Privacy

This site

getexo.app sets no cookies, runs no analytics and makes no third-party requests. Its pages, font, icons and pictures all come from this site.

It runs on Cloudflare Workers. Cloudflare sees your IP address while it answers, as any host does (see Cloudflare's privacy policy). The site writes no logs and stores nothing about you.

The version and SHA-256 beside each Download come from this site, which reads them from Exo's update address. Download sends you through Exo's update address (updates.getexo.app) to the installer on GitHub, or to Exo's own copy when GitHub can't send it. GitHub sees your IP address, as with any download.

Exo Launcher

Exo Launcher is local-first. It has no Exo account, no ads, no analytics and no telemetry.

Your library, installs, updates, game launches and settings work offline. Exo has no server of its own that they depend on.

What stays on this PC

Exo keeps its data in %LocalAppData%\ExoLauncher. This includes:

• settings (settings.json, which also holds your Library folders), the library cache, playtime Exo recorded, hours Xbox reported (reported-hours.json: game titles and minutes only), window position, cover art and thumbnail caches, achievement cache, and upscaler backups;
• copies of custom game covers you choose. They are stored locally and never uploaded;
• your Store wishlist (store/wishlist-v2.json) and the last sale price Exo told you about, the Store's saved pages (store/home-v5.json, Steam's public facts about the games it showed in store/items-v2.json, tag names in store/tags-v1.json), and your Exo Mouse profiles (mouse/profiles.json);
• the parts Exo fetches when it installs: the store tools (Legendary, gogdl, Nile) and their data, DeepFilterNet for noise suppression, and NVIDIA's TitaNet and Parakeet models for Only My Voice and dictation (in tools, voice and models; uninstalling Exo removes them), plus the browser data from the Epic and GOG sign-in windows;
• Exo Shaders, the shader engine behind PC > Graphics > Shaders, keeps its compile records, recordings and settings in %LOCALAPPDATA%\SCSKiller (the same folder SCSKiller uses). Exo passes it your installed games' names and folders so it can find their shaders; nothing leaves your PC (see Exo Shaders under Other network requests for the files it may download). It runs only when it has work, and Exo keeps in shaders-engine.json what it saw last time (your graphics driver's version, short hashes of your installed games and their programs, and when it ran) so it starts only when something changed;
• Exo Capture, the add-on behind the Capture button, saves the instant replays, recordings and snips you ask for in your captures folder (Videos\Exo Captures unless you choose another), and keeps its settings, thumbnails and which game each capture belongs to in capture under Exo's data folder. It captures the game's window or the screen through Windows; only when Windows gets no picture from a game (exclusive full screen) does it load OBS Studio's game capture hook into that game to copy its frames, never into Riot games or while FACEIT or ESEA runs. Every replay and recording has four sound tracks: the mix, the game (on the desktop, everything you hear except Discord), Discord voice while Discord runs, and your default microphone. There is no setting to leave one out; mute a track in your player or editor instead. While instant replay or a recording runs, your microphone is in use and Windows shows its microphone indicator. Instant replay holds the last minutes in memory, by default only while a game is running, and writes nothing until you save. Captures never leave your PC by themselves: Send to Discord copies the file and opens the Discord room for you to paste it into a chat. A storage limit or age you set sends the oldest captures to the Recycle Bin; favorites are always kept. A capture you delete goes to the Recycle Bin too;
• Exo Notes (Captures › Notes) keeps your notes as plain text and Markdown files in Documents\Exo Notes (your user folder's Exo Notes when Documents is kept in OneDrive), and in notes under Exo's data folder which notes are open, their pins and the game each was written in, and the edits of a file opened from elsewhere until you save it. A word you right-click is checked by Windows' own spell checker on this PC; Add to dictionary puts it in Windows' word list. Nothing in a note is sent anywhere. Exo adds itself to Windows' Open with and Default apps for .txt, .md and .log files (for your account only) only when you choose Open text files with Exo; Windows keeps which app opens them, and Stop opening text files with Exo, or uninstalling Exo, takes it out.
• the browser profile used for YouTube Music and Apple Music;
• logs (see Logs below).

