Privacy

This describes what Parallel actually stores, written from the code rather than from a template. Where something is encrypted, it says what can and cannot read it.

What your account holds

Creating an account stores your email address, a hash of your password (bcrypt — the password itself is never stored and cannot be recovered from the hash), which plan you are on, and the date you signed up. That is the whole record.

If you turn on two-factor authentication it also holds your authenticator secret and your unused recovery codes, and a record of recent sign-ins — the time, the IP address and the browser's user-agent string — so you can see whether a sign-in was yours. That history is capped and rolls over.

Your profiles

Profile settings sync to your account: names, groups, tags, notes, fingerprint seeds, proxy details, start URLs and which platforms each profile signs into. This is what lets the same profile open on another computer.

Session cookies are different. They are encrypted before they leave your machine, with a key derived per account, and our server stores only the encrypted blob. We cannot read the sessions you sync, and neither can anyone who obtains a copy of the database.

What never leaves your computer

• Saved platform logins. The usernames and passwords you save against a profile are encrypted with your operating system's own keychain and are deliberately not part of what syncs. They exist on that machine and nowhere else.
• Your browsing. Parallel launches ordinary Chromium with its own data directory. Pages you visit, what you type, and what those pages store are on your disk. None of it is reported anywhere.
• The sharing key. When you send a profile to another account, it is encrypted to their device's public key on your machine. The private half never leaves theirs, which is why the relay cannot read what it passes on.

The fingerprint test

The fingerprint test runs entirely in your browser. Nothing it measures is uploaded, stored, or sent to us — you can read the page source and confirm that rather than taking our word for it.

Third parties

• Payments are handled by Stripe and Coinbase Commerce. Card details go to them and never touch our servers.
• Email — verification, password resets and security alerts — is sent through Resend.
• Hosting: this site is served by Cloudflare, and the API runs on Render with a MongoDB Atlas database.

There is no analytics script, no advertising pixel, and no third-party tracker on this site.

Deleting your account

Settings → Delete account removes your account and everything synced with it. Profiles on your own computer are yours; deleting the account does not reach onto your disk, and you can remove them from the app or by deleting the data folder shown in Settings.

Contact

Questions about any of this: support@parallel-browser.com.