Privacy policy and terms.

01The short version

Leet Browser has no account, no server of its own, no analytics, no telemetry and no ads. This page covers two apps: Leet Browser for Windows and Leet Browser for Android. Your bookmarks, settings and site data stay on your own device. Like any browser, it connects to the websites you open; this page says what that means.

This page is both our privacy policy and the terms on which the apps are offered. By installing or using Leet Browser you agree to it.

02What we collect

Nothing. The developer does not collect, receive or have access to the sites you visit, your searches, bookmarks, downloads or any other data from the browser. There is no analytics or crash-reporting code, no advertising code and no sign-up, on either platform.

If you write to us, we receive what you choose to send (your email address and message) and use it only to reply and to improve the apps.

03Stored on your device

Windows

Everything is on your computer and nothing is uploaded. Leet keeps plain files in %LOCALAPPDATA%\Leet Browser\ and the browser engine's own profile in %LOCALAPPDATA%\Leet Browser Native\User Data\.

• Bookmarks, settings and per-site answers: your bookmarks, search engine, theme, tracker shield exceptions and the camera, microphone, location and notification answers you gave to sites.
• Visited pages (History, Ctrl+H): address, title and time of pages you visited, newest first, at most 5,000. This is on by default. Switch it off in Settings, remove one page, or choose "Clear all". Private tabs, Leet's own screens and the hidden music tabs are never added.
• Search history: what you typed in the address bar as a search, kept only to give you suggestions. "Clear history" empties it. No suggestions come from a server.
• Site data: so that you stay signed in, the engine keeps cookies, cache and site storage on disk. Windows encrypts the cookie values for your user account; cache and site storage are ordinary files. "Clear browsing data" removes them from the disk.
• Your vault (logins and cards), if you use it, in an encrypted file; see "Passwords and cards" below.
• Leet Music: your liked songs (up to 1,000) and the last 40 played, and two switches. Never sent anywhere. "Clear browsing data" does not touch it because it is your library, not browsing data.
• Downloads go to the folder you chose, or to your Windows Downloads folder.

The engine (Chromium) also keeps small records of its own, such as favicons, remembered servers and per-site counters. History saving is switched off and these files are deleted every time the browser is not running: at start and after it shuts down. They can exist while it runs, and after a crash they stay until the next start. Uninstalling keeps your data folders; delete them yourself if you want everything gone.

Android

• Site data that the websites you visit store through the browser (cookies, cache, local storage). You can see its size, erase it by kind or for one site, or clear it all in Menu > Browsing data. You can also turn on "Clear everything when I close".
• Visited pages (History): address, title and time of pages you opened, so you can find them again. Private tabs are never added.
• Bookmarks and parked tabs (address and title only), and your settings such as search engine, tracker blocker choices and site permission answers.
• Downloads you start are saved to the place you choose.

The Android app also keeps a list of the pages you visited, so you can find them again. It is stored only on your phone, is never sent anywhere, and never includes private tabs. You can remove single pages or clear it all in the app. The Android app does not save passwords or form data. Thumbnails of open tabs are kept only in memory. Android backup of the app is switched off.

Private tabs, both platforms

Private tabs use a separate session that is held in memory only and dropped when the last private tab closes. They are not saved to history, the session or "reopen closed tab", and on Windows their searches are not added to suggestions and their permission answers last only for the private session. Honest limits: the window, your network and the sites you visit still see what you open; files you download, bookmarks you add and logins you save are your own actions and stay; the operating system can still cache DNS answers or page memory to disk.

04What leaves your device

The browser itself never sends your data to the developer. Only the following leaves your device.

How Windows keeps it to that

Every secure (https) connection from the engine goes through a small checkpoint on your own computer (127.0.0.1) that applies the tracker blocklist. If the checkpoint is down, https pages do not load; there is no direct fallback. The checkpoint also reads the chain of names a site redirects to and refuses the connection if a listed tracker hides behind a first-party name. QUIC is switched off so nothing bypasses it. Chromium's own background services (sync, component update, Safe Browsing, translation, pings, crash upload, autofill server) are switched off at start. Plain http:// pages go direct and are marked NOT SECURE. HTTPS-only mode, on by default, shows an error page instead of silently falling back to http. The build contains a test that fails if a network call appears anywhere it is not allowed.

How Android keeps it to that

We turned off the parts of Android's web engine that would otherwise report to Google on their own: Safe Browsing lookups, usage and crash metrics, and form autofill uploads. Requests sent to sites include the Global Privacy Control and Do Not Track signals, and the app's package name in a standard Android WebView header, which this version of Android does not let us remove. Updates to Android System WebView and to the app come from Google and are not part of the app.

YouTube

If you watch YouTube in the browser, you are talking to YouTube as with any website. On Android, the "YouTube: no ads, plays in background" switch (on by default, changeable in Privacy settings) only changes how the page is shown on your phone. On Windows, playing a song opens up to three ordinary hidden YouTube tabs, only when you play or search, with the same shield and gate and the same cookies as your other tabs. Neither sends anything to the developer. Whether these work depends on YouTube and can stop working at any time.