Dictation. The mic in Exo's text boxes (Settings > General > Dictation) uses your microphone only from when you press it until you press Stop, at most a minute, and Windows shows its microphone indicator. What you say is turned into text on this PC by NVIDIA's Parakeet model and goes into the text box. The sound stays in memory until then; it is never saved, logged or sent anywhere.

To find your games, Exo reads local folders, store manifests, registry keys and data saved by store clients on this PC. For hours, it also reads GOG Galaxy 2.0's database (galaxy-2.0.db, read-only) for the time Galaxy holds for games on the other platforms you connected to it. Exo does not upload your library, install folders, launch settings, playtime or achievements. Some services see a game title or store id when Exo looks up artwork or hours for it; they are listed under Other network requests.

To free memory, Exo reads the process list on this PC (names, parent processes, and the command line of a Battle.net process to tell its renderers apart) to find the browser helpers of Steam, the Epic Games Launcher, the EA app, Ubisoft Connect, GOG Galaxy and Battle.net, and lowers their memory use while they are hidden. It reads nothing inside them, keeps nothing and sends nothing.

Keys and sign-ins stay local. Optional keys you paste (Steam Web API, itch.io, SteamGridDB, OpenXBL) and your saved Riot ID are encrypted with Windows (DPAPI) for your Windows user. They are not written to settings.json, not shown back in the app, and only sent to the service they belong to (see Other network requests). Other programs running as the same Windows user can still get at them.

Store sign-ins stay with the official tools:

• Epic sign-in goes to Legendary.
• GOG sign-in goes to gogdl.
• Amazon sign-in goes to Nile.

Exo opens the store's own sign-in page, passes the result to that tool, and does not keep its own copy of the token.

Accounts in Settings > Accounts and keys. To show who each store is signed in as, Exo reads the display names in Steam's config\loginusers.vdf, Legendary's user.json, Nile's user.json, and the Epic Games Launcher's account id in the registry (to tell whether it uses a different account). Only display names reach the page; account names, ids and tokens are never logged. Switch account on Steam does what Steam's own account picker does: it closes Steam, marks that account as the one to sign in to in loginusers.vdf and the registry (AutoLoginUser, RememberPassword), and starts Steam again. Exo never sees a Steam password and never touches config.vdf. Epic accounts you add for their hours each get their own Legendary folder in %LocalAppData%\ExoLauncher\epic-accounts, and the last Epic playtime of each account signed in on this PC is kept in epic-playtime.json under a one-way tag. Exo adds up the hours each Steam account on this PC and each of those Epic accounts recorded; nothing is sent anywhere new.

Store settings Exo changes. Exo turns the Steam overlay off for Steam games (a game's Properties turn it back on for that game), and keeps Steam's and Epic's own pop-ups and sounds off. Exo writes these switches into each Steam account's localconfig.vdf and sharedconfig.vdf and into Epic's own settings, on this PC, while those apps are closed; nothing else in those files changes. When you press Play on a Steam game, Exo accepts that game's own EULA and Steam's default launch choice if Steam asks, never Steam's Subscriber Agreement or a purchase.

When Steam's servers are down. While Steam runs, Exo reads two of Steam's own logs on this PC every 15 seconds (logs\connection_log.txt and logs\steamui_login.txt: whether Steam's sign-in was answered, and Steam's own internet check) to tell you once when Steam can't reach its servers; nothing is sent anywhere and nothing from them is kept. If you choose Play offline, Exo closes Steam (never while a Steam game runs), turns on Steam's own offline mode for the account Steam signs in as (WantsOfflineMode and SkipOfflineModeWarning in config\loginusers.vdf, what Steam's Go Offline writes), and starts Steam again. It first keeps a copy of that file (steam-offline-loginusers.vdf) and the two values it had (steam-offline.json) in Exo's data folder, puts exactly those values back when Steam's servers answer again (or after you go online in Steam), and then deletes both. Nothing else in the file changes, and no password or token is read.

