Privacy policy

Version 3.0 · Effective 6 November 2026 · Last updated 6 November 2026

The short version. The Tao Browser app has no account, no telemetry, no analytics, and no crash reporting. Your browsing data stays on your device (Mac, iPhone, iPad, or Android). This website (not the app) uses Google Analytics, through Google Tag Manager, to count visits and downloads. In the EU, EEA, UK, Switzerland, and India it stays off unless you click “Allow”; elsewhere it is on unless you click “Decline”; and it is always off if your browser sends Global Privacy Control or Do Not Track. Change your choice anytime with “Cookie settings” at the bottom of every page. If you join our beta email list, we keep your email address (plus, only if you choose, a founder-circle tick and the invite code you arrived with), ask you to confirm before sending updates, and delete it whenever you ask. We never sell or share personal data.

Hostao L.L.C (“Hostao”, “we”, “us”) respects the privacy of the people who use our products and complies with the data protection laws that apply to us, including the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the CPRA (CCPA), and for users in India, India's Digital Personal Data Protection Act 2023 (DPDP Act). Wherever you live, we give you the same core rights described in section 10. This policy covers the Tao Browser apps for macOS, iPhone and iPad (iOS/iPadOS) and Android (together, the “App”), the website tao.hostao.com (the “Site”), in-app feedback, and the beta updates email list (the “List”).

1. Definitions

“Personal data” means any information that identifies you, or can be linked to you, such as your email address or IP address. “Processing” means anything done with personal data, such as collecting, storing, or deleting it.

2. Who is responsible

Hostao L.L.C, a Wyoming (USA) limited liability company, is the controller (in India, the “data fiduciary”) for the personal data described here. Hostao is a US company. For any privacy question or request, write to privacy@hostao.com. Users in India can also reach our Grievance Officer at grievance@hostao.com (see section 12).

3. The App

We do not collect personal data through the App. It has no account, no sign-in, no analytics, no telemetry, no advertising identifiers, and no crash reporting. If we ever add crash reporting, it will be off by default, anonymized, opt-in, and described here before release.

Suggestions from the makers. Tao may show one suggestion for other products by its makers on the New Tab page. You can turn it off. No data is collected. It is one small card on Tao's own New Tab page (never on websites, in search results, in Private windows, or in locked spaces), shown at most once a day and only after a few days of use. It uses no tracking, no advertising identifier and no network request: the list is built into the App and the counters stay on your device. Switch it off in Settings (“Hide suggestions”) or with “Turn off suggestions” on the card. Nothing is sent to us when you see, dismiss, or ignore it; only if you click “Learn more” does a normal tab open a page of that product (hostao.com, createautochat.com, or ratinge.com).

Your history (including the searchable history list), tabs, bookmarks, cookies, website logins, downloads, imports, and settings are stored only on your Mac, inside your macOS user account. Each space keeps its own separate cookies and website storage. Secrets such as your AI API key are stored in the macOS Keychain. We have no copy and cannot see any of it. You can delete it at any time by clearing a space's website data or removing the App and its data folder.

Passwords. Passwords you save in the App are stored in your macOS Keychain on your Mac and are never sent to us. If you run the breach check, the App sends only the first 5 characters of a SHA-1 hash of the password to the Have I Been Pwned service (k-anonymity), which cannot work out the password from it; see its privacy policy. Importing a password CSV file happens on your Mac.

Extensions. If you install a web extension, it runs with the permissions you approved when installing it and may process the pages it is allowed to access. The extension developer, not Hostao, is responsible for what the extension does with data, under its own policy. Extensions never run in private tabs.

Importing from Arc or other browsers reads files on your Mac and writes the result into the App's local storage. Nothing is uploaded.

Update checks (Mac). Once a day, and when you choose Check for Updates, the Mac App downloads the public update feed from tao.hostao.com (the open-source Sparkle updater). The request carries only what any download does (your IP address, the App version in the user agent, the time). Sparkle's system-profile sending is switched off, and we keep no log of these requests beyond Cloudflare's standard security processing (section 4).

