Orb Privacy Policy
Effective November 5, 2026
Orb is a browser for Mac published by Dennis Yilmaz, an individual ("we"). This policy explains what Orb sends over the network, what we keep and for how long, and what stays on your Mac.
The short version
- Orb has no account. There are no ads, and we don't sell your information.
- Your history, cookies, extensions and private windows stay on your Mac.
- Orb contacts our servers for security updates and for the features described below. Crash reports and diagnostics are on by default, and you can turn them off.
- Our web servers keep no access logs, and we don't store your IP address.
- Orb Sync is end-to-end encrypted. We can't read what you sync, and we can't recover it for you.
What stays on your Mac
Orb stores your browsing data on your Mac, including history, cookies, windows, extensions, settings and saved passwords. Saved passwords and site sign-ins are protected by a key kept in your macOS keychain. The content blocker and Orb's anti-fingerprinting protections run on your Mac.
If you import from another browser, Orb reads that browser's data on your Mac. Importing doesn't send it to us. Importing from Safari needs Full Disk Access, which macOS asks you to grant.
What Orb sends, and where
Orb's servers are at services.orb.surf. Every connection to them shows your IP address to the server, as any internet connection does. See "IP addresses and logs" below for what happens to it.
Always on
These keep Orb safe and can't be turned off while you use Orb.
| Feature | What Orb sends | What we keep |
|---|---|---|
| Orb updates | A check of our update feed, and downloads of new versions. The request shows your Orb version. Orb doesn't send a system profile. | Nothing tied to you. |
| Certificate and component updates | The component names and versions on your Mac, plus your macOS type and processor type. | Nothing tied to you. |
| Safe Browsing | Requests for the current malware and phishing lists. If an address you visit looks like a match, Orb sends a short hash of it, not the address. | Nothing tied to you. Responses are held in memory for at most an hour. |
For component updates, our server sends Google a fresh request of its own for only two components: the certificate revocation list and Google's Widevine Content Decryption Module, which lets protected video play. Orb downloads both automatically through our server, without asking first, so Google doesn't see your IP address.
For Safe Browsing, our server removes everything except the request itself, adds its own key, and passes it to Google. Google doesn't see your IP address. If this relay isn't available, Orb relies on the malware and phishing lists in its own blocker.
On by default, with a switch
You can turn these off in Settings, under Privacy.
| Feature | What Orb sends | What we keep |
|---|---|---|
| Extension store proxy | The IDs and versions of extensions from the Chrome Web Store, and requests to download them. | Nothing tied to you. |
| Blocker list updates | A check for newer lists about every six hours, and downloads of those lists. | Nothing tied to you. |
| Bang shortcuts | A download of the !bang shortcut list, at most once each time Orb starts. | Nothing tied to you. |
| Crash reports | See below. | Up to 30 days. |
| Diagnostics | See below. | Daily totals for up to 400 days. |
With the extension store proxy on, our server rebuilds each request before it reaches Google and mixes in other extension IDs, so Google sees neither your IP address nor your list of extensions. With it off, Orb contacts Google directly for these. Either way, browsing the Chrome Web Store itself is a normal visit to Google's website.
Crash reports and diagnostics only start after Orb has shown you their switch.
Crash reports. When Orb crashes or hangs, it can send a report so we can fix the bug. A report includes the state of the program at that moment: parts of its memory, the software modules that were loaded, your Orb and macOS versions, and your processor type.
Before a report leaves your Mac, Orb removes crash details that can carry addresses or personal data, replaces your macOS user name in file paths, and blanks every run of six or more text characters in the memory it captures. Reports carry no device or user ID. Our server drops any field that names a URL, email or user.
This removes most personal information but can't guarantee all of it. Short pieces of text or other data from the moment of the crash may remain. We use crash reports only to fix bugs.
Hang reports from macOS are sent under the same switch. They contain the program's call stack, how long the hang lasted, your Orb and macOS versions, and your processor type.
Diagnostics. Once a day Orb sends counts and timing totals, such as launch time, hangs and internal crash counts, how many times each Orb command and feature was used (such as new tabs, Split View and Orbit), what kind of result you pick in the command bar (never what you typed), rough setup details such as how many Spaces you have in ranges, whether the ad blocker is on and whether Orb is your default browser, and a rough install age such as "under a week", with your Orb version, macOS version and processor type. There are no IDs and no browsing data. Our server adds each report into a total for that day and that combination of versions, and keeps only the total.
If you turn off crash reports or diagnostics, Orb deletes anything waiting to be sent.
Only if you use them
Orb Sync. Sync keeps spaces, tabs, pinned tabs, favorites, folders, splits, Archive, Links rules, Tweaks, appearance and, if you choose, passwords the same across your Macs. There is no account or email address.
Everything you sync is encrypted on your Mac with keys we never receive. Your device names are encrypted too. The server stores only:
- the encrypted data
- your sync group's public key and each device's public key and ID
- the type of each record, such as "tabs" or "logins", and its size, version and the time it changed
- the day each device was added and last seen
The server can see from this how much you store and how often you sync, but not what it is. While two Macs pair, a short code and encrypted keys are held in memory for up to five minutes.
Your recovery key is 24 words. Anyone who has it can read your synced data. We don't have it and can't replace it.