Gifts. To show gifts waiting for you in the Library, Exo opens Steam's and Epic's own gifts pages in a hidden browser with its own profile (gifts-webview in Exo's data folder) when you open the Library (at most every half hour) or refresh it, and every half hour while Exo is in front and you're not playing, and reads them; Accept and Decline make the same calls those pages make. Steam's website needs one sign-in there, on Steam's own page (Settings > Game stores > Steam gifts); it stays in that profile until you sign out there. Epic's store page is signed in with a one-time code from Exo's Epic sign-in. Gift names, senders and messages are shown, never saved, logged or sent anywhere else.

Exo accounts (removed)

Exo 3.4 removed the optional Exo account. The app has no sign-in, sign-up, sign-out, handle, badges, export or delete screens any more, and it never contacts the Exo account service (exo-id). Recent versions synced nothing to the account, so your library, playtime, settings and keys are already on this PC and keep working as before.

On this PC. The first time Exo 3.4 or later starts, it deletes what an earlier version saved for the account, in %LocalAppData%\ExoLauncher and %AppData%\ExoLauncher:

• auth.bin, the session token, encrypted with Windows (DPAPI), that kept you signed in, together with the account id, handle and email it held, plus any unfinished copy (auth.bin.tmp);
• the online-cache folder of saved account responses;
• device-id, the per-PC id very old versions sent with a library activity summary.

This is a local cleanup only: Exo does not sign out with the service or send it anything. It runs again on every start, so a copy restored from a backup is removed too. Exo writes one line to its log when it removes a saved sign-in.

On the service. If you created an account with an earlier version, the service still holds what it held before: your account id, display name, email, a salted password hash, session records (which may include an IP address and an app or browser identifier), and anything older versions stored, such as a handle, profile fields, a library activity summary, online status, preferences, friends or store links. Exo 3.4 does not add to it or change it. That data stays on the service (Cloudflare Workers with a Cloudflare D1 database) until the service is shut down and its data deleted. Until then, Exo 3.3.x can still download a copy (Settings > Exo account > Download) or delete the account (Settings > Exo account > Delete account); deleting removes the account and everything linked to it. Sessions end after 7 days, and the service removes expired ones every hour.

Connected apps

Exo's Discord room and Music room talk to those services for you, with your own sign-in. Each service keeps its own data and privacy policy. What Exo reads from them (your messages, your library, what you played) is shown to you and not stored, logged or sent anywhere else.