Extensions (Mac, iPhone, iPad). When you add an extension from the Tao Extensions gallery, the App downloads it straight from its publisher's official release page (for example github.com), checks it against the exact version we reviewed, and installs it on your device. While you have at least one gallery extension, the App also downloads our signed public extension list from tao.hostao.com once a day (and when you choose Check for Updates) so it can install reviewed updates. These requests carry only what any download does (IP address, the time, a generic “TaoBrowser” user agent) and nothing about your browsing. Extensions you add run on your device under their own publishers' privacy policies; they never run in private tabs, and removing one also deletes its data. The Android app has no extensions and makes no such requests.

In-app feedback (Mac). If you open Send Feedback (⇧⌘F) and click Send, the App sends your message to tao.hostao.com, together with the App version, build, macOS version, and processor type. Your email address and the address of the current page are included only if you type the email or tick the box. We store the message in our Cloudflare D1 database and email a copy to our support mailbox, so we can read and answer it. We do not store your IP address with it. We keep feedback for up to 12 months and then delete it. Nothing is sent unless you click Send.

Translate (Mac, optional). If you choose to translate a page, the App opens the page address in Google Translate, which then processes it under Google's privacy policy.

Agent bridge (Mac, optional, off by default). If you switch it on, a local AI agent you run yourself can control a separate Agent space over a connection that only works on your own Mac (127.0.0.1), protected by a token in your Keychain. Nothing goes to us. It cannot read your saved passwords or cookies, and it only sees the spaces you choose to share with it. Whatever your agent does with page content is governed by that agent and its AI provider, not by Hostao.

Websites and search. Like any browser, the App connects directly to the websites you open and to the search engine you choose (DuckDuckGo by default). Those services receive your IP address and the requests your browser makes, under their own privacy policies. The built-in content blocker applies EasyList and EasyPrivacy rules on your Mac; nothing about the pages you visit is sent to us or to the list authors.

Site Watch (optional, off by default). If you turn it on and list your own sites, the App checks them from your device: a short request to each site (status and its security certificate) and a lookup of the domain's expiry date with the domain's registry (RDAP, found through IANA's public list). The registry can see which domain was looked up, as with a whois lookup. Results stay on your device. Nothing goes to us.

Wrong-Account Guard and Company Cards. On Gmail and Google apps, Outlook / Microsoft 365 and Zoho Mail, the App reads only the signed-in account's e-mail address shown on the page, never your mail, to warn you when it belongs to another space. The list of which account belongs to which space and your Company Cards (company name, address, and tax numbers) are stored only on your device: Company Cards are in the Keychain on Mac and in a file with complete data protection on iPhone/iPad. Nothing goes to us.

The AI panel (optional, Mac)

The AI panel does nothing until you click one of its actions or ask a question. Only then does the App send the visible text of the current page and your question to the AI provider you chose, using your own API key ("bring your own key"). The request goes directly from your Mac to that provider. We (Hostao) run no AI server and no proxy, we never see the page text, your question, the answer, or your key, and the App logs and counts nothing about your AI use. The first time you use each provider, the App tells you where the text will go and asks before sending anything.

Your keys are stored only in the macOS Keychain on that Mac. They are not synced to iCloud Keychain or anywhere else, and each one is sent only to its own provider. You can give a space its own key and provider (for example, one company's OpenAI key in that company's space). Your provider choices are stored in the App's settings on your Mac.

The AI panel never runs in private tabs, and it never sends a site you marked “Never send” or “Confidential”.

Providers you can choose. Each one processes what you send under its own terms, and your relationship with it is direct:

• Google Gemini (default): Gemini API Additional Terms, Google Privacy Policy. On Google's free (unpaid) tier, Google may use what you send to improve its products, and human reviewers may read it. In the EEA, the UK, and Switzerland, use a paid key. Google's Gemini API is for users aged 18 and over.
• OpenAI: OpenAI Privacy Policy and API terms.
• Anthropic (Claude): Anthropic Privacy Policy and commercial terms.
• OpenRouter: OpenRouter Privacy Policy. OpenRouter passes your request on to the model's own provider, whose terms also apply.
• Mistral AI: Mistral privacy policy.
• Groq: Groq privacy policy.
• DeepSeek: DeepSeek privacy policy. DeepSeek processes data on servers in the People's Republic of China.
• Ollama or LM Studio on your own computer: the request goes to a model running on your Mac (localhost), and the page text does not leave your computer.
• Any OpenAI-compatible server you enter yourself (https, or http only on your own computer): that server's operator and terms apply. We don't check or vouch for it.

