Privacy

Version 1.1 · effective when the store build ships

What Rove does in your browser

Rove is a browser extension. While it is switched on it points the browser's proxy at the Rove Gateway, answers the Gateway's proxy authentication challenge with a short-lived token issued for your account, and leaves everything else alone. Rove injects no content scripts, reads no page content, form data or cookies, and does not record your browsing history. Every line of code that runs ships inside the extension package; Rove never loads remote code.

What stays on your device

• Your sign-in state for the Rove website and the extension's own settings: ON/OFF intent, the selected location, and display preferences.
• The install identity and the current short-lived Gateway token, so a restarted browser can keep a working connection. The token is only ever sent to the Rove Gateway it was issued for.
• A bounded in-memory diagnostics buffer of the last proxy authentication decisions (at most the first 160 characters of a requested address, shown as the last 10). It is never written to storage and never uploaded automatically; it leaves the device only if you copy it for support.
• While Rove is switched on it disables non-proxied WebRTC UDP so real-time traffic cannot bypass the proxy, and it restores the value your browser had before when you switch Rove off.

What the Rove service stores

• Your account email and authentication state, and the verification/security records needed to protect the account.
• Install and device metadata (browser, operating system, versions, last seen) and the link between a browser install and your account.
• Usage and authorization records: aggregate traffic totals (bytes up/down per install, node and day), entitlement windows, and the audit trail of every access decision.

What is never stored

URLs, page contents, form data, cookies and per-site browsing history are not recorded by Rove. Traffic is metered in bytes, not inspected or sold.

Service providers

The website and API are served behind Cloudflare, transactional email is delivered through the mail provider configured for the service, and the browser store versions are distributed by Microsoft and Google under their own policies. Rove does not sell personal data.

Retention

Account, install and entitlement records are kept while the account exists and for the short period needed to settle billing or abuse questions. Aggregate byte counters carry no personal identifier. Diagnostic buffers in the extension are memory-only and disappear when the browser closes.

Your account and deletion requests

You can ask for a copy or the deletion of your account data at any time. Email [email protected] from the account address with the subject "Account data request" and say whether you want a copy or deletion. We delete the account, its linked browser installs, preferences and unneeded diagnostics; records we must keep for accounting or legal reasons are retained without being used to provide access. Deleting the account ends any remaining Rove access window.

Contact

Privacy questions and account data requests: [email protected] or WeChat summer991100. The same channels are listed on the contact page.