Discord

• Exo's own Discord client. The Discord room is Exo's own client; Exo does not run, install or change the Discord desktop app. You sign in by scanning a QR code with Discord's phone app, so Exo never sees your password. Exo keeps the sign-in on this PC, encrypted for your Windows account (discord-client.bin in Exo's data folder), and sends it only to Discord. Messages are shown, never saved or logged, and only channels your roles let you see are shown. What you were writing and haven't sent (up to 100 conversations) is kept on this PC in Exo's page storage, as Discord's app keeps drafts, and goes when you send or clear it. Exo sends Discord your status and your custom status, never the game you're playing or the song Exo's Music room plays; your song shows only inside Exo. Each time it connects, Exo also turns off your Discord account's data and privacy switches wherever one is on: Data & Privacy's two consents (data to improve Discord, data to personalize it), sponsored content from your activity and from third-party data, your messages on Discord's web pages, telling friends when you update your profile, Share my activity, and messages from friends in connected games. It sets your account's language and time format to your PC's. These are your Discord account's own settings, saved with Discord as its app saves them, so they hold on your other devices too. Listen along reads a friend's song from the activity Discord already sends Exo, and looks for that song's name and artist on your own music service, through the service's own app or page; nothing about it goes anywhere else. An invite link you click is sent to Discord to join that server. In a call, your microphone is used only while you're in it, and in Discord settings > Voice & Video only while its level meter shows (Windows shows its microphone indicator); its sound is cleaned of noise and echo on this PC (DeepFilterNet and WebRTC's echo canceller, or NVIDIA's noise removal on an RTX card once you download it); with Only My Voice, Exo learns your voice from a Voice Check you choose to use, keeps that voiceprint (192 numbers) on this PC, encrypted for your Windows account (voice\my-voice.bin), and compares voices with it only on this PC; Forget deletes it; encrypted end to end with Discord's DAVE protocol and sent only to Discord's voice server. Mentions and DMs show as Windows notifications with the message's text, as Discord's app does. Discord settings change your Discord account's own settings on Discord, as Discord's apps do; what Discord keeps per device (Accessibility, Streamer Mode, the camera, keybinds, sounds) stays on this PC. Your email and phone number are shown masked and never reach the page in full. Discord's sounds and the fonts of its display name styles are fetched once from discord.com and kept in Exo's data folder. The Shop shows Discord's catalog and the collectibles you own. Buying with a card already saved on your Discord account happens through Discord, which shows Exo only the card's brand, last four digits and expiry; Exo never sees or stores card numbers or your billing address, and anything else finishes in Discord's own shop in your browser. Keybinds read the keys you hold only while you're in a call, and never record or send them. Sign out removes the sign-in and ends it on Discord. Discord's terms do not allow third-party clients; that risk comes with signing in.

Spotify

This is your installed desktop app, which plays the music hidden behind Exo. You sign in to Spotify on Spotify's own page in your default browser. When Exo starts Spotify:

• Spotify. Exo recolors it and hides ads, promos and install prompts by adding CSS to Spotify's local xpui.spa file, turns on two of Spotify's own preferences that hide home-page takeovers and promoted songs, and turns off its Windows notification on every new song. It turns on Spotify's "system media controls" preference so the mini player can follow playback. It also starts Spotify with a private debugging pipe that only Exo holds (no port another program could find), and uses it to hide Spotify's window buttons and to pause Canvas videos.

All of these changes stay on this PC. The mini player reads what is playing from Windows' media controls.

Exo's Music room for Spotify draws Spotify's pages itself. Through that same private pipe it asks the Spotify app for what the room shows (your library, home, search, playlists, albums, artists, podcasts, the queue, devices, recently played, lyrics of the playing song, your friends' activity, and your Jam) and passes on what you click (play, queue, like, add to or remove from a playlist, start, leave or end a Jam, remove someone from it). Spotify makes every one of these requests itself, with its own sign-in, exactly as when you click in Spotify; Exo never reads your token or cookies. Only small summaries (names, picture links, durations) reach Exo's window, and nothing is stored. A Jam's invite link reaches Exo only to be copied when you press Copy invite link. Album art, profile pictures and lyrics' covers load in Exo's window straight from Spotify's image servers (*.scdn.co, *.spotifycdn.com).

Your mouse (Exo Mouse)

In the Devices room, your mouse's page is Exo Mouse, which is part of Exo's download and talks to your mouse directly over USB HID. It reads and writes your mouse's own settings (such as DPI, polling rate, buttons, lighting, battery level and onboard profiles). That data stays on this PC: profiles you save in Exo Mouse (a name, the settings to put back and the games they are for) are kept in Exo's data folder on this PC (mouse\profiles.json), nothing is sent anywhere, and Exo needs no OpenMouse app, vendor software or driver for it. To show a picture of your mouse, Exo Mouse loads its product render from OpenMouse's image server (img.openmouse.app), the request names the model's image file, and the image is then kept in Exo's browser cache. Your mouse's card in the Devices room shows the picture Exo's list has for that same render (the render itself, or the maker's own picture where it is sharper). Your keyboard, controller and headphones are shown with their maker's own product picture (where the maker publishes none large or clean enough, an authorized store's copy of it). Exo picks it from a list of links built into Exo, by what Windows and the device report (its name, a keyboard's layout, a DualSense's body color) or the headphones you picked in Lucid, and requests only that image file from the maker's image server (see Device pictures below). Nothing about you or this PC goes with the request, and no cookies; as when you open the maker's product page, the image server sees which product's picture was asked for. Exo fits the picture to the Devices room's frame and keeps it on this PC (device-images in Exo's data folder), so each picture is fetched once. A device with no picture in Exo's list is drawn by Exo itself.