Don't use the AI panel on pages with sensitive, confidential, or other people's personal information unless you are comfortable with your provider's terms. For the App Store "App Privacy" label, the App collects no data: AI requests go from your device to a provider you choose and pay for directly, never to us.

Tao Browser for iPhone, iPad, and Android

The iPhone/iPad app and the Android app follow the same rules: no account, no telemetry, no analytics, no advertising identifiers, no crash reporting, and no tracking. We (Hostao) do not collect any data from them. The same one-suggestion card applies there: Tao may show one suggestion for other products by its makers on the New Tab page. You can turn it off. No data is collected. Your tabs, spaces, bookmarks, history, cookies, website logins, downloads, and settings are stored only on your device. Each space keeps its own cookies and website data. Private tabs keep no history, and their cookies are deleted when you close the last private tab.

Face ID / Touch ID. App, tab, and space locks use Apple's LocalAuthentication on your device. Tao never receives your face or fingerprint data; it only learns whether the check succeeded.

Passwords. On iPhone and iPad, Tao uses iOS Password AutoFill (iCloud Keychain or your password manager). Tao never sees or stores your passwords. On Android, Android's own autofill service works in the same way.

iCloud sync (iPhone and iPad, when it is switched on). Sync uses your own private iCloud database (Apple CloudKit). Titles and addresses are stored as encrypted fields. We have no server for it and no access to your iCloud data.

Ad and tracker blocking. The Android app downloads the public EasyList and EasyPrivacy filter lists from easylist.to; the iPhone/iPad app ships them inside the app. These downloads contain no information about you or your browsing.

Safe Browsing (Android). Android System WebView, the page engine Google provides with Android, keeps Google Safe Browsing on to warn you about dangerous sites. For this, WebView checks the addresses you visit against Google's lists; it normally sends Google only short hashed fragments of a page address, never your browsing history. Google processes this under its own privacy policy. Tao opts out of WebView's usage metrics.

Permissions. Camera, microphone, location and photo-library access are used only when a website you are using asks for them (for example a video call or a map) or when you save an image, and Tao asks you first. Tao itself does not record or keep this data.

4. This Site

The Site is a static website served by Cloudflare, Inc., our hosting and security provider. When you visit it or download the App, Cloudflare processes technical data (your IP address, browser user agent, the requested URL, and the time) to deliver files and protect the Site against abuse. We do not run advertising, remarketing, or cross-site tracking on the Site and we do not load third-party fonts. We do measure how the Site is used with Google Analytics, as described next. None of this applies to the App: the App sends no analytics, and its “Data Not Collected” privacy labels are unchanged.

Site analytics (Google Tag Manager and Google Analytics 4)

What we measure. Pages viewed, the site that referred you, campaign tags in the link you used (such as utm_source or a founder-circle ?ref code), clicks on download and app-store buttons, and the fact that a beta sign-up or feedback form was sent (never your email address or message). Google Analytics also records your browser and device type, screen size, language, and approximate location (country and city), which Google derives from your IP address. Google Analytics 4 does not log or store IP addresses. A random identifier in a first-party cookie lets us tell new visits from returning ones. We see only aggregated reports.

What we switched off. Google signals, advertising features, ad personalization, and remarketing are off. There are no advertising tags. Analytics data is not linked to your Google account and is not used for advertising.

Your choice. In the EU, EEA, UK, Switzerland, and India, analytics stays off and no analytics cookie is set unless you click “Allow” (Google Consent Mode v2, with all advertising signals always denied). Everywhere else analytics is on by default and you can click “Decline”. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as “Decline” everywhere. You can change your mind at any time with “Cookie settings” at the bottom of every page; declining deletes the analytics cookies. You can also use Google's Analytics opt-out browser add-on.

Retention. Event-level analytics data is deleted from Google Analytics after 2 months; only aggregated reports are kept. The analytics cookies expire after 13 months. Your cookie choice is kept in your browser for 12 months, then we ask again.

