VulpineOS
Docs
Runtime
Runtime overview
Hardened browser, orchestrator, MCP
Injection filter
Strip invisible DOM before the agent
Action lock
Freeze JS, timers, reflows mid-think
Optimised DOM
93.1% measured token reduction
Operator surfaces
Web panel
Embedded operator console
TUI workbench
SSH-friendly terminal UI
MCP toolbelt
36 typed browser tools
Vulpine-Box
One-container self-host
Ecosystem
Foxbridge
CDP ↔ Juggler / WebDriver BiDi
vulpine-mark
Set-of-Mark visual labelling
mobilebridge
Android device sessions
OpenClaw
Pre-configured agent loop
Documentation
Quickstart
First agent in 30 seconds
Architecture
Four-phase security model
MCP Reference
All 36 browser tools
Agent Scripting DSL
Declarative agent definitions
Open source
VulpineOS Runtime
GitHub, MPL 2.0
Foxbridge
CDP ↔ Juggler / WebDriver BiDi
vulpine-mark
Set-of-Mark visual labelling
mobilebridge
Android device discovery + sessions
Integrations
OpenClaw
Pre-configured agent loop
Camoufox
Anti-detect browser core
LLM providers
30+ models, one toolbelt
Docker (Vulpine-Box)
One-click self-host
Guides
AI Agent Security
Threat model, mitigations
Prevent Prompt Injection
Hidden DOM, ARIA tricks
OpenClaw + Camoufox
End-to-end setup
Camoufox vs Chrome
Why Firefox, why patches
Engineering
Changelog
Release notes as work lands
Roadmap
Now, next, later, research
Blog
Long-form posts on the runtime
RenderLab
Optional render-diagnostics study
Community
Support
How to get help, fast
GitHub Discussions
Ideas, RFCs, support
Contributing
How to help
Security
Responsible disclosure
Star on GitHub →
Legal · Last updated 9 May 2026

Privacy Policy

What VulpineOS collects, the lawful bases under UK GDPR, the processors we share data with, retention windows, and your rights — including how to ask for deletion.

01

Who we are

For the purposes of UK GDPR, the data controller for vulpineos.com, auth.vulpineos.com, admin.vulpineos.com, and related services is Flippify Ltd, trading as VulpineOS, a company registered in England and Wales under company number 16548611, with registered office at 61 Bridge Street, Kington, United Kingdom, HR5 3DJ.

We have not appointed a Data Protection Officer because we are not required to under UK GDPR Article 37. The point of contact for data-protection matters is privacy@vulpineos.com.

02

Data we collect

From the waitlist form

Name, email address, GitHub handle, LinkedIn profile URL, optional Twitter / X handle, the interests you select, and the optional free-text message you submit.

From operator-console accounts

For operator accounts: a username, password hash held by our auth provider, an opaque session cookie, and any data you write while using the console (admin notes, content edits to the public roadmap and changelog).

Automatically

Standard request metadata (IP address, user-agent, timestamp), and — when you have accepted cookies — analytics data via Google Analytics. Server logs are retained for short windows for security and reliability.

From public profiles

We may publicly view the GitHub, LinkedIn, or Twitter / X profiles you provide to confirm context and shipping signal during waitlist review. We do not log in to private surfaces or scrape protected endpoints.

From RenderLab research

If, and only if, you explicitly consent at /research/renderlab in desktop Firefox, we collect anonymised render diagnostics, including controlled probe outputs generated by that page. Full scope, retention, and revoke flow live on that page. RenderLab does not collect cookies, account data, browsing history, page contents, screenshots, localStorage / sessionStorage contents, passwords, or tokens.

03

How we use your data

We use the data described above to operate the waitlist (review fit, decide access, contact applicants), to run the operator console, to improve the site and runtime, and to send infrequent updates to people who have opted in.

We will not sell your data, share it with advertisers, or use it to train AI models. (Vulpine RenderLab — described separately on /research/renderlab — is browser-render diagnostics research, not model training.)

04

Lawful bases (UK GDPR)

  • Consent — for cookies-based analytics, marketing emails, and RenderLab diagnostics. You can withdraw consent at any time.
  • Legitimate interests — for waitlist review, security logging, fraud prevention, and product improvement that does not override your rights.
  • Contract — for operator-console accounts and any related service we provide to invited users.
  • Legal obligation — where we must retain or disclose data to comply with applicable law.
05

Subprocessors

We use a small number of third parties to operate the service. The current list is published at /legal/subprocessors and is updated when we add or remove a processor.

06

International transfers

Some of our subprocessors operate outside the UK / EEA. Where transfers occur, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision in force at the time of transfer. The current location of each processor is listed on the subprocessors page.

07

Retention

  • Waitlist data — until you request deletion, or until 24 months of inactivity.
  • Operator-console accounts — for the life of the account, plus 30 days.
  • Cookie / analytics data — Google Analytics retention is set to 26 months.
  • Server access logs — up to 90 days.
  • RenderLab diagnostic runs — retained for the duration of the active research project, and in any case for no longer than 24 months from collection. Revoking consent prevents further runs from being attributed to you and clears the local participant id; you can request deletion of submitted runs by emailing privacy@vulpineos.com.
  • Email logs — up to 12 months.
08

Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you.
  • Correct data that is inaccurate or incomplete.
  • Erasure of your data (subject to legal exceptions).
  • Restrict or object to certain processing.
  • Data portability for the data you provided.
  • Withdraw consent at any time, where consent is the lawful basis.
  • Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) if you believe your data has been mishandled.

To exercise any of these rights, email privacy@vulpineos.com.

09

Cookies

We use cookies for site analytics, gated behind explicit consent. The full cookie policy lives at /legal/cookies, including how to change your decision later.

10

Agentic emails

We may send personalised emails to waitlist applicants, drafted with the help of information you have provided and information from your public profiles. Drafts are reviewed by a human before sending.

11

Children

The service is not intended for children under 13 and we do not knowingly collect data about them.

12

Changes

Updated versions of this policy are posted with a new "last updated" date at the top of the page. Material changes will be flagged on the homepage and, where appropriate, notified by email.

13

Contact

Privacy queries: privacy@vulpineos.com. Other queries: support@vulpineos.com.

See also
  • Terms of Service
  • Cookies
  • Acceptable use
  • Subprocessors
  • Security
VulpineOS

The browser built for AI agents.
Open-source runtime, end to end.

Camoufox 146.0.1
Product
RuntimeAction lockOptimised DOMMCP toolbeltVulpine-Box
Ecosystem
Foxbridgevulpine-markmobilebridgeOpenClawCamoufox
Resources
Resources hubRoadmapChangelogBlogDocs
Community
SupportDiscussionsContributingIssuesSecurity
© 2026 VulpineOSBuilt on Camoufox · Firefox 146.0.1TermsPrivacyCookiesAcceptable useSecurity