Earlier versions of Exo answered the OpenMouse web panel through a bridge of their own and could stop the OpenMouse Bridge app to do it. That bridge is gone. The first time this version starts, if Exo had stopped the OpenMouse Bridge app, Exo puts its start with Windows back exactly as it was and writes the profiles Exo kept into the app's own settings file, then deletes Exo's copy. It does not start the app.

YouTube Music

YouTube Music runs inside Exo as a web page (Microsoft Edge WebView2), using a browser profile stored under %LocalAppData%\ExoLauncher. You sign in to Google there, and Google handles that data.

Exo's Music room draws YouTube Music's pages itself and keeps that page out of sight behind it (it shows only so you can sign in). Exo asks the page for what the room shows (home, search, your library, playlists, albums, artists, the queue, lyrics) and passes on what you click (play, like, shuffle, repeat); the page makes every request itself with your Google sign-in, as when you click in it, and Exo never reads its cookies or tokens. Only small summaries reach Exo's window, and nothing is stored. Covers load in Exo's window straight from Google's image servers (*.googleusercontent.com, i.ytimg.com).

Apple Music

Apple Music runs inside Exo as Apple's own web player (music.apple.com) in the same browser profile. You sign in to Apple there, in Apple's own sign-in window, and Apple handles that data. Exo's Music room draws Apple Music's pages itself and keeps that page out of sight behind it (it shows only so you can sign in). Exo asks the page's own Apple Music player (MusicKit) for what the room shows (home, recently played, search, your library, playlists, albums, artists, the queue, lyrics of the playing song) and passes on what you click (play, add to the queue, favorite, add to or remove from your library or a playlist, shuffle, repeat, volume). The page makes every request itself, with Apple's own developer token and your sign-in; Exo never reads, stores or copies those tokens or its cookies. Music plays inside Apple's page, protected as Apple protects it; Exo never handles the audio. Only small summaries (names, picture links, durations) reach Exo's window, and nothing is stored. Covers load in Exo's window straight from Apple's image servers (*.mzstatic.com). The Apple Music app for Windows is no longer used.

Exo adds these browser extensions to that profile:

• uBlock Origin Lite blocks ads and trackers with the filter lists built into it, and downloads no lists of its own.
• SponsorBlock asks sponsor.ajay.app about the video that is playing.
• Better Lyrics fetches lyrics from outside lyrics services.

These extensions have their own privacy policies. A music page that asks for your microphone, camera, clipboard or notifications asks you first; Settings > Accounts and keys > Music sets YouTube Music's notifications.

Other network requests

Store and service websites (store pages, key redemption, sign-up pages) open in your normal browser.

Logs

Exo writes a diagnostic log to %LocalAppData%\ExoLauncher\logs\app.log. It holds up to about 2 MB, plus one older file. The log can include:

• game titles and folder names;
• app and store tool messages;
• errors from the app's interface;
• crash details.

Before writing, Exo removes things that look like tokens, passwords, keys, account or store ids, and email addresses. Logs never leave your PC. Exo does not upload them. Open logs, offered when part of Exo stops, only opens the folder. If you share a log for support, check it first.