Who processes it. Google LLC (Google Ireland Limited for users in the EEA, UK, and Switzerland) provides Google Tag Manager and Google Analytics as our processor under the Google Ads Data Processing Terms. See also how Google uses data from sites that use its services.

Cookies and local storage on the Site

The Site's own server sets no cookies. Local and session storage stay in your browser and are not sent to us. Cloudflare Turnstile (below) may use its own technical storage only while you use a form.

Anti-spam check. When you start using one of our forms, the Site loads Cloudflare Turnstile from Cloudflare's servers to check that you are a person, not a bot. Turnstile processes technical signals from your browser, and your IP address is passed to Cloudflare to verify the check. We do not store your IP address. See Cloudflare's Turnstile privacy addendum.

5. The beta updates email list

The List belongs to this Site, not to the App. The App's store privacy labels (“Data Not Collected” on the App Store, “No data collected” on Google Play) describe the App only and stay true: the App sends nothing to the List.

What we collect: your email address, the fact that you ticked the consent box (with the version of the wording you saw and the time), whether you have confirmed, a random code used for your confirm and unsubscribe links, whether you ticked the optional founder-circle box, and the invite code in the link you arrived with (a ?ref= code of up to 32 letters, digits, hyphens or underscores), if there was one. We do not collect your name, location, or IP address for the List.

Why: to email you about Tao Browser betas, releases, and new platforms, which is what you asked for. Nothing else.

Double opt-in: before we send any update, we email you once to ask you to confirm. Until you confirm, we send you nothing else.

Welcome email: right after you confirm, we send one short welcome email: what Tao Browser is, the download link, how to send us feedback, and how to unsubscribe.

Founder circle (optional): the sign-up form has a separate, unticked box to join Tao's founder circle. If you tick it, we store that choice with your address and use it only to invite you to early builds and ask for your feedback on what we build next. Members get no money or discounts. Invite codes: if you open the Site through a founder's invite link (?ref=), your browser keeps the code for that tab (see the cookie table), and if you then sign up we store the code with your address so we can count how many people each invite brought. We do not use it to profile you or share it with the person who invited you. Both are kept for as long as your address stays on the List and are deleted with it. Untick or leave the circle any time by writing to privacy@hostao.com.

Unsubscribe and delete: every email has an unsubscribe link. It opens a page with one button; pressing it deletes your address (and any founder-circle tick and invite code) from the List. Where your mail app shows its own “Unsubscribe” button, that works in one click. You can also delete it at any time on our delete my data page, or by emailing privacy@hostao.com.

Retention: unconfirmed sign-ups are deleted automatically 90 days after sign-up. Confirmed addresses are kept until you unsubscribe or ask us to delete them, or until we close the List, whichever comes first.

Storage: the List is stored in a Cloudflare D1 database on Cloudflare's network. Emails: confirmation and update emails are sent by BestEmail, Hostao's own email-sending service, which runs on servers we rent in Germany and are relayed through Google Workspace (Google LLC), which hosts hostao.com email. Both receive only your email address and the email we send you.

We never sell, rent, or share the List, and we never use it for advertising.

6. When you email us

If you write to us, we use your message and email address only to reply and to handle your request, and we keep them for as long as needed to do that and to keep a record of the request (normally no more than 24 months). Please don't send us files from your browser profile: they can contain your browsing data.

7. Legal bases

Under the DPDP Act, we process List data (including the optional founder-circle tick and invite code) on the basis of your consent, Site security data for legitimate uses permitted by the Act, and pseudonymous Site analytics data only after you click “Allow” (you can withdraw it at any time in Cookie settings).

8. Who has access

Only the Hostao staff who run the List and answer privacy requests. Our service providers process data on our behalf under written data processing terms: Cloudflare, Inc. (hosting, security, the List database; Data Processing Addendum), Google LLC (Google Workspace, which relays and stores hostao.com email; Cloud Data Processing Addendum; and Google Tag Manager and Google Analytics for Site analytics; Google Ads Data Processing Terms), and the hosting provider of the servers that run BestEmail, our own email-sending service, in Germany. We may disclose data if the law requires it, for example in response to a valid court order. We do not sell personal data and we do not “share” it for cross-context behavioral advertising, as those terms are defined in the CCPA.

