Security and privacy · Tao Browser by Hostao®

Plain answers about your data.

No browser is perfectly secure, and we won't claim Tao is. This page says what we've built, what we haven't finished, and exactly what leaves your Mac.

What leaves your Mac

What	Where it goes	When
Usage statistics, analytics, crash reports	Nowhere. Tao has none.	Never
History, tabs, bookmarks, cookies, site logins, settings	Stay on your Mac, inside your macOS user account	Never sent
Arc and bookmark imports	Read from files on your Mac	Never uploaded
Page requests	The websites you open and the search engine you use (DuckDuckGo by default)	When you browse, like any browser
Visible page text and your question	The AI provider shown in the panel (Google Gemini today), using your own key	Only when you click an AI action
Your AI API key	Stored in the macOS Keychain; sent only to that provider	With your AI requests
Saved passwords	Your macOS Keychain, on your Mac	Never sent
Breach check	Have I Been Pwned receives the first 5 characters of a hash of the password, never the password	When you run the check
Extensions	Whatever the permissions you approved allow; the extension developer's policy applies	Only if you install one

How Tao is built

Apple's WebKit engine. Tao is a native Mac app around the WebKit that ships with macOS. When Apple patches WebKit in a macOS or Safari update, Tao gets the fix too. We own the browser shell, not the engine.
Signed and notarised. Builds are signed with Hostao's Apple Developer ID (HOSTAO L.L.C, team 9KCU577Z4L), use Apple's Hardened Runtime, and are notarised by Apple.
App Sandbox. Tao runs inside Apple's App Sandbox, which limits what it can reach on your Mac.
HTTPS-Only by default. Tao upgrades connections to HTTPS and asks before falling back.
Keychain for secrets. Your AI key and saved passwords are kept in the macOS Keychain, and filling a password needs Touch ID or your Mac password. Secrets are never written to plain files, settings or logs.
Extensions ask first. You see an extension's permissions before it's installed, and extensions never run in private tabs.
Separate spaces. Each space has its own cookie and storage container. Private tabs use a storage container that isn't saved.
Safer navigation. Web pages can't open javascript:, file: or data: addresses at the top level. Links that try to open other apps ask you first. Camera and microphone access is asked per site.
Careful downloads. File names are cleaned up and downloaded files get the macOS quarantine flag, so Gatekeeper checks them before they open.
AI with guard rails. The panel only reads the visible text of the page, treats it as untrusted, and strips links out of answers so a page can't sneak a malicious link into a reply. You can block it per site, and it's off in private tabs.
Developer tools off by default. The Web Inspector stays off unless you turn it on in the Develop menu.

Not finished yet

We'd rather you hear this from us:

No independent audit yet. Tao has had internal security reviews and attack-page tests, and the fixes are in 1.4.2. An outside review is planned.
Passkeys aren't supported yet. They need an Apple entitlement, which we've requested.
Extensions are new. The gallery only lists extensions we have reviewed and tested in Tao. Extensions you add yourself from a file or link are not reviewed by us, and some Chrome-only extensions don't work in WebKit.

Check your download

The SHA-256 checksum of TaoBrowser-1.4.2.zip is:

33929f605c252beec1a5c601b04130972de4141d90e19ee4f45fc7a68f8d9234

In Terminal, run shasum -a 256 ~/Downloads/TaoBrowser-1.4.2.zip and compare. To check the signature after installing:

codesign -dv --verbose=2 "/Applications/Tao Browser.app"

Look for Authority=Developer ID Application: HOSTAO L.L.C (9KCU577Z4L). To confirm Apple's notarisation, run spctl -a -vv "/Applications/Tao Browser.app"; it should say source=Notarized Developer ID.

This website

tao.hostao.com is a static site on Cloudflare. Our server sets no cookies, and the site loads no third-party fonts and no advertising tags. It counts visits with Google Analytics through Google Tag Manager: in the EU, EEA, UK, Switzerland and India only after you click “Allow”, and never when your browser sends Global Privacy Control or Do Not Track. Details are in the privacy policy, and you can change your choice any time with “Cookie settings” at the bottom of every page. This applies to the website only; the apps send no analytics. Cloudflare Turnstile, the anti-spam check, loads only after you start filling in one of our forms. Your theme choice (dark or light) is remembered in your own browser's storage and never sent to us.

Report a security problem (vulnerability disclosure policy)

Email security@hostao.com with “Security report” in the subject. Include the app (Mac, iPhone/iPad or Android), the Tao version, your OS version and steps to reproduce. We acknowledge reports within 3 working days and keep you updated until the issue is fixed. Please give us 90 days, or until a fix ships if sooner, before you share details publicly.

Safe harbour. We won't take legal action against good-faith research that follows this policy: test only against your own devices and accounts, don't access or change other people's data, don't degrade our services (no denial-of-service or spam), and report promptly. We don't run a paid bug bounty, but we're happy to credit you in the changelog. Machine-readable contact: security.txt.