You can check all of this yourself: see how to verify Leet Browser.

05Updates

Windows

A few seconds after start and then every 6 hours, Leet asks one place for one small text file, latest.txt, held in a public repository that contains only signed installers. That host sees your IP address and that a Leet is asking. The request carries the name "Leet" only: no id, no cookies and nothing about your browsing.

Nothing is trusted because of where it came from. The file carries an ECDSA P-256 signature over the new version, the installer's address, size and SHA-256, made with the developer's release key; the matching public key is built into the program. A notice that is unsigned, edited, older, oversized or points to a different host is ignored, and a downloaded installer with a different size or hash is deleted. Redirects are followed by hand and every hop must be on a short list of GitHub hosts. Nothing is installed while you work: the verified installer waits in your data folder, and "Restart to update" or simply closing Leet installs it silently. You can switch updates off in Settings, "Keep Leet up to date"; then Leet checks for nothing and installs nothing.

The Windows installer is not yet code-signed, so Windows SmartScreen may warn when you first run it. Compare its SHA-256 with the one on the verify page before running it.

Android

The app is updated by Google Play, under Google's terms. The app itself does not check for updates.

06Permissions, and why

Both platforms

Sites can ask for the camera, microphone, location and notifications. You are asked per site and can answer Allow, Ask or Block, and review or forget your answers in one place. What a site does with a permission you allow is up to that site.

Android

Leet Browser asks for no permission at install. A permission is requested only when a website asks for it and you tap Allow, and Android then shows its own prompt.

Files are chosen with Android's own file picker, so the browser does not need storage permission.

Windows

The installer puts the program in your own user folder and does not need administrator rights. Once installed, the only time Leet asks Windows for administrator permission is if you press "Allow" on the phone-link screen, to add one Windows Firewall rule (see "Leet Assistant link"). Nothing else changes system or security settings.

07Leet Assistant link

Leet Assistant is a separate app from the same developer. The two apps are optional and work without each other.

Android: the bridge

If both apps are on the same phone, they can talk to each other, and only if both are signed by the same developer key. Nothing goes over the internet for this.

• Leet Assistant can show your day (reminders, bills, tickets) on the browser's start page.
• When a page looks like a ticket, bill or show, the browser offers to read it. The page text is sent to Leet Assistant only after you tap, is processed there, and a reminder or ticket is saved only after you tap Save.
• The browser can keep one small copy of its bookmarks, parked tabs and a few settings inside Leet Assistant, so they come back after a restore. It never includes history, cookies, passwords or private tabs, and is offered back only when you tap.
• Passwords and cards are filled into web pages only by Leet Assistant (through Android autofill, after your PIN). The browser itself does not store them.

Page readings can be wrong; check a saved ticket, bill or reminder before you rely on it. Leet Assistant has its own privacy policy and terms.

Windows: linking your phone

Only while the "Link Leet Assistant" QR code is on screen, your computer listens on one port of its home or office network address (never all addresses, never a public one) for one message from a private-network device, for at most 5 minutes and 5 wrong tries. It answers nothing unless the message begins with the one-time secret that only the QR code carries; then the listener closes. If Bluetooth is on, the code also carries the computer's Bluetooth address and the same limits apply. Both listeners go away when the code is used, cancelled or times out.

Both screens show the same 6-digit confirmation number, and the phone's vault is stored on the computer only after both of you press Yes. This stops someone who only saw or photographed the QR from linking their own device unnoticed. It does not hide the link from someone who can see both screens.

If Windows Firewall blocks incoming connections, the screen offers an "Allow" button. Only when you press it, Windows asks for administrator permission and a rule named "Leet Browser link" is added: this program only, TCP, inbound, local subnet only, on networks Windows marks Private only. You can delete the rule in Windows Firewall. The linked copy of your logins is a normal encrypted file whose key is sealed with Windows data protection (DPAPI); it starts closed, closes again after 10 quiet minutes and needs Windows' own check (Windows Hello, PIN or password) to open. A copy the phone did not name for keeping is deleted when the browser closes. While the code is shown, the window is excluded from screenshots and screen sharing (a camera pointed at the screen is not stopped).

08Passwords and cards (Windows)

On Windows, Leet has its own vault; there is no server and no account. The vault file holds your logins and cards, sealed with your master password (PBKDF2-HMAC-SHA256 with 600,000 rounds, then AES-256-GCM). The master password is never stored, logged or sent anywhere, and there is no recovery if you forget it.

• It locks itself after 5 quiet minutes. After 5 wrong tries it makes you wait (30 seconds, doubling, up to 15 minutes).
• A card has no CVV field: it cannot be saved, you type it each time.
• Nothing is filled by itself. Filling a login or card is a deliberate key press on the exact site (no parent domain, https only, no IP addresses), and it never submits the form. Saving a login you typed needs your Yes in a box the page cannot press.
• Export writes a file sealed with its own password; import merges one.