9. International transfers

Cloudflare runs a global network, so Site and List data may be processed in the United States and other countries. Email data and Site analytics data are also processed by Google in the United States and other countries, and email data by BestEmail in Germany. Transfers from the EEA, the UK, and Switzerland rely on Cloudflare's and Google's data processing terms, which include the European Commission's Standard Contractual Clauses (and the UK addendum), and on their certifications under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

10. Your rights

You can ask us to tell you what personal data we hold about you, give you a copy, correct it, delete it, or stop or restrict using it. You can withdraw consent at any time, which does not affect processing done before. To make a request, email privacy@hostao.com. We may need to confirm that the email address is yours. We reply within one month (GDPR), 45 days (CCPA), or the time set by your local law, whichever is shorter. Exercising your rights is free.

• EEA and UK: you also have the rights to data portability and to object to processing based on legitimate interests, and you may complain to your local data protection authority (in the UK, the Information Commissioner's Office).
• California: you have the right to know, delete and correct personal information, and to opt out of its sale or sharing. We do not sell or share it. Site analytics runs with Google as our service provider, with advertising features off; you can still turn it off with “Cookie settings” or a Global Privacy Control signal, which we honor. We do not use sensitive personal information. We will not treat you differently for using your rights. You may use an authorized agent.
• India: you have the rights to a summary of your data and its processing, to correction, completion, updating, and erasure, to grievance redressal, and to nominate someone to act for you. If you are not satisfied with our Grievance Officer's response, you may complain to the Data Protection Board of India.
• Everyone else: wherever you live, you can use the same rights described above (access, copy, correction, deletion, objection, and withdrawing consent), and you may complain to your local data protection authority.

11. Security

All connections to the Site use HTTPS. The List is stored in a database that only our Site's code and authorized Hostao staff can access. We keep the data we hold to the minimum described above. No system is perfectly secure; if a breach affecting your personal data happens, we will notify you and the authorities as the law requires.

12. Contact and Grievance Officer

Hostao L.L.C, a Wyoming (USA) limited liability company · privacy@hostao.com. All our contact addresses are on the contact page.

Grievance Officer (India, DPDP Act): write to grievance@hostao.com. We acknowledge grievances promptly and aim to resolve them within 30 days. See the grievance page.

13. Children

The Site and the List are not meant for anyone under 18, and we do not knowingly collect personal data from children. The App is a general-purpose web browser, not directed at children. Because it gives unrestricted access to the web, the App Store rates it for adults only, and parents can use the parental controls built into their devices (Screen Time on Apple devices, Family Link on Android) to restrict it. The App collects no personal data from anyone, including children. If you believe a child has joined the List or written to us, email privacy@hostao.com and we will delete the data. In India, we do not knowingly process the personal data of children (under 18) without verifiable parental consent, and we do not track, monitor behavior or target advertising at children.

14. Automated decisions

We do not make decisions about you based solely on automated processing, and we do not profile you.

15. Changes to this policy

If we change this policy, we will publish the new version here with a new version number and date. If a change affects what the App sends off your Mac, we will also say so in the changelog. If a change materially affects the List, we will email confirmed subscribers before it takes effect.

Prepared from DocPro template doc107 (Privacy Policy with GDPR, Website / Mobile App) and adapted to how Tao Browser and this Site actually work. 2.8 (27 October 2026): the AI panel can use more providers you choose (each listed above, sent directly from your Mac, never through us), with per-space providers and keys; Site Watch in the App contacts only the sites you list and their domain registries. Previous versions: 1.0, 2.0, and 2.1 (23 October 2026), 2.5 (24 October 2026; the Site had no analytics). 2.6 (26 October 2026) adds consent-based Site analytics (Google Tag Manager / Google Analytics 4) and the cookie list; the App is unchanged. 2.7 (26 October 2026): Site analytics is opt-in for users in India too; the optional founder-circle tick and ?ref invite code on the List (purpose and retention); the welcome email after you confirm; clearer unsubscribe wording (the link in an email opens a one-button page; one-click works through your mail app's unsubscribe button). The App is unchanged.