (analytics, download counts, rate limits, and the IP addresses counted with web searches, which we need to moderate the platform and stop abuse of our search systems).

Children

Our services aren't directed at children under 13, and we don't knowingly collect their personal information. If you think a child has sent us a support report, email us and we'll delete it.

Changes

We'll update this page when what we collect changes, and change the date at the top. Significant changes will also be noted in the release notes.

Contact

Email support@1zero.app or ask in our Discord.