Last updated: October 20, 2026
Your browser profiles
Your profiles, meaning cookies, saved passwords, history and site data, live on your own computer, in the Morpho Browser folder. The only copy that leaves it is the encrypted cloud backup described below, which we can't read.
What we store in your account
- Your email address and whether it has been verified.
- Your sign-in credential. Your password is turned into a key inside your browser; the server never sees your password and stores only an argon2id hash of that key.
- When your account was created, when you last signed in, and your plan.
- The names of the computers signed in to the desktop app, with their sign-in and last-used times.
- To apply your plan's profile limit: a random ID for each profile you create in the desktop app, and when, how often and from which of your computers it was last opened. Never the profile's name, cookies, sites or any of its contents.
- Hashes of your open web sessions and of your verification and password reset links. These links expire shortly after they are sent.
- When you transfer a profile to another account: the two accounts, the profile's random ID, its size, the time and the status. The profile itself is encrypted on your computer for the recipient's app only; we can't open it, and it is deleted from our server as soon as the transfer ends (accepted, declined, cancelled or expired after 7 days). For receiving, your account stores a public key and a private key that only your app can unlock.
- Teams: the team and workspace names, the members' email addresses and roles, invitations, which member opened or changed which shared profile and when (the team's activity log), and the shared profiles' random IDs, sizes and times. The shared profiles themselves, their names, cookies and proxies are encrypted on the members' computers with a key only the members' apps hold; we can't open them.
Encrypted cloud backup
So that your profiles come back when you sign in on another computer, the desktop app backs them up to your account. Each profile is encrypted on your computer before it is uploaded, with a key that is itself locked with your password and with a recovery code that only you have. We never receive your password, your recovery code or the unlocked key, so we can't open your backups, and neither can anyone who gets into our server.
For the backup we store:
- The encrypted backup of each profile, and of each browser extension your profiles use (stored once per account under a random-looking ID). To us it is unreadable data: we can't see the profile's name, cookies, passwords, proxy, sites or settings, or which extensions you use.
- For each backup: its size, a checksum of the encrypted data, a version number, when it was uploaded and the name of the computer that uploaded it.
- Your backup key in locked (encrypted) form, twice: once locked with your password and once with your recovery code, plus the random value used to make those locks. Neither can be opened without your password or your recovery code.
Deleting a profile in the app deletes its backup. If your account is deleted, all your backups and backup keys are deleted with it.
The honest limit
Because we can't open your backups, we also can't recover them for you. If you lose both your password and your recovery code, nobody, including us, can decrypt your backups. If you reset your password on this site, the app asks for your recovery code once to unlock your backups again. Keep the recovery code somewhere safe.
Security activity and two-step verification
To protect your account we record security events: sign-ins on the website and in the desktop app (with the device or browser name, the IP address and the approximate country Cloudflare reports), failed sign-ins and wrong verification codes, password changes, two-step verification changes and device sign-outs. You can see them on your account page. They are deleted automatically after 90 days. A sign-in from a device we have not seen before also sends you an email.
If you turn on two-step verification, its secret key is stored encrypted, and your backup codes are stored only as keyed hashes. Turning it off deletes both.
Kept briefly for security
To limit sign-in and sign-up attempts, your IP address and email address are held briefly in the server's memory and never written to disk. For security, the web server keeps access logs (IP address, date and the page requested).
Cookies
This site only uses the cookies it needs to keep you signed in, remember your language and protect its forms. There are no advertising or analytics cookies. Cloudflare, which serves the site, may add its own security cookies to block attacks.
Hosting
The site runs on an OVHcloud server in Canada and is served through Cloudflare. Every connection is encrypted with HTTPS.