Privacy
Privacy Policy.
Mica is a web browser for Windows and Android, made by lessnoise. It has no ads and no analytics, and your browsing stays on your device.
Effective 26 October 2026
This policy covers the Mica apps for Windows and Android and the optional Mica account service at the-api.lessnoise.online. In it, "we" means lessnoise, the developer of Mica.
The short version
- No ads, no analytics, no tracking SDKs, and no advertising ID.
- Your history, bookmarks, tabs, cookies and downloads are stored on your device and are not sent to us.
- Data leaves your device for us only if you sign in to the optional account, which powers Passwords & sync and Send to device.
- We don't sell or share your data, and you can delete your account at any time at lessnoise.online/delete-account.
Data that stays on your device
Mica stores your browsing history, bookmarks, open tabs, cookies and site data, downloads, settings, and passwords you save on the device you use. We don't receive any of it. Passwords and sign-in tokens saved on the device are kept encrypted: with an Android Keystore key on Android and with Windows data protection (DPAPI) on Windows.
You can remove this data at any time with Settings → Clear browsing data, from a site's info card, or by uninstalling Mica. Private tabs and windows keep their cookies and history separate and discard them when closed.
The ad and tracker blocker uses rule lists that ship inside the app. Mica checks each request against them on your device and doesn't download lists or report what it blocks.
When a site asks for your camera, microphone or location, Mica asks you first and remembers your answer per site. What you allow goes to that site, not to us.
The optional Mica account
You can use Mica without an account. If you sign in, it's with Discord (OAuth, the "identify" permission only), and our server stores the following to run Passwords & sync and Send to device:
| Data | What it is and why |
|---|---|
| Discord profile | Your Discord user ID, username, avatar, banner and accent color, so Mica can show who is signed in. We don't get your email address, password, friends, servers or messages. |
| Encrypted password vault | Your saved logins and 2FA keys and, on Windows, a browser snapshot (tabs, bookmarks and history) if you choose to save one. The vault is encrypted on your device (PBKDF2-SHA256 with 600,000 rounds, AES-256 and an HMAC) before it is uploaded. We never receive your master password and can't read the vault. |
| Synced settings | A few on/off preferences, such as dark theme. |
| Devices | A random ID and the name of each Mica install you use with Send to device, and when it was last seen. |
| Sent tabs | The address and title of a tab you choose to send to another device. It is deleted once that device receives it. |
| Sign-in sessions | A hashed form of each device's sign-in token. Sessions expire after 30 days. |
We use this data only to provide those features. We don't use it for advertising or profiling, and we don't sell it or share it with third parties.
Short-lived records also exist to keep the service working and safe: sign-in requests expire after 10 minutes, and rate-limit counters use a one-way hash of your IP address and expire within a minute. Mail sent to our deletion address gets an automatic reply, and a counter based on a hash of the sender's address expires after a day.
Other connections Mica makes
- Websites and search. Pages you open, and searches you send to your search engine (Google by default), go to those sites under their own privacy policies.
- Updates (Windows). Mica for Windows checks GitHub for new releases and downloads updates from there. Mica for Android is updated through Google Play.
- Password leak check (Windows). When you run it, Mica sends the first 5 characters of each password's SHA-1 hash to Have I Been Pwned's range API. Your passwords themselves never leave the device.
- Extensions (Windows). When you add an extension, Mica downloads it from the Chrome Web Store.
Service providers
The account service runs on Cloudflare (Workers and the D1 database), which processes this data for us. Discord handles the sign-in. Neither gets your vault contents. Cloudflare's database keeps a rolling 30-day recovery history, so deleted data drops out of backups within 30 days.
Keeping and deleting your data
We keep account data while your account exists. You can delete the account and everything listed above at any time at lessnoise.online/delete-account: sign in with Discord and confirm, and it's deleted straight away. If you can't sign in, email us and we delete it within 30 days. Signing out on a device ends that device's session but doesn't delete the account.
You can also ask us what we hold about you or to correct it, using the contact below.
Security
Connections to the account service use HTTPS. Vault contents are encrypted end to end, sign-in tokens are stored only as hashes, and the service doesn't log request contents. No system is perfectly secure, but we limit what we hold so there is little to expose.
Children
Mica is meant for people aged 13 and over and isn't directed at children under 13. If you believe a child under 13 has created an account, contact us and we'll delete it.
Changes
If this policy changes, we'll update this page and its effective date. For significant changes, we'll also say so in the release notes.
Contact
lessnoise, developer of Mica
Email: accounts@lessnoise.online