What Exo Launcher does not do

• No ads, analytics, telemetry or crash-reporting service. Crashes are written to the local log only.
• No Exo account, and no online dependency for your library or game actions.
• No library activity, playtime or per-PC id sent anywhere. Your online status, and your current game when your Discord account shares it, go only to Discord (see Discord).
• No uploading of your library, install folders, playtime history or store sign-ins.
• No Exo friends list, profiles, handles, badges, chat or settings sync. The friends, profiles and chat in the Discord room are Discord's own.
• No kernel driver, anti-cheat bypass, or silent approval of Windows security prompts.
• The clipboard is read only when you open Activate key, to spot a game key, and only on this PC. Exo then opens the store's own redeem page (for Epic it copies the key for you to paste); it does not send the key anywhere itself. Exo Capture writes to the clipboard when you snip or press Copy or Send to Discord, and never reads it. In Exo's own Discord client, Copy Image puts the picture on the clipboard and Save Image saves it in your Downloads folder.

Exo Cinema

Exo Cinema is local-first. It has no Exo account, no ads, no analytics and no telemetry.

Exo Cinema has no server of its own. Nothing you watch or do in it is sent to Exo or its developer.

What stays on this PC

Exo Cinema keeps its data in %LocalAppData%\ExoCinema, beside the app (in app), never inside it, so updates never touch it:

• your Jellyfin sign-in (accounts.json): the server's address and name, your user name and an access token from the server, sealed with Windows' own protection for your Windows user. Your password is never stored;
• settings.json: whether the first run is done, and the last version whose What's New you saw;
• the interface's own storage (WebView2): your choices in Settings, the volume, the languages you picked for each show, the last server you signed in to, and a copy of Home and the title pages you opened, so they draw at once next time;
• pictures from your server (cache\images), so Home draws before the server answers. Settings > Storage > Clear empties it;
• app.log, crash.log and window-placement.json: what Exo Cinema did (timings, buffering, errors), what went wrong if it crashed, and where its window was. app.log never holds a web address, a key or your server's or add-on's name: each address is cut to its kind of file (https://…/*.mkv), so the log is safe to attach to an issue.
• While the player is open, the title, the show and the poster of what's playing go to Windows' media controls on this PC, which show them in Windows' media flyouts and to apps that read them, such as Exo Launcher. They don't leave the PC; closing the player clears them.
• WebView2's form memory is off: nothing you type into Exo Cinema (a server address, an add-on link) is kept by it.

Signing out forgets the sign-in. Uninstalling with Also remove my sign-in and settings deletes the whole folder; without it, the folder stays for a reinstall.

What leaves your PC

Your Jellyfin server

Exo Cinema talks to the Jellyfin server you sign in to, and only to it, for your libraries: what's in them, their pictures, search, and the video you play. While you watch, it tells the server where you are in the video, when you pause and when you stop, as every Jellyfin app does, so the server keeps your place and marks what you finish as watched, and your other Jellyfin apps pick up where you left off. Watched on a title's page tells the server too. The server sees your user, your IP address, the name of this PC and a random ID Exo Cinema made for it. What it does with that is up to the server and its owner.

A stream add-on, if you add one

Settings > Playback > Stream addon is empty unless you fill it. With an add-on's address there, Exo Cinema asks that add-on for streams of what you play (the title's IMDb ID, and the season and episode), and plays from the address it answers with. That add-on, and the host it sends you to, see your IP address.

Your Jellyfin account page

Settings > Account > Jellyfin account opens your server's own account page in your web browser.

Microsoft

Exo Cinema's interface runs on Microsoft Edge WebView2, part of Windows. WebView2 updates itself and its components through Microsoft, and may send diagnostic data according to your Windows privacy settings. If WebView2 is missing, Setup downloads Microsoft's installer from go.microsoft.com and checks Microsoft's signature on it.

Updates

Twenty seconds after Exo Cinema starts, and every twelve hours while it runs, it asks GitHub which release is the newest (github.com/UhhErix/ExoCinema/releases/latest), and when a newer one is out, reads that release's list of changes (whats-new.json). Settings > About > Check for updates asks at once. GitHub sees your IP address and "ExoCinema/" with the version you run; nothing else is sent.

