Privacy Policy

Effective date: 20 September 2026
Applies to: this build of Private Browser AI for iOS 18 and later on iPhone and iPad
Last updated: 20 September 2026

This policy describes this software build. It is written in plain language so you can see what the app actually does. It is not legal advice, has not been reviewed by counsel, and is not a guarantee of anonymity, unhackability, or “complete security.”

If a later version of the app changes how data is handled, this document will be updated and the in-app copy will change with it. The in-app Settings → About → Privacy Policy is the copy bundled with the binary you installed.

1. Plain-language summary

Private Browser AI is a WKWebView browser with an optional on-device assistant. There is no account. There is no product cloud of ours. There is no analytics SDK. Tracking is off.

• Default AI policy is Never Use Cloud. Page text is not sent to a commercial model provider unless you change that policy, add a key you control, and authorize the session.
• History, bookmarks, notes, chats, embeddings, downloads, and local model files stay on the device (with the exceptions in §6).
• Websites you visit still see you as a browser on a network. Private Mode reduces local traces. It does not hide you from sites, your ISP, or the websites’ servers.
• We do not sell personal information. This build does not operate an advertising network and does not use an advertising identifier.

“We” and “the developer” mean the person or organization that publishes this app. This build does not include a developer backend that receives your browsing.

2. Who processes data

This app does not operate a VPN network and does not run a proxy that your traffic is forced through.

3. App Privacy nutrition labels (this binary)

These statements match PrivacyInfo.xcprivacy in this build:

• Data Not Collected. The privacy manifest lists no collected data types.
• Tracking is off. NSPrivacyTracking is false. There are no tracking domains. There is no advertising identifier and no third-party analytics SDK in this binary.
• Required-reason APIs used on-device only: UserDefaults (CA92.1), file timestamp (C617.1), disk space (E174.1), system boot time (35F9.1).

If Apple’s App Store nutrition labels are published, they should match this section. If they ever diverge, treat the shipped privacy manifest and this policy as the description of the binary, and contact the developer through the store listing when one exists.

4. Information that stays on your device

Unless you export it or send it yourself, the following is stored locally with iOS Data Protection:

• Browser tabs, history (if you leave history enabled), bookmarks, folders, and tags
• Downloads you save
• Reader snapshots / saved pages you choose to keep
• Notes, collections, spaces, tab groups, research projects
• Assistant conversations you allow to be saved
• Opt-in assistant memory items (encrypted at rest)
• Local embeddings / semantic index only if you enable indexing
• Prompt-injection log entries
• Site permissions you grant or deny
• Network transparency log of destinations this app contacted (not a full packet capture)
• Settings, including cloud policy, search engine, and model roles
• Downloaded GGUF model files (excluded from iCloud Backup)
• Encrypted backup archives you create (files you choose to save or share)
• Crash-recovery flags in UserDefaults (tab counts, not page URLs)
• Home Screen widget configuration (deep links to Search / Private tab / Ask AI — not Private Mode URLs or history)

The SwiftData store and model directory are excluded from iCloud Backup. Downloads remain in Documents so you can export them through Files.

Keychain is used for secrets such as encryption keys, optional API keys, and an optional Kagi token. Items use WhenUnlockedThisDeviceOnly (or equivalent device-bound accessibility) in this build.

Passwords for websites use system AutoFill / iCloud Keychain. This app does not keep a password vault for the assistant and does not give page passwords to the model.

5. Information we do not collect

This build does not run a developer telemetry pipeline. We do not collect, on a server of ours:

• Your name, email, or phone number (there is no account)
• Advertising identifiers
• Precise location for the developer (sites may still request location from you)
• Analytics events, funnels, or A/B flags
• Full browsing history uploaded “for improvement”
• Microphone, camera, or speech audio uploaded to us
• Contacts, photos, or Health data for our servers

If you never leave the device, the developer of this app does not receive a copy of what you browse.

6. Information that leaves the device

Leaving the device is normal for a browser. It is not the same as “we collect it.”

6.1 Web navigation

When you open a URL, your device performs ordinary HTTPS (or, if you allow it, other) requests to that host. The site may set cookies, see your IP address, user agent, and whatever the page loads (scripts, ads, trackers on that site). This app applies:

• HTTPS-Only upgrades for public http URLs (localhost and RFC1918 are left as-is so you can reach a machine you own)
• Optional stripping of common tracking query parameters (utm_*, fbclid, gclid, and similar)
• A limited WKContentRuleList plus WebKit tracking prevention — not a full-content blocker such as uBlock Origin
• Global Privacy Control and DNT signals you can enable, which ask sites to respect privacy; sites may ignore them

6.2 Search

The query you type into search is sent to the engine you selected. Default is DuckDuckGo. Private Mode can force DuckDuckGo. A bang (for example !w) may send you to a third-party site. Optional Kagi search may attach a token you stored, only on kagi.com URLs.

6.3 Model downloads

Catalog downloads (for example Qwen2.5 Instruct GGUF from Hugging Face) occur only when you tap Download. The request includes a product user agent. Files are checked for the GGUF magic header; invalid files are deleted. Model licenses (Apache 2.0, Gemma License, and others) are shown in Model Manager and are your responsibility to review.

6.4 Optional cloud or private-network AI

Default execution mode is local-only. If you set policy to allow cloud or a private-network OpenAI-compatible / Ollama endpoint:

• You must store an endpoint and, if required, a key
• You must authorize the session when policy requires it
• Prompts, page extracts you include, and conversation context will leave the device to that endpoint
• The network transparency log records that the app contacted that host

Turn the policy back to Never Use Cloud to stop. Keys remain in Keychain until you delete them.

