Privacy notice of the CYBETOWER Browser app (Android)

Who is responsible

The app belongs to POWERB SAGL, Via Serrai 2, 6592 S.Antonino, Switzerland (CHE-367.484.791). Privacy questions: privacy(at)cybetower.swiss.

What stays on the phone

Company network access profiles, with their private key, bookmarks, history and open tabs are sealed with a hardware-backed key of the phone and excluded from backups and device transfers.
Cookies and data that sites store stay in the app, as in any browser. Anonymous tabs have their own cookies and data, stay out of history and are wiped when the last one closes.
Settings, the permissions you gave to sites, a random installation identifier and the block counters (numbers only) stay in the app.
History can be deleted in the app; you can also have site data wiped at every disconnection. Uninstalling the app deletes all of this data; files you downloaded stay in the phone's Download folder.

What leaves the phone, and to whom

The pages you open: they go to the requested sites through a proxy inside the app. Company pages travel in the encrypted tunnel to your organisation's server; internet sites go out as your profile says, directly or through your organisation's network. Each site receives what it receives from any browser: the IP address you go out from, a reduced browser identification and its own cookies.
Before any connection the app refuses requests to the domains in its block list (ads, tracking, malware, spam), blocks third-party cookies and removes WebRTC from pages, except on sites you allowed the camera or microphone. The list is inside the app: using it contacts no one.
Activation from CYBETOWER SHIELD, only when you start it, to api.platform.cybetower.swiss: e-mail, password and second-factor code for sign-in, or the code of the one-time link; the tunnel's PUBLIC key; the device name (the one proposed by SHIELD or the app's name); the random installation identifier; the platform (android). Never the private key, history, visited pages, the phone model or hardware identifiers such as serial number, IMEI or MAC address. The sign-in session stays in memory only. Like any server, the platform sees the IP address you connect from.
Rating: when you tap “Rate the app”, or rarely on its own (after 5 sessions and 7 days, at most once every 90 days), the app asks Google Play to show its rating window. What you write goes to Google under Google's terms.
External links (website, author, sharing) open only if you tap them.
No ads, no usage statistics, no tracking, no third-party analytics library, no update checks. Google Safe Browsing and WebView metrics are off. Pages are drawn by Android System WebView, a system component that Google Play updates like other system apps; Google Play also handles installing and updating the app under its own terms.

Data on the CYBETOWER platform

The data sent at activation lets your organisation's administrator manage accesses (which devices are active, revoking one). For this data you can also contact your organisation.

Permissions and why

Internet and network state: open pages, keep the tunnel, notice network changes.
Foreground service and notifications: keep the connection alive when the app goes to the background, only while a session is open, and show that it is active with a Disconnect button.
Camera (optional): read the activation QR code and, if you allow it for that site, video calls.
Microphone (optional): video calls, only on sites you allow.
Location (optional): only on sites you allow, never in the background.
Fingerprint or screen lock: open the profile vault.
Camera, microphone and location go through two questions: your answer for that site, then Android's request. Change them in Menu > Privacy > Site permissions.

Your rights

Under the Swiss Federal Act on Data Protection (nFADP) you can ask for information, correction or deletion of data about you by writing to privacy(at)cybetower.swiss.

Changes

We update this notice the same day an app version changes connections, permissions or data. Last updated: 06.10.2026.