When you choose Install update, Exo Cinema downloads that release's Setup and its SHA-256 from GitHub (github.com, which hands the files over from its own download host), checks the file against that checksum and against its own version details, keeps it in %LocalAppData%\ExoCinema\updates and runs it. Setup installs over the version you have and keeps your data; the downloaded Setup is deleted the next time Exo Cinema starts.

Questions

Open an issue at https://github.com/UhhErix/ExoCinema/issues. Issues are public: leave out anything personal, your server's address included.

Exo Browser

Exo Browser is local-first. It has no Exo account, no ads, no analytics and no telemetry.

Exo Browser has no server of its own. Nothing you do in it is sent to Exo or its developer.

What stays on this PC

Exo Browser keeps its data in %LocalAppData%\ExoBrowser, beside the app (in app), never inside it, so updates never touch it:

• your settings (Boosts, Mods and your own CSS among them), open tabs, spaces and folders, history, archived tabs, bookmarks, site icons, downloads list and the extensions you added (settings.tsv, session.tsv, spaces.tsv, history.tsv, archive.tsv, bookmarks.tsv, favicons.tsv, icons.tsv, iconmiss.tsv, downloads.tsv, extensions.tsv);
• the browser profile (Profile): cookies and sign-ins, site data, the cache, and your extensions' own data, kept by Microsoft Edge WebView2 as Edge keeps them;
• Exo Vault (vault.exovault, and vault.exovault.bak from the save before): your logins, cards, notes and identities, encrypted (see Exo Vault);
• a working copy of Exo Shield (Builtin).

A private tab (Ctrl+Shift+N) runs on a profile kept in memory only: its cookies, sign-ins and site data stay apart from your other tabs and go when the last private tab closes, and what it visits never reaches your history or saved tabs.

Settings > Privacy > Cookies, site data and cache clears cookies, every site's stored data and the cache, which signs you out of every site. Uninstalling with Also remove my data and Exo Vault deletes the whole folder; without it, the folder stays for a reinstall.

Exo Vault

• Exo Vault is one file, encrypted with AES-256-GCM (Windows' own implementation). Its key is random and is itself locked twice: by a key made from your master password with Argon2id (256 MiB of memory, 4 passes), and, if you turn it on, by Windows Hello, through a key Windows Hello keeps for your Windows user on this PC (in its security chip when it has one).
• Your master password is never stored. Nobody can recover the vault without it or Windows Hello, Exo included.
• While the vault is open, its items are held in memory by Exo Browser's own interface, which has no access to the web. It locks after the time you choose, when Windows locks and when the PC sleeps, and forgets them.
• Filling a sign-in form: a small script in each page finds sign-in fields and tells Exo Browser where they are. Exo Browser matches logins to the page's real address as WebView2 reports it, not what the page claims, and the page gets nothing until you pick a login. After you sign in, it passes what you typed to Exo Browser so it can offer to save it.
• A password you copy is kept out of Windows' clipboard history and cloud clipboard, and cleared from the clipboard after 30 seconds.
• Password health (weak, reused and missing 2FA) is worked out on this PC. Exo Vault never sends your passwords, or parts of their hashes, anywhere.
• An export is one file encrypted with a password you choose. It leaves your PC only if you move it yourself.

Bringing your things from other browsers

When you choose Import (or Bring in on first run), Exo Browser reads that browser's own files on this PC: bookmarks, history, site icons, cookies (so you stay signed in), its search engine and its Chrome Web Store extensions, and, into Exo Vault, its saved passwords. From Arc it also reads its sidebar file (StorableSidebar.json) for your spaces, their colors, favorites, pinned tabs with their folders and Today tabs. For Firefox, Zen, Floorp, LibreWolf and Waterfox it reads bookmarks, history, cookies and passwords. Encrypted data is decrypted on this PC with Windows' own protection for your user. Nothing is removed from the other browser, and nothing is sent anywhere. A password export file you import is read the same way.