Honest limit: a page's own scripts run in the same page the fill goes into and can read what was filled, as with every password manager. That is why filling is a deliberate key press. Android's browser stores no passwords; see "Leet Assistant link".

09Third parties

The developer has no server and receives none of your data, so there is nothing to sell or share. The websites you open, and the search engine you pick, receive what you send them and handle it under their own policies.

The apps also rely on things we do not control: GitHub (the Windows update notice and installer), lrclib.net (lyrics, only if you turn them on), YouTube (music and video, only when you use them), Cloudflare or Quad9 (only if you choose Secure DNS), Android System WebView, Google Play, Windows, your device maker's software and the sites you visit. Their behaviour, updates and security fixes are theirs, not ours.

10Your control and duties

• Erase site data, history, bookmarks and permission answers at any time inside the app.
• Use private tabs for sessions that should leave nothing behind.
• Turn off the tracker shield for a site, or (where the app offers the switch) visited-pages history, automatic updates or the YouTube switch, if you prefer.
• Uninstalling the Android app removes its data. On Windows, uninstalling keeps the data folders listed above; delete them yourself to remove everything.

11The web is not ours

Leet Browser shows you websites; it does not create, review or endorse them. Websites may be inaccurate, unsafe, unlawful, deceptive or harmful, and may try to track you or install unwanted files. The tracker blocker, "not secure" marking, look-alike warnings and permission prompts help, but they are not a guarantee against phishing, malware, scams, fraud or tracking. You visit sites, run downloads and make purchases at your own risk. Features that read a page (ticket, bill or show reminders) can be wrong; check before you rely on them.

12Provided "as is"

THE APPS ARE PROVIDED FREE OF CHARGE, "AS IS" AND "AS AVAILABLE", WITHOUT ANY WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, RELIABILITY, SECURITY, UNINTERRUPTED OR ERROR-FREE OPERATION, COMPATIBILITY WITH ANY WEBSITE OR DEVICE, AND NON-INFRINGEMENT, TO THE FULLEST EXTENT PERMITTED BY LAW.

A web browser is complex and no security is perfect. The Windows version is a beta. We describe the protections honestly, but we do not promise the apps are free of bugs or flaws, or that they will keep working with any given site. The source code is not public and has not had an independent audit. We may change, pause or stop an app or any feature at any time.

13Limit of liability

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, THE DEVELOPER SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR PUNITIVE LOSS, OR FOR ANY LOSS OF DATA, MONEY, PROFIT, OPPORTUNITY OR GOODWILL, ARISING FROM THE USE OF, OR INABILITY TO USE, THE APPS. THIS INCLUDES LOSS CAUSED BY A WEBSITE, SEARCH ENGINE OR OTHER THIRD PARTY, TRACKING, PHISHING, MALWARE, SCAMS OR UNSAFE DOWNLOADS, A FAULT IN ANDROID, WINDOWS, WEBVIEW OR THE BROWSER ENGINE, A FAILED OR MALICIOUS UPDATE FROM A THIRD-PARTY HOST, A LOST OR STOLEN DEVICE, A FORGOTTEN VAULT PASSWORD, OR AN ERROR IN A PAGE READING. WHERE LIABILITY CANNOT BE EXCLUDED, IT IS LIMITED TO THE AMOUNT YOU PAID FOR THE APP, WHICH IS ZERO IF IT WAS FREE.

You agree to use the apps lawfully and at your own risk, to keep to the laws that apply to you, and to hold the developer harmless from claims that arise from your own misuse of the apps. Nothing here limits any right you have under law that cannot be waived, including consumer rights where they apply.

14Children

Leet Browser is a general-purpose browser and is not directed at children under 13. The developer collects no information from anyone, of any age. The web contains content that is not suitable for children, and websites have their own rules; a parent or guardian is responsible for how a child uses a device that has the apps.

15Governing law

This page is governed by the laws of India. Subject to any mandatory right you have to go elsewhere, the courts at Ayodhya, Uttar Pradesh, have jurisdiction over any dispute about it. Before going to court, please write to the contact below so we can try to sort it out. If any part of this page is found unenforceable, the rest stays in force.

16Changes and acceptance

If the apps' data handling changes, this page is updated first, with a new effective date at the top, before the change ships. We may also revise the other parts of this page; the date at the top always shows the current version. By continuing to use the apps after a change, you accept the updated page. If you do not agree, uninstall the app.

17Contact and grievances

Leet Browser is built and published by an individual developer, not a company. The same person answers questions about this page and formal grievances.

Developer

Grievance Officer

In line with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, the grievance officer for these apps is:

Write in English or Hindi. Every complaint is acknowledged within 24 hours and resolved within 15 days, as those Rules require.

The apps have no server and no account, so there is no copy of your data with us to correct, hand over or delete. It is on your device and you control it; see Your control and duties. If you see a connection that is not listed in "What leaves your device", please tell us: we treat it as a bug.