A browser that keeps your data to itself.

• Tracking ads: blocked.
• Invisible trackers: blocked.
• Fingerprinting: randomized.

That is the result Satori gets on the EFF's Cover Your Tracks test. Run the test yourself.

Saved passwords live in the login keychain. When you focus a sign-in box, Satori lists the accounts it has for that site, and a password fills in only after you click one. It does not fill a sign-in form on its own.

The exception is the sign-in dialog for a password-protected folder. When there is one saved login for that site, Satori answers the dialog over https, and "Don't ask again" stops the question.

Show and Copy in Passwords ask for Touch ID or your account password. A copied password is marked concealed, so clipboard managers skip it, and it is cleared after a minute unless you copy something else.

Passwords imported from another browser land in your own login keychain, labeled Satori. macOS asks once for permission to read that browser's keychain entry, and nothing is changed there.

Sites can try to recognize you by the details of your browser, such as its screen and fonts. WebKit, the engine Satori runs on, keeps those details from adding up to you: on the Cover Your Tracks test, the fingerprint comes out randomized.

Copy Address (⇧⌘C) removes tracking tags and click IDs. Copy Original Address keeps them. ⌥⇧⌘C copies a Markdown link.

Many Russian sites, including Sber, Alfa-Bank, T-Bank, and Gosuslugi, use certificates from the Russian Ministry of Digital Development. macOS does not trust that root. Satori trusts it only for addresses ending in .ru, .su, and .рф. You can turn this off in Settings › Privacy & Security.

What stays on your Mac

• Passwords: the login keychain, as internet passwords labeled Satori.
• History, open tabs, bookmarks, downloads, and hidden elements: encrypted files under ~/Library/Application Support/Satori/.
• Site icons and per-site settings such as colors, mute, and reading position: under keyed hashed names, in files and in macOS preferences. Settings, extensions and the data websites store (cookies, caches) are not encrypted by Satori.
• Private tabs: nothing, except elements you hide.
• Seeing or copying a saved password: asks for Touch ID or your account password. A copied password is marked concealed and cleared from the clipboard after a minute, if Satori is still open.
• No account and no sync: there is nothing to upload your data to.
• Translate, summaries, Apple Intelligence features, and the read-aloud system voices: run on your Mac. Soundscapes are composed there as they play.
• Problems: if Satori runs into trouble, it writes a plain-text log, crash.log, in the Satori folder and sends it nowhere.
• Clearing: History › Clear History, and Settings › Privacy & Security to clear history and cache or sign out of everything.

What leaves your Mac

• Update checks go to brandkit.pro, which sees your IP address: about five seconds after launch, then once a day. The update itself downloads from GitHub, which also sees your IP address. Satori downloads updates in the background and installs them when you quit; the new version opens the next time you launch. You can turn automatic checks off in Settings › About.
• A single word that is not in the dictionary is looked up in DNS with .com added, to see whether that site exists. Only the name is looked up. Search words are not sent before Return.
• Pointing at a link can open a connection to that site early. Turn this off in Settings › Privacy & Security, under Connect ahead on hover.
• Installing Bitwarden downloads it from Google's Chrome Web Store update service, which gets the extension's ID and a Chrome version string. About every 20 hours, Satori checks installed Chrome Web Store extensions for updates and sends each extension's ID and version. Other Chrome extensions are switched off for now.
• These are the ones that matter most. macOS and WebKit make some requests of their own that Satori does not control. The full list is in the privacy policy, linked below.