Encrypted data stays on the server until you delete it, or until no Mac in your sync group has connected for a year, when we delete the group. Removing the last Mac from your sync group deletes the group and everything in it. Deleted items are erased from the server after about 30 days, once your other Macs have seen the deletion.
Tweaks Gallery. Opening the gallery downloads the whole list of Tweaks, and searching and installing happen on your Mac, so the server doesn't learn which Tweak you pick.
If you publish a Tweak, it becomes public, including its site, title, description and content. Our server also keeps an ID key created by your copy of Orb, so that only you can update or delete the Tweak. That key isn't shown publicly. Don't put personal information in a Tweak.
If you report a Tweak, we keep your reason and any note you write until a moderator restores or deletes the Tweak. We don't store who sent it.
Feedback. Help > Send Feedback sends only what you type, the email address you add for a reply, if any, and, if you leave its box checked, your Orb version, macOS version and Mac type (Apple silicon or Intel). Nothing is sent until you press Send. We use feedback to fix bugs and improve Orb, and to reply if you gave an email address. We keep it for up to 180 days, then delete it.
Connections that don't involve us
Using a browser means connecting directly to other people's servers. We don't see these connections, and each service has its own privacy policy.
- Websites you visit see your IP address and whatever you send them, as in any browser. Orb tells sites you don't want your data sold or shared by sending the Global Privacy Control signal.
- Your search engine receives what you search for. DuckDuckGo is the default, and you can pick another in Settings. Search suggestions are off by default. If you turn them on, what you type goes to your search engine as you type.
- DNS. Unless you choose a provider, Orb uses your network's DNS, encrypted when your network supports it. If you choose a provider, it sees which sites you look up.
- Extensions can see what their permissions allow. Extensions that come from outside the Chrome Web Store update directly from their developers.
IP addresses and logs
Our web servers are set up to write no access logs and to strip addresses, request details and headers from error logs. Our services log only totals, such as how many requests of a type were served, and never single requests.
To stop abuse, some services count requests per address. They use a keyed hash of your IP address, held only in memory, with a key that is discarded when the server restarts. We don't store your IP address with crash reports, diagnostics, Sync data, Tweaks or feedback.
Our hosting provider carries this traffic and can see network connections to our servers.
When our servers fetch data from Google or from blocker list publishers, they send fixed requests of their own and pass on none of your headers, cookies or addresses.
Using your own server
Orb can be configured to use a server you choose for its optional services and for Sync. That server's operator then handles what those features send. Security updates, the Tweaks Gallery and feedback always use services.orb.surf.
Why we use this information
| Purpose | Our legal basis in the EEA and UK |
|---|---|
| Keeping Orb and its users safe: updates, certificate data, Safe Browsing | Legitimate interests |
| Running features: extension proxy and blocker lists | Legitimate interests |
| Sync and the Tweaks Gallery | Providing the service you asked for |
| Moderating Tweaks and preventing abuse | Legitimate interests |
| Crash reports and diagnostics | Legitimate interests |
| Reading and answering feedback you send | Legitimate interests |
We don't sell personal information, share it for advertising, or use it for automated decisions about you.
Who handles it
- Hosting: Hetzner Online GmbH, Germany, in its Falkenstein data centre.
- Software and data providers: Google and blocker list publishers receive our servers' own requests, as described above, and none of your personal information.
We may disclose information if the law requires it. Because of the way Orb is built, we hold very little: we can't identify you from it, and we can't read Sync data.
Where it is held
Our servers are in Germany. We are based in the United States and may access them from there, so information on them can be accessed from the United States.
How long we keep it
| Data | How long |
|---|---|
| Crash and hang reports | 30 days, or sooner if storage fills |
| Diagnostics totals | 400 days |
| Sync data | Until you delete it, or after a year with no Mac connecting |
| Deleted Sync items | About 30 days |
| Pairing codes | Up to 5 minutes, in memory |
| Published Tweaks | Until you or a moderator delete them |
| Tweak reports | Until the Tweak is restored or deleted |
| Feedback | Up to 180 days |
| Rate-limit hashes | In memory, until the server restarts |
Your choices and rights
You can turn off each optional service in Settings, under Privacy. You can delete Sync data by removing your Macs from Sync, and you can delete a Tweak you published from Orb.
Depending on where you live, you may have the right to ask for access to your personal information, to correct or delete it, to restrict or object to its use, to receive a copy, and to withdraw consent. People in the EEA and UK can also complain to their data protection authority. To use these rights, contact us below.
We have no account linked to you, so we usually can't find data about a particular person. For a crash report, give us its report ID if you have it. We won't treat you differently for using your rights.
Children
Orb isn't directed at children under 13, and we don't knowingly collect their personal information. If you think a child has given us personal information, contact us and we'll delete it.
Security
Connections to our servers use TLS 1.3, and updates are signed so Orb can check them. Sync is end-to-end encrypted. No system is perfectly secure. To report a problem, see Orb's Security Policy.
Changes
We'll post any new version of this policy with its effective date. If a change materially affects you, we'll say so in Orb or on our website first. A new optional Orb service stays off until you allow it.
Contact
Dennis Yilmaz
orb@denni.sh