Privacy

Last updated 23 October 2026.

The short version

• We receive nothing. There is no account, no server of ours to send anything to, no analytics, no advertising and no crash reporting.
• Your browsing stays on your phone. History, bookmarks and settings are stored on the device and are never uploaded.
• The apps are open source (MIT). Anyone can check that this is true, and the source is linked at the bottom of every page.

Which apps this covers

• herald and herald mono — the browser, whether installed on its own or as part of a drawbridge phone.
• drawbridge — the protection app itself.

What stays on your device

The browser keeps the ordinary things a browser keeps, all of it on the phone and none of it anywhere else:

• the pages you have visited, and your bookmarks
• cookies and site data from the sites you open
• your settings, such as the search engine you chose

Removing the app, or clearing its data from Android’s settings, removes all of it. We never have a copy, so there is nothing for you to ask us to delete.

What leaves your device, and where it goes

Using a browser means connecting to things. Here is the complete list of what these apps connect to, and none of it is us:

• The websites you visit, and your searches, which go to the search engine you have selected. Those sites and search engines have their own privacy policies and we have no part in them.
• The policy document — the signed list of what is blocked — which both apps fetch from GitHub, where it is published as a file. GitHub sees that request the way any web server sees a visitor. Nothing identifying you is attached to it: it is the same file, fetched the same way, for everyone.
• Filter lists for the built-in ad blocker (uBlock Origin), fetched from the list maintainers in the usual way.
• The browser engine’s own safety and update checks. herald is built on Mozilla’s GeckoView, the engine behind Firefox, which keeps its security and phishing-protection lists current by itself.

There is no step in which any of this reaches us, because we run no service that could receive it.

Permissions

herald asks for internet access, network state, the ability to keep a download or playback running, notifications and a wake lock. It asks for no contacts, no location, no microphone and no camera. drawbridge is a device policy controller and necessarily holds device-management permissions, which it uses to apply the rules on the phone — locally, and on that phone alone.

On a managed phone

When drawbridge manages the phone, the browser asks it which rules apply. That question is answered on the device itself, through a read-only channel protected by the apps’ shared signature. The browser does not report your browsing to whoever set the phone up — there is no history screen for a parent, no log that is sent anywhere, and no server in between. What a parent can see is what they chose in drawbridge, not what was done with the phone afterwards.

Diagnostics

drawbridge has a diagnostics screen that shows what the phone has been doing, so a problem can be described accurately. It is displayed on the screen only. Nothing is sent anywhere unless you copy the text and send it to us yourself.

Children

These apps are made for teenagers and adults and are not directed at children under 13. They collect nothing from anyone, of any age.

Changes

If this policy changes, the new version appears on this page with a new date, and the change is in the public commit history along with everything else.

Who we are, and how to reach us

On the Way BV — Kasteelstraat 37, 1560 Hoeilaart, Belgium — enterprise number BE 0651.912.452
info@drawbridge-project.org