How Orb keeps you safe.
Orb is built to block what you didn’t ask for, send as little as it can, and say plainly what it does send. This page covers the defaults, our server, Sync’s encryption and how the app is signed and updated.
- Filter lists on from the first launch
- 38
- Servers Orb contacts on its own
- 1
- Access logs on that server
- 0
- Accounts to create
- 0
Blocked before it loads.
A blocker is built into Orb and runs on your Mac. There’s nothing to install.
38 lists, on from the start
Orb’s blocker uses the open-source adblock-rust engine. 38 of the 70 lists in Orb’s catalogue are on from the first launch, including EasyList, EasyPrivacy, uBlock filters, AdGuard and Peter Lowe’s list. The rest, such as regional lists, are a switch away.
Inside the page too
Many ads that slip into a page are hidden as they appear, and so are many cookie banners, newsletter pop-ups and chat widgets.
Trackers in disguise
Some trackers hide behind a site’s own subdomain. With secure DNS on, Orb looks up a subdomain’s real name and blocks it if that’s a known tracker.
Malicious and phishing sites
Malware and phishing lists in the blocker, plus Google Safe Browsing through Orb’s relay, show a warning page before known bad sites load. Google doesn’t see your IP address.
Fresh lists
Orb checks for newer lists about every six hours, from Orb’s own mirror. You can turn updates off in Settings.
One site at a time
If a site breaks, open Site Controls in the address bar and turn blocking off for that site alone.
Harder to follow.
Defaults that make it harder for sites to recognise you from one visit to the next.
Fingerprinting
Canvas, WebGL, audio and font checks get slightly altered answers. The key behind them lives only in memory, so it changes every time you open Orb, differs from site to site, and private windows get their own.
Tracking tags
Orb strips click identifiers such as fbclid, gclid, msclkid and mc_eid from the addresses you open, before the request leaves your Mac.
Global Privacy Control
Every site you visit is told you don’t want your data sold or shared.
No guessing ahead
Orb doesn’t preload pages it thinks you’ll open, and search suggestions are off until you turn them on.
HTTPS first
Orb upgrades sites to HTTPS where it can, and warns you before most sites that only offer an unencrypted connection.
Encrypted DNS
Orb uses your network’s DNS, encrypted when the network supports it. Or choose Cloudflare, Quad9 or NextDNS in Settings.
WebRTC
Orb keeps pages from using WebRTC to learn your local network addresses, and limits it further in private windows to keep your IP address from the other end of a call.
It stays on your Mac.
Orb has no account, no ads, and doesn’t sell your information.
Your browsing data
History, cookies, open windows and extensions are stored on your Mac and aren’t synced. Private windows don’t keep history or cookies after you close them.
Saved passwords
Passwords and site sign-ins are encrypted with a key kept in your macOS keychain, under the name Orb Safe Storage.
Importing
When you import from another browser, Orb reads that browser’s data on your Mac. None of it is sent to us.
Search
DuckDuckGo is the default search engine. Your searches go to the engine you choose, not to Orb.
What Orb sends, and what we keep.
Everything Orb sends on its own goes to services.orb.surf. The privacy policy has the full detail.
| Feature | What Orb sends | What we keep |
|---|---|---|
| Orb updates | A check of the update feed, and downloads of new versions. The request shows your Orb version, and no system profile. | Nothing tied to you |
| Certificate and component updates | Component names and versions, your macOS type and processor type. Our server asks Google for the certificate revocation list and Widevine on your behalf. | Nothing tied to you |
| Safe Browsing | Requests for the current malware and phishing lists. If an address looks like a match, a short hash of it, never the address. Our server passes it to Google without your IP address. | Nothing tied to you; answers held in memory for up to an hour |
| Feature | What Orb sends | What we keep |
|---|---|---|
| Extension store proxy | The IDs and versions of your Chrome Web Store extensions, and their downloads. Our server rebuilds each request and mixes in other IDs, so Google sees neither your IP address nor your list. | Nothing tied to you |
| Blocker list updates | A check for newer lists about every six hours, and their downloads. | Nothing tied to you |
| Crash reports | The program’s state at the moment of a crash or hang. Your user name and runs of six or more characters of text are removed first, and there’s no device or user ID. | Up to 30 days |
| Diagnostics | Once a day: counts and timings, such as launch time and how often each feature is used, never what you typed or visited, and no IDs. | Daily totals, for 400 days |
| Feature | What Orb sends | What we keep |
|---|---|---|
| Orb Sync | Your synced data, encrypted on your Mac with keys we never receive, plus the public keys and timestamps listed below. | Until you delete it, or after a year with no Mac connecting |
| Tweaks Gallery | Browsing downloads the whole list, so we don’t learn which Tweak you pick. A Tweak you publish is public. | Published Tweaks, until you or a moderator remove them |
Sync the server can’t read.
