Privacy Policy

TCC Browser · updated 5 September 2026 · applies to the Android and iOS apps

TCC Browser is a web browser that runs on your own device. It has no user account, no cloud sync, and sends no usage data anywhere. Everything you browse stays on this device until you delete it yourself.

💾

Your data stays on your device
History, bookmarks and settings are kept in the app's private storage on your device.

🔕

No analytics, no advertising
No telemetry, no user profiles, no selling data to anyone.

🔑

Passwords use your OS keystore
Never readable on disk, and never passed to a web page.

🔒

Meetings are end-to-end encrypted
The key lives after the # in the link, so the server never sees it.

1. What is stored on this device

All of it lives in TCC Browser's private storage on your phone — an area the operating system lets only this app read. No copy is sent anywhere else.

Data	Where it lives	How to delete it
Browsing history	`history.json`	Settings → Clear browsing data, or the clear button in the History panel
Bookmarks	`bookmarks.json`	Remove them one by one in the Bookmarks panel
Settings and the list of open tabs	`settings.json`, `the-dang-mo.json`	Turn off Reopen the tabs you had open and the tab list is no longer written
Permissions you granted to sites	`quyen.json`	Settings → Permissions you granted to sites → Revoke
Saved passwords	`matkhau.bin` — encrypted with your OS keystore (Android Keystore)	Settings → Saved passwords → delete one or delete all
Cookies, cache, data sites store locally	Managed by the browser engine	Settings → Clear browsing data
Downloaded ad-filter rules	`adblock-engine.bin`	Nothing to delete — these are rule lists fetched from the network and contain nothing about you. Turning ad blocking off stops using them.

2. What leaves this device

Only the following, and every item is a direct consequence of something you just did:

When you…	What is sent	Where it goes
Open a web page	Ordinary web requests, same as any browser	That site, and whatever servers that site calls
Type a search into the address bar	Your search terms	The default search engine (Google)
Turn on ad blocking	Nothing about you — the rule lists are only downloaded	EasyList, EasyPrivacy, Peter Lowe, ABPVN
Create or join a meeting	Room name, the display name you typed, and encrypted audio and video	TCC Browser's own meeting service and its dedicated LiveKit server — see section 4
Open the TCC Wallet	The web wallet talks to the TCC chain itself	`network3.tcc-coin.com` and the TCC chain RPC
Allow a `tcc-coin.com` page to send notifications	A device token issued by Google (Firebase Cloud Messaging) or Apple (APNs). The TCC page sends it, with the TCC account you are signed in to, to the TCC server so it can tell you about messages and incoming funds. No token is created until you allow it.	Google/Apple, TCC account server `ram2.tcc-coin.com`

Nothing here phones home. TCC Browser has no analytics server, no telemetry code, and sends the list of pages you visit to nobody — including us.

3. Site permissions default to DENY

Microphone, camera, location, clipboard, notifications — when an unfamiliar site asks, the browser asks you. It never grants silently. Answer once and the answer is remembered, and you can review or revoke it at any time under Settings → Permissions you granted to sites.

One exception: the browser's own infrastructure — the TCC Wallet and the meeting service, both under tcc-coin.com — plus the internal tcc:// pages. That is code we wrote ourselves, and without it the wallet and meetings would have to ask for permission every time you open them.

Site notifications. Every site must ask before sending notifications, TCC's own pages included, and the default answer is NO. Each notification names the site that sent it. Only pages on tcc-coin.com can get a device token to notify you while the browser is closed. Revoke it in the same place as other permissions.

Third-party cookies are blocked by default. That kind of cookie exists almost entirely to follow you from site to site. You can turn the block off in Settings if a site genuinely needs it.

4. Meetings

Join by link, no account. We ask for no email and build no profile. The display name is whatever you type each time you join.
End-to-end encrypted. The device that creates the room generates the key and puts it after the # in the link. By web standard, browsers never send that part to the server — so the meeting service does not hold the key and cannot decrypt the meeting.
A join ticket opens exactly one room and expires after 6 hours.
Recording runs on the device of whoever pressed record, not on the server — so recording does not break end-to-end encryption. The file stays on that person's device.
Closing the room kills the link immediately.
A deliberate trade-off, stated plainly: while the room is open, anyone holding the link can join. Do not post links publicly.

5. Saved passwords

The password store follows four hard rules:

Never readable on disk — encrypted with your operating system's keystore (Android Keystore / iOS Keychain). The key is held by the OS and tied to your device, so another user on the same device cannot decrypt the file even if they copy it. On a device where the keystore is unavailable the browser refuses to save rather than falling back to plain text.
Never passed to a web page. There is no API a page could use to ask the store anything.
It only leaves the store when you press the key button in the address bar and pick an account yourself.
Exact hostname match — no subdomain matching, no fuzzy matching. erp.tcc-coin.com.spoofed.net merely looks similar; matching by suffix would hand your password to an attacker.

On http:// pages (no lock) the browser never offers to save.

6. Children

TCC Browser is a general-purpose browser. It is not aimed at children, and it collects no data about anyone — so it collects none about children either.

7. When this policy changes

The update date sits directly under the title of this page. The policy ships with the copy installed on your device, so it only changes when you update the browser. Check which build you are running under Settings → About this build.

8. Contact

Questions, or a security issue to report: [email protected].