What leaves your PC

The sites you visit

The sites you open, and what they load, minus what Exo Shield blocks. They see what any browser sends them. Exo Browser turns on Microsoft Edge's balanced tracking prevention, and does not send the "pings" some links ask for.

Cloudflare (secure DNS)

Every address lookup (a site's name, like github.com) goes encrypted over HTTPS to Cloudflare's resolver (chrome.cloudflare-dns.com), with no unencrypted fallback, so your network and internet provider don't see which sites you look up. Cloudflare sees the names looked up and your IP address; see Cloudflare's resolver privacy policy.

Your search engine

What you type in the Bar when it isn't an address goes to the search engine you pick in Settings > General (Brave Search unless you change it; Google, DuckDuckGo, Startpage, Kagi and Bing are the others), as a normal search. A site search (a keyword such as yt, or a site's address and Tab) sends what you type to that site's own search instead, as a normal visit. Nothing is sent while you type: the Bar's suggestions come from your tabs, bookmarks and history on this PC.

Site icons

For your bookmarks and most visited sites, Exo Browser asks each site for its large icon (/apple-touch-icon.png, or the icon the page names). These requests go to that site, or to the address its own page names for its icon (often the site's own image server), over HTTPS only, through Windows' own download service, so their address lookups use your PC's usual DNS rather than Cloudflare.

Sites you follow in live folders

When you follow a site in a live folder, Exo Browser asks that site for its feed (the RSS or Atom address its page names) 15 seconds after it starts and every 30 minutes while it runs. These requests go to that site only, through Windows' own internet service, with "ExoBrowser/" and the version you run and none of your cookies; their address lookups use your PC's usual DNS rather than Cloudflare. Delete the folder and they stop.

Twitch (Exo Shield)

To skip Twitch's ads, Exo Shield's TTV LOL PRO sends Twitch's request for a live stream's playlist (the list of video pieces, never the video) through TTV LOL PRO's proxy servers (perfprod.com) in a country where Twitch shows no ads. That request includes the channel name and the playback token Twitch gives your browser for the stream; the proxy sees it and your IP address. It looks up those servers' addresses with Cloudflare. TTV LOL PRO's ad reports are off, and it sends nothing else about you.

Chrome Web Store

Opening the Chrome Web Store is a visit to Google's site. When you add an extension, its package is downloaded from Google (clients2.google.com) with the extension's id and your WebView2 version.

Microsoft

Exo Browser runs on Microsoft Edge WebView2, part of Windows. WebView2 updates itself and its components through Microsoft, and may send diagnostic data according to your Windows privacy settings. Exo Browser turns off Microsoft Defender SmartScreen's address checks, so the pages you open are not checked with Microsoft; Exo Shield's malware lists block known bad sites instead. If WebView2 is missing, Setup downloads Microsoft's installer from go.microsoft.com and checks Microsoft's signature on it.

Exo Shield's lists

Exo Shield's filter lists are built into each release. It downloads no lists and sends nothing about the pages you visit.

Updates

When Exo Browser starts, and every twelve hours while it runs, it asks Exo's update address which release is the newest (exo-updates.exo-erix.workers.dev, a Cloudflare Worker run for Exo). It answers from Exo Browser's releases on GitHub, or from its own copy of them when GitHub can't. It sees your IP address while it answers, and "ExoBrowser/" with the version you run; it keeps no logs and stores nothing about who asked. Only if it doesn't answer, Exo Browser asks GitHub itself (github.com/UhhErix/ExoBrowser/releases/latest), which sees the same. Settings > About > Check for updates asks at once.

When you choose Install update, Exo Browser downloads that release's Setup and its SHA-256 from the same place (the update address hands them over from GitHub's download host, github.com, or its own copy), checks the file against that checksum, keeps it in %LocalAppData%\ExoBrowser\Updates and runs it. Setup installs over the version you have and keeps your data; the downloaded Setup is deleted the next time Exo Browser starts.

Questions

Open an issue at https://github.com/UhhErix/ExoBrowser/issues. Issues are public: leave out anything personal.