There’s no account or email address. Your recovery key is the only key, and it never leaves your Macs.
Encrypted before it leaves
Each record is sealed with ChaCha20-Poly1305 using keys derived from your 24-word recovery key. Device names are encrypted too, and record IDs are replaced by keyed hashes.
Every request signed
Each Mac has its own Ed25519 key, and the server accepts changes only when they’re signed by a Mac in your group. Removing a Mac stops it syncing straight away.
Pairing
Adding a Mac uses a fresh X25519 key exchange. The six-digit code only lets the two Macs find each other, and both show the same check words before the key is shared.
What the server sees
The encrypted data, your group’s and devices’ public keys, each record’s type, size, version and time, and the day each Mac was added and last seen. That shows how much you store, not what it is.
If you lose every Mac
Your recovery key is the only way back. We don’t have it and can’t reset it, so write it down and keep it private: anyone with those 24 words can read your synced data.
Our server.
One server, services.orb.surf, at Hetzner in Falkenstein, Germany.
No access logs
The web server is set up to write no access log and to strip addresses, request details and headers from its error log. Our services log only totals, not single requests.
Your IP address
To stop abuse, some services count requests using a keyed hash of your IP address, held only in memory with a key that’s thrown away on restart. We don’t store it with crash reports, diagnostics, Sync data or Tweaks.
Requests of its own
When our server fetches from Google or from blocker list publishers, it sends fixed requests of its own and passes on none of your headers, cookies or addresses.
TLS 1.3 only
Connections to services.orb.surf use TLS 1.3, and updates are signed so Orb can check them.
This website
orb.surf sets no cookies, runs no analytics and loads nothing from anyone else, not even fonts.
Your own server
Optional services and Sync can use a server you run instead. Updates and the Tweaks Gallery always come from services.orb.surf.
The app itself.
Checked for the security report of November 3, 2026, with commands you can run yourself.
Signed and notarized
Orb is signed with Dennis Yilmaz’s Developer ID and notarized by Apple, which scans every submission for malware. Every program inside runs with Apple’s hardened runtime.
Nothing in the background
No launch agents, login items, background daemons, privileged helpers or system extensions.
Sandboxed pages
Web pages run in Chromium’s macOS sandbox, with certificate and web security checks on.
Signed updates
Orb updates itself with Sparkle. Each update is signed with an EdDSA key, and Orb installs only updates signed with the key it ships with.
Regular security fixes
Orb follows Chromium’s security releases and ships their fixes in regular updates.
Check it yourself
Once Orb is in Applications, macOS can tell you who signed it and whether Apple notarized it.
spctl -a -vv /Applications/Orb.app
/Applications/Orb.app: accepted source=Notarized Developer ID origin=Developer ID Application: Dennis Yilmaz (7VA9646HSG)
codesign --verify --deep --strict --verbose=2 /Applications/Orb.app
/Applications/Orb.app: valid on disk /Applications/Orb.app: satisfies its Designated Requirement
Found a problem?
Please tell us privately first.
Write to orb@denni.sh
Include what you found, your Orb and macOS versions and steps to reproduce it. We’ll confirm we’ve received it within 5 business days. We ask for 90 days before you publish, or until a fix ships if that’s sooner, and research in good faith under the policy is welcome.
Security Policy
Scope, disclosure and safe harbour.
Security report
What was checked, and how to check it yourself.
security.txt
The contact in the standard machine-readable form.
Privacy Policy
Every item Orb sends, and how long it’s kept.
Browse with less behind you.
Free for Macs with Apple silicon on macOS 14 or later.