This policy explains what Wasted Penguinz AB (“we”) does with personal data when you use Zero Say Browser. The short version: the browser has no account, sends us nothing about you, and the only time it contacts our server at all is to ask, through Tor, whether a newer version exists. Everything it stores, it stores on your device.
The zerosay.com website, where you download it, is covered by the main Privacy Policy. We are the data controller under the EU General Data Protection Regulation (GDPR) and the Swedish Data Protection Act (2018:218).
1.What reaches us
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| An update check: a request for the current version file, arriving from a Tor exit relay, with no identifier and no data about you or your device | Offering you security updates | Legitimate interest (Art. 6(1)(f)) | Counted into a daily total; the server log line itself is deleted after 14 days |
| A download of the app or an update, arriving from a Tor exit relay when the browser fetches it | Delivering the software | Legitimate interest (Art. 6(1)(f)) | Counted into a daily total; the log line is deleted after 14 days |
That is the complete list. The browser contains no analytics, no crash reporting, no telemetry and no feature that reports usage. Because the update check travels through Tor, even the address we see is a Tor relay's, not yours. Our download statistics are daily counts per file; they never contain an address.
2.What reaches other parties
A browser exists to fetch things from other people's servers. Zero Say Browser makes every such fetch through Tor, so those servers see a Tor exit relay (or, if you set one, your own upstream proxy) rather than you. Besides the sites you choose to visit, the browser itself contacts:
| Who | What they receive | When |
|---|---|---|
| The Tor network (directory authorities, relays, bridges) | Your connection, which is what Tor is for; a bridge learns your address in place of a guard relay | Whenever the browser is open |
| Filter-list publishers (EasyList, uBlock Origin on GitHub, AdGuard, Dandelion Sprout) | A request for the list files, from a Tor exit | Once a day, in the background |
| The search engine you chose (DuckDuckGo by default, its .onion address) | Your search terms | When you search from the address bar or start page |
| Onion search engines (Ahmia, TorDex, OnionLand, Torch, Amnesia) | Your search terms, over Tor | When you use onion search |
| Mozilla (translation models) | A request for model files, from a Tor exit | The first time you translate into a language |
| Apple (macOS) | Notarisation checks are Apple's own; nothing is sent by the browser | At install |
None of these are our processors; they are independent services with their own policies. The text of pages you translate never leaves your computer.
3.What stays on your device
By default the browsing session is a burner: cookies, cache, site storage and downloads exist only in memory and are gone when you close the window. The browser keeps no history. It stores the following on your device only, in your profile folder or the operating system's secure storage, and never sends any of it anywhere:
- your settings, including security level, per-site script choices, bridge configuration and any upstream proxies you entered (including their passwords, which are yours to protect);
- bookmarks;
- logins you chose to save, in the operating system's keychain, optionally behind Touch ID or an app passphrase;
- the filter-list snapshot and any translation models, which contain no data about you.
Deleting the profile folder, or uninstalling the app, removes all of it.
4.The Direct window and upstream proxies
The Direct window is an explicit exception: it uses your own connection, and a site opened in it sees your real address, as with any ordinary browser. With an upstream proxy configured, that proxy provider sees the traffic Tor hands it and the sites it connects to; it does not see your address, because Tor is in between. Both are your choice, both are labelled in the interface, and neither involves us.
5.Your rights
Under the GDPR you can ask us for access, rectification, erasure, restriction, portability and to object (Art. 15–21), and complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY, Box 8114, 104 20 Stockholm, imy.se) or the authority where you live.
In practice there is nothing on our side to act on: the browser creates no account and we hold no record that can be linked to you. Everything the browser stores is on your device, under your control, and is deleted by removing the profile folder. If you believe we hold something about you anyway, write to hello@zerosay.com and we answer within 30 days.
6.Children
Zero Say Browser is not directed at children under 13. It has no account and collects nothing, so there is nothing for us to delete; parents should use the operating system's own controls.
7.Requests from authorities
We comply with valid legal orders under Swedish law. Because the browser has no accounts and reports nothing, the most we can provide is our own server's daily download and update-check totals and whatever remains of a 14-day web-server log, which shows Tor exit relays, not users. We cannot say who uses the browser or what anyone browses, because we do not know. We will publish a transparency summary at least once a year.
8.Changes to this policy
When we change this policy we update the version and date at the top and describe the change in the log below. If a change means the browser would send anything new anywhere, we will announce it inside the browser before it takes effect. We will never quietly widen what leaves your device.
Change log
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-09-14 | First version, published with the browser page on the website and ahead of its first public release. |
Contact
Wasted Penguinz AB
267 75 Ekeby, Sweden
Org. nr 559447-4859
hello@zerosay.com