Privacy policy

Corvus is made by Parendum OÜ, a company based in Estonia. Parendum is the controller of the personal data described in this policy. For any privacy question or request, write to privacy@parendum.com.

This policy applies to:

• Corvus, the desktop browser for Windows, macOS and Linux;
• Corvus for mobile, for Android (an iOS version is planned);
• this website, corvus.parendum.com.

Your browsing data, such as history, bookmarks, open tabs, passwords and settings, is stored on your device. Parendum runs no account system, and the apps do not send us any personal data.

The apps contain no analytics, telemetry, crash reporting or advertising.

Sync is optional. When you turn it on, your data is encrypted on your device before it leaves it, and is sent to a sync server that you run yourself or choose. Parendum never operates that server.

The server stores your synced data end-to-end encrypted and cannot read it. To route it, the server also stores, unencrypted, each device's name (by default the computer's name or the phone's model), its type, and timestamps. Like any server, its logs can record IP addresses.

Your recovery phrase and pairing code never leave your devices, except when you use them to pair your own phone. On the phone, the phrase is kept in the operating system's secure storage (Android Keystore or iOS Keychain).

Anyone who has your recovery phrase can read your synced data. Use it only on your own devices and do not share it.

The AI features of the desktop app use the provider you choose:

• the Anthropic API, with your own API key;
• Claude Code, with your own Claude Code sign-in on that computer;
• a local or self-hosted model server, such as Ollama or any OpenAI-compatible server.

Requests go straight from your computer to that provider and are handled under its own privacy policy. Parendum sees nothing. Your API keys are stored on your device.

These features send page content to your provider when you use them: Assist, the browser agent, AI search and the page monitor (which sends the changes on the pages you watch).

Dictation, if you turn it on, sends your voice to the speech-to-text service you choose: OpenAI, Groq or a server you set.

On its own, the desktop app connects to:

• Updates: GitHub (github.com/ParendumOU/Corvus), to check for new versions and download them.
• Ad blocker: the sources of its filter lists, to download them.
• Extensions: the Chrome Web Store (Google), every few hours to update them, only if you have installed extensions.
• Spell check: Google's servers, to download dictionaries (on Linux).
• Site icons: the sites in your bookmarks and history, without cookies. For a bookmark that redirects, Corvus may load the bookmarked page itself to find its icon.
• Reading list: the pages you save from your phone without their article, to fill it in, without cookies.
• Search: the search engine you pick. Corvus's AI search uses a local SearXNG when one is available and DuckDuckGo or Brave otherwise, and loads the icons of the result sites.
• New Tab background: Bing, Wikimedia Commons, NASA or Picsum, if you choose one of them.

When you turn them on, it also connects to these services:

• Telegram, if you link it;
• Have I Been Pwned, for password checks;
• Cloudflare, for the connection check;
• New Tab widgets, such as weather, and their data sources;
• file hosts such as GoFile (which creates a guest account), when you download from them;
• the Brave Search API;
• YouTube, for video transcripts, using your own YouTube session in the browser;
• the MCP server, which lets AI apps on your computer, or on your network if you allow it, control the browser.

Each of these services works under its own privacy policy, and Parendum receives nothing from them. Any service Corvus connects to receives the technical details that come with a connection, such as your IP address.

• Connections: the app connects to your sync server, and directly to websites to load the icons (favicons) of the pages it shows from your synced tabs, bookmarks and history. Those sites see your phone's IP address, as when you visit them.
• Camera and QR scanning: the camera is used only to scan the pairing QR code. The code is decoded on the phone by a decoder built into the app (ZXing on Android, Apple's AVFoundation on iOS). The camera image and the code never leave the phone and are not sent to Google or anyone else.
• Default browser: on Android you can make Corvus for mobile your default browser. Links you open then come to Corvus first, which offers to open them in the browser you pick, or to send, save or watch them. The list of installed browsers is read on the phone only and never sent anywhere.
• Notifications: optional and off by default. If you turn them on, the phone checks your sync server in the background and creates the notifications itself. No push service is used and no push token is requested. The notification library includes Firebase Cloud Messaging code, but Corvus does not configure or use it.
• Backups: your recovery phrase is never included in device backups. From Corvus for mobile 0.6.0, nothing the app stores is included in Android's cloud backup.

Corvus is distributed through Google Play and GitHub. Those platforms may process data about you under their own privacy policies, for example when you install the app from Google Play.

This website is hosted by Parendum on its own server. It sets no cookies and uses no analytics or ads.

Like most web servers, ours may keep standard technical access logs: your IP address, your browser's user agent, the address you requested and the time. We keep them on the basis of our legitimate interest in keeping the site secure and running (Article 6(1)(f) GDPR), and only for a limited period.

Corvus and this website are not directed at children under 13.

Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, and to object to its processing. To use these rights, write to privacy@parendum.com.

Because Parendum holds almost no personal data from the apps, most requests will be about website logs or e-mails you have sent us.

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee).

If this policy changes, we will publish the new version on this page and update the date at the top.