6.5 Apple on-device intelligence

On supported hardware and OS versions (Apple Intelligence / Foundation Models, typically iOS 26+ where Apple makes them available), generation can run on-device via Apple’s system frameworks. This app’s default is still Never Use Cloud: it does not send those prompts to Private Cloud Compute or a developer server. Apple’s own system privacy rules apply to Apple’s frameworks.

6.6 llama.cpp / GGUF

On a physical iPhone or iPad, this build can load a GGUF you downloaded and generate on-device (Metal, then CPU fallback). Simulator builds cannot link the XCFramework (no iOS Simulator slice) and will not run GGUF inference. Weights are never bundled in the App Store binary.

6.7 Share extension, widgets, Spotlight

• Share-in writes a local inbox file, then the app imports it on-device.
• Widgets open deep links (privatebrowserai://). They never encode Private Mode URLs or history.
• Spotlight may index bookmarks you saved, not history and not private tabs.

6.8 Encrypted backup

Backup is a local file you export (passphrase or device-key formats). Restore refuses archives that claim to be iCloud data. You choose whether that file is copied to Files, AirDrop, or another device. That is not an iCloud sync product.

6.9 Background tasks

Opportunistic BackgroundTasks may refresh page or price monitors you created. They run on-device when iOS allows; they cannot run continuously. They do not upload those snapshots to us.

7. Permissions the system may ask for

Usage strings exist because websites or optional device features can request them. Denying a prompt is supported.

The assistant does not get silent access to camera, microphone, or location for “training.”

8. Private Mode

Private Mode uses a non-persistent website data store, skips history / chats / embeddings / memory writes, can force DuckDuckGo, and can close private tabs on exit. App-switcher blur can hide the preview.

Private Mode is not anonymity, not Tor, and not a VPN. Destinations you visit still see a network request from your IP address (or whatever path your device already uses, such as iCloud Private Relay if you enabled it in system settings).

9. Children

This app is a general-purpose browser. It is not directed at children under 13 (or the equivalent age in your country). We do not knowingly collect personal information from children on a server of ours because this build does not collect personal information on a server of ours. If a child uses the browser, websites they visit have their own policies. Parents should use iOS Screen Time and system restrictions as they would with Safari.

10. Automated decision-making and AI outputs

On-device or optional remote models may summarize, compare, or extract text you provided. Outputs can be wrong, incomplete, or biased. Page-grounded actions are designed to stay extractive; they are not professional, legal, medical, or financial advice. You remain responsible for what you do with answers and with sites you visit.

The agent requires preview and confirmation for browser tools. It will not bypass CAPTCHAs, paywalls, DRM, or site security. It will not submit purchases for you.

Prompt-injection defenses split untrusted page text from system instructions and can freeze website interaction after blocked patterns. No filter is perfect.

11. Retention, deletion, and your controls

Because the store is on-device, you already hold the data.

You can:

• Clear history, cookies / site data, chats, memory, embeddings, and downloads from Settings
• Delete a downloaded model (the runtime unloads it)
• Delete an encrypted backup file you created
• Remove optional API keys from Keychain via Settings
• Reset the local database from launch recovery (models and downloads are left in place unless you delete them)
• Delete the app, which removes its container (Keychain items may persist until you uninstall according to iOS behavior; delete keys in Settings first if you want them gone)

There is no developer dashboard where we can “see your history,” because it is not uploaded to us.

If a privacy law (for example GDPR or CCPA) gives you rights against a service that collects personal information, those rights still apply to websites and optional endpoints you use. Against the developer of this build, the practical equivalent of access and erasure is: look at Settings, export if you wish, then delete.

12. Sale, sharing, and “selling” under CCPA / CPRA

We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not operate a data broker. Optional third parties in §2 receive data only because you navigated, searched, downloaded, or enabled an endpoint.

13. International transfers

This app does not host your browsing on a developer server, so we do not transfer a profile of you to another country. Your device, Apple’s systems, and any site or API you contact may be anywhere on the network. Those parties’ policies apply.

14. Security

We use platform Data Protection, Keychain, encrypted memory values, HTTPS-Only defaults, and local encryption for backup files. No consumer app is unhackable. A person with your unlocked phone, a compromised website, malware, a backup file you copied, or a cloud endpoint you enabled can still expose data. Protect the device with a passcode, enable App Lock if you want it, and treat backups as sensitive.

15. Third-party terms

WebKit, Swift, SwiftUI, SwiftData, CryptoKit, NaturalLanguage, Vision, Speech, llama.cpp (MIT), and downloaded model licenses are described in Licenses in the app. Hugging Face, DuckDuckGo, Kagi, Apple, and any cloud vendor you add have their own terms and policies.

16. Do Not Track / GPC

You can send DNT and Global Privacy Control headers. They are signals, not enforcement.

17. Changes

Material changes will update this document and the bundled in-app copy, and may appear in What’s New. Continued use after an update you installed means that build’s policy applies. Because there is no account, we cannot email you.

18. Contact

This build has no user account and no in-app support inbox. When the app is available on the App Store, use that listing’s support / privacy contact. Until then, Settings → About, this policy, and the Terms of Use bundled with the app are the description of this build.

For websites you visit, contact that site. For Apple services, contact Apple. For a cloud endpoint you configured, contact that provider.

19. What we do not claim

• Not anonymous
• Not a Tor browser
• Not an app-operated VPN
• Not a full-content blocker
• Not counsel-reviewed legal advice
• Private Mode ≠ hiding from the network
• Demo mode is not a real model
• Cloud AI is optional, confirmed, and off by default