Pale Moon Sync Privacy Policy

Privacy overview

• We need your email address to register you with the Sync Service, but we don’t ask for other personal information.
• Your data is only used to provide the Pale Moon Sync Service.
• Pale Moon Sync on your computer encrypts your data before sending it to us, meaning the data isn’t stored on our servers in a usable form. Only you have the key to decrypt and use the stored data.
  
• We don’t sell or disclose your data.

Pale Moon Sync Privacy Policy

This privacy policy explains to what extent Moonchild Productions ("we", "us", etc.) collects and uses information about users of Sync as found in the Pale Moon browser (“Pale Moon Sync Service”), where such users use our maintained servers.

Definitions

“Personal Information” is information that you provide to us that personally identifies you, such as your name, phone number, or email address. Except for your email address, we do not collect or require end-users of the Pale Moon Sync Service to furnish Personal Information.

“Non-Personal Information” is information that cannot by itself be directly associated with a specific person or entity. Non-Personal Information includes but is not limited to your computer’s configuration and the version of Sync you use.

“Potentially Personal Information” is information that is Non-Personal Information in and of itself but that could be used in conjunction with other information to personally identify you. For example, Uniform Resource Locators (“URLs”) (the addresses of web pages) and Internet Protocol (“IP”) addresses (the addresses of computers on the internet) can be Personal Information when combined with internet service provider (“ISP”) records.

“Operational Data” means aggregated data regarding users’ usage of the Sync Service, such as access log data (such as data about when people access the service and with what piece of software), how many records of each type users were creating in aggregate (such as how many bookmarks, history, or tabs users have created and synced). We collect Operational Data to help us ensure that we have sufficient storage to meet user needs and otherwise to help with the operation of the Service.

“Usage Statistics” refers to the Non-Personal Information we will use to understand your use of the Pale Moon Sync Service. Such information may include but is not limited to the amount of data you are storing with the service, the frequency with which you access the service, and bandwidth utilization.

“User Data” is the digital content stored on, manipulated, and transmitted to and from our servers by means of your use of Pale Moon Sync. Examples of User Data include those items that you choose to synchronize across devices using Sync, such as your browsing history, form history, bookmarks, saved passwords, preferences, and open tabs. User Data does not include your username, email address, or password.

Gathering, Use and Disclosure of Transmitted Data

Account Information

Before you are able to access the Pale Moon Sync Service, you will be required to register. To register, the Pale Moon Sync Service will require the following Personal Information and Potentially Personal Information from you: your email address and password. We will not make any of this information public. Your email address and password are transferred to us using TLS encryption. Your email address is used by us to provide you with the service. (Feel free to use a separate email account set up just for using the Pale Moon Sync Service if you’d like.) Your password is only retained on our servers in an encrypted format (which means that your actual password cannot be recovered from it) and your e-mail is likewise not stored in plaintext in our database (it is converted to a non-recoverable account identifier).

As part of registration, you will also create a recovery key. However, the Pale Moon Sync Service is designed so that your recovery key resides only on your computer and is never transmitted to the Pale Moon Sync servers or to us.

The only time your recovery key is transmitted is when you link a new device using the 12-character "easy setup" method. Even so, this transmission occurs both over SSL and client-side encrypted using a 3-party key exchange juggling protocol (J-PAKE) that prevents the intermediate (our data exchange server involved in this process) from ever learning your recovery key.

Once you have registered, your password and recovery key are used to help prevent unauthorized access to your account and User Data.

Encrypted User Data

The Pale Moon Sync Service encrypts User Data on your computer and uploads only pre-encrypted User Data over the network, additionally using TLS communication for such data transfers. We believe that user privacy is extremely important, and we require that the User Data is encrypted to reside on our servers. Those items you choose to synchronize across browsers or devices using Pale Moon Sync are examples of User Data that is encrypted by design before leaving your computer. These can include your browsing history, form history, bookmarks, saved passwords, preferences, and open tabs.

Data Used to Provide the Services

We receive and use the following information for the purpose of providing and improving the Pale Moon Sync Service: IP address, login credentials, date and time of accessing the Pale Moon Sync Service, and various types of operational data such as the type of client OS and browser version.

The Pale Moon Sync Service also receives the host names you have given your devices that you are syncing. These names are used to label your tabs within Pale Moon Sync. If you don’t want to share your name, you should consider naming your devices with fanciful names rather than your actual name. This information is also transmitted via TLS and cannot be observed by third parties in transit.

Disclosure to Third Parties

To safeguard your privacy, the Pale Moon Sync Service is purposely designed so that the amount of data that we have access to is extremely limited, either by encryption, cryptographic hashing, or by not collecting it in the first place. This is why User Data and your password and recovery key are either encrypted before being sent to our servers or not sent to our servers at all. This is also why we don’t collect other information at all like your name or phone number.
For the set of information that we do have, we will not knowingly disclose Personal Information or Potentially Personal Information to third parties unless legally required to do so, such as in order to comply with any law, regulation, or valid legal process, such as a search warrant, subpoena, statute, court order, or if necessary or appropriate to address an unlawful or harmful activity. Do note, however, that even in this case the key required to decrypt the User Data portions of your data resides solely on your computer and not on ours, and access to your User Data will remain impossible without it.

No legal or governmental entity will be able to access User Data that is sent to us by using the Pale Moon Sync Service by design. While we will comply with any official request for User Data as outlined in the previous paragraph as part of due process, this User Data cannot be decrypted, analyzed or used without your key and will therefore be useless to any entity requesting this data unless they also obtain the key from you.

It is your responsibility as a user to keep your recovery key safe to prevent access to your User Data by third parties.

What Data is Analyzed by us?

We will only use Usage Statistics to understand your use of the Pale Moon Sync Service.

How Are the Usage Statistics Used?

We will use the Usage Statistics gathered through the operation of the Pale Moon Sync Service as part of normal operation of the Pale Moon Sync servers. By identifying patterns and trends in usage, we will be able to improve users’ experiences, both in terms of content and ease of use.

Where is the Operational Data Available?

Operational data is considered part of the internal administrative tasks of running the service and will not be made public, nor shared with anyone outside of the organization structure providing you with the Service.

How to Disable or Opt-Out of Pale Moon Sync

If at any time, you decide you no longer want to have the Pale Moon Sync Service, you may disable the use of it from the Pale Moon preferences window.

Transfer of Data to another country

Privacy laws and common practices vary from country to country. Some countries may provide for less legal protection of your personal data; others may provide more legal protection. By using the Pale Moon Sync Service, you consent to the transfer of the information collected, as outlined by this Policy, to us in the country where the Sync server is located (currently the U.S.A.), which may potentially provide a lesser level of data security than in your country of residence.

Data Retention

We will retain any information collected for the period necessary to fulfill the purposes outlined in this Policy unless a longer retention period is required by law and/or regulations.

Privacy Policy Changes

We may change this Privacy Policy from time to time. Each time you use the Pale Moon Sync Service, the current version of this Privacy Policy will apply. Any and all changes will be reflected on this page. You should periodically check this page for any changes to the current policy. To make your review more convenient, we will post an effective date at the top of this page. Material changes will also be announced through the normal channels like the forum. It is your responsibility to ensure that you understand the terms of this Privacy Policy.

What This Privacy Policy Doesn’t Cover

This policy does not apply to other Pale Moon websites, products, or services. It also does not apply to your use of non-Pale Moon Sync servers. If you choose to use a Sync server provided by an entity other than us, this policy does not apply and we assume no liability whatsoever for such services.