Vision: TV Browser & Launcher Privacy Policy

Effective date: 28 October 2026

Vision: TV Browser & Launcher ("Vision", previously Ciro TV Browser, Android package com.ceero.browser) is published by Autosoft Shujaa Solutions Limited. This policy covers the TV launcher, browser, photo tools and optional device-control features, including legacy Ciro installations.

Manage or request deletion of your data

Your local data

Vision does not require a Vision account and does not sell personal data or include an advertising or analytics SDK. Your favourites, settings, installed-app presentation, bookmarks, history, tabs, calendar preferences and photo albums are stored on your TV. The installed-app list is used locally to display and launch apps; it is not uploaded to our app catalogue.

Current Vision browsing uses GeckoView. Legacy Ciro versions use Android System WebView. Websites can store cookies and other site data on your device. Private tabs are kept separate from saved browser history and their private session is closed when you leave private browsing. Private mode does not hide your network address from websites or remove files you explicitly download.

Optional password vault

Saved website passwords are stored in a local encrypted vault protected by your passphrase and Android Keystore. The vault locks when you leave browsing or after inactivity. We do not receive your vault passphrase or have an account-recovery service for it. Resetting the vault, clearing app data or uninstalling can permanently remove access to saved passwords. Password saving, filling and import require explicit user actions.

Phone browser import

The normal QR import flow opens a page in your phone browser. The selected export is parsed and reviewed on your phone; the TV must approve pairing and import. Password items are masked during review and require an unlocked TV vault before storage.

The phone and TV use end-to-end encryption for the import payload. Our Cloudflare-hosted relay receives ciphertext and temporary session capabilities, not the decryption key, plaintext website passwords or plaintext bookmarks. Sessions are held in memory for up to five minutes and cleared after completion, cancellation or expiry; they are not written to a persistent export database. This is a user-initiated transfer, not automatic account sync. Original export files remain on your device unless you delete them yourself.

Our hosted pages, catalogue and relay receive normal connection information needed to deliver requests, such as IP address and user-agent information. The relay hashes the source IP for short-lived abuse rate limits and hashes session capabilities for request limits. These security counters are not used for advertising, location inference or a cross-app user profile. Hosting providers process standard network/security information under their own privacy practices. We do not log import contents, payload keys or vault passphrases.

Optional live Mirror

Mirror lets you use your phone camera as a live mirror on your TV. Scan the TV QR in your phone browser, compare the codes and approve the connection on the TV. Approval starts the camera, subject to the phone browser’s camera permission. Camera permission is requested by your phone browser, not by the TV app. No microphone access or recording is used in this version.

Camera video travels directly between the phone and TV using encrypted WebRTC on the local network. Mirror has no media relay or TURN fallback: if the devices cannot connect directly, it reports that instead of sending the camera feed through our servers. Our HTTPS service handles only encrypted, short-lived pairing and connection messages. Pairing uses the QR secret and ephemeral device keys; decryption keys stay on the devices. Connection messages are held only in memory for up to five minutes and cleared after setup, cancellation or expiry. Normal hosting connection/security information is handled as described above.

Leaving the phone page turns off its camera, camera light and screen wake request. A temporary interruption can retain an approved, memory-only reconnect context for up to one minute. Returning to the same open phone page within that window can resume the camera without another QR scan; browser camera permission still applies. The TV blanks the old picture while reconnecting. End or Cancel on either device, leaving Mirror on the TV including Home, closing/reloading the phone page, or expiry ends that context and requires a fresh connection. Disconnection detection can take a few seconds. While live, the phone page requests a screen wake lock where supported; the browser or operating system can refuse it.

Nothing is saved to a Mirror history or camera-roll recording by this feature. The phone browser controls any remembered camera-site permission, which you can revoke there. Keep the QR private and approve only a phone whose comparison code matches.

Your photos

You can choose photos on your phone and send them directly to your TV using the session-specific QR link. Photo selection, album names, ordering and saved images are held on the TV; your photos are not uploaded to an Autosoft photo-storage service. Previewing does not save an album until you choose Save album. You can edit or remove saved albums from the app.

Local photo upload uses HTTP on your local network, so use a trusted Wi-Fi network and keep the temporary upload link private. The receiver closes when you close the session, leave the app or the link expires. The separate browser-export relay uses HTTPS and end-to-end payload encryption.

Websites and online providers

When you browse, search or sign in to a website, the TV connects to the selected website or identity provider. They may receive your IP address, browser details, cookies, queries and any information you submit. Their policies govern that information. Google is the default search provider for address-bar text that is not a web address; other engines can be visited directly.

Optional Pexels photography requests images and attribution from Pexels. Pexels receives normal network request information; Vision does not send it your browser history, bookmarks, vault or personal photo albums. Mozilla add-on services, filter-list providers and browser security services may receive network requests needed for uBlock Origin, filter updates and Safe Browsing. Our app catalogue and companion-download pages are hosted using Cloudflare. Website, hosting and provider privacy policies apply to their services.

Optional Android access

The Home-button helper is an optional AccessibilityService. It is not an accessibility tool for disabilities. After the separate in-app explanation and your affirmative consent, you can enable it in Android Accessibility. It detects Home-button presses and current app/package and window-class identifiers to open your chosen Vision Home screen. That metadata is used locally, is not stored or transmitted, and screen content, typed text, passwords and screenshots are not read. You can disable the helper in Android Accessibility and continue using Vision as an ordinary app. Vision does not disable Google TV or casting services.

The optional TV status bar needs Display over other apps access and an ongoing foreground service to show current time, date, network connection and volume. Its preferences stay local. It does not capture other apps' screens. You can turn it off in Vision or revoke overlay access in Android settings.

Smart Remote uses a user-started local-network service and locally stored pairing keys to let an approved phone control TV actions. If you separately grant notification access, Vision queries Android media-session status to report the current media app and whether it is playing to your paired phone; it does not read notification contents. You can stop the remote service, forget paired phones or revoke notification access. There is no cloud remote-control account.

Vision uses internet/network access for browsing and these requested network features. It does not request location, contacts, SMS, call logs or an advertising identifier. Android file pickers allow you to choose files or save downloads without giving Vision broad access to all device storage. Website camera/microphone access is not enabled by the app's permissions.

Retention and deletion

To request deletion of data held by Autosoft for Vision, email admin@autoshujaa.com (also listed at autosoftshujaa.com/contact) with a privacy request naming “Vision: TV Browser & Launcher” and the data or feature involved. Do not send your vault passphrase, saved passwords or full browser export. We can address data we hold; local-only records must be removed on your own TV using the controls below. Third-party website records must be managed with that provider.

Local browser records, downloads, photos and settings remain until you remove them, clear app storage or uninstall, subject to Android's storage behavior. Downloads saved through Android's document picker can remain in your chosen folder and must be deleted there. Vault reset deletes saved vault data. Forget paired phones removes local remote authorisations. Temporary relay sessions expire as described above. We do not keep an Autosoft account-based copy of your browser library, personal photos or vault to restore later. Data submitted to third-party websites must be managed with those services.

Children and updates

Vision is a general-purpose launcher and browser, not a service directed to children under 13. Parents and guardians should supervise web use and use device-level controls as appropriate. We may update this policy when features or data practices change, with an updated effective date.

Contact

For privacy questions or data requests, contact Autosoft Shujaa Solutions Limited at admin@autoshujaa.com or autosoftshujaa.com/contact.