This page says exactly what Zero Say Browser protects, how, and where the protection stops. It is written to be checked, not admired. If something here turns out to be wrong, write to us and we will correct it.
The short version: every tab reaches the internet through Tor and nothing leaves before Tor is ready; trackers and ads are cut out before they load; the browser reports the same common device as everyone else; and a closed window leaves nothing behind. The browser has no account and never talks to us except to ask, through Tor, whether an update exists.
1.Where your traffic goes
Every tab goes through Tor. The browser starts its own Tor daemon (bundled, with the pluggable transports) and points its whole web session at it. Until Tor reports itself ready, the page area is gated and no request leaves: fail-closed, not fail-open. Name lookups happen inside Tor, so your resolver never learns the sites you visit. WebRTC is not allowed to open non-proxied connections, which is the classic way a browser leaks its real address.
What a site sees is a Tor exit, not you. With an upstream proxy configured (Settings → Upstream proxy) the site sees your proxy instead, and cannot tell that Tor is involved; Tor still sits between you and the proxy, and .onion sites always go straight through Tor. Each destination gets its own circuit, so two sites are not seen leaving the same exit.
Bridges (obfs4, Snowflake, or lines you paste) hide the fact that you are connecting to Tor from the network you are on. They do not make you faster.
| Who | Can see | Cannot see |
|---|---|---|
| Your network / ISP | That you connect to Tor (or, with a bridge, to what looks like ordinary traffic), how much, when | Which sites, what pages, what you type |
| Tor guard relay | Your address, encrypted traffic | Where it is going |
| Tor exit relay | The site's address, and plain HTTP content if a site has no HTTPS | Your address |
| The site | The exit's (or your proxy's) address, the same common device story as thousands of others | Your address, your real device, other sites you visit |
| Us | Nothing, except an update check arriving from a Tor exit | Who you are, what you browse |
HTTPS-Only is on by default so an exit cannot read or alter what you load; a site without HTTPS asks you for a one-time exception. The Direct window is the deliberate exception to all of this: it is for sites Tor cannot reach, it uses your own connection, and the site sees your real address. It is labelled as such.
2.Trackers, ads and tracking links
- Twenty-one filter lists (EasyList, EasyPrivacy, Peter Lowe, uBlock Origin's own lists, AdGuard Tracking Protection and URL Tracking, Nordic filters, cookie and annoyance lists) run inside the browser through the Ghostery engine. They ship inside the app as a prebuilt snapshot, so blocking is active from the first tab, and are refreshed over Tor once a day.
- Tracking parameters (click and campaign identifiers) are stripped from links you open, including the page you navigate to, using the lists' own rules plus a hand list.
- Known redirect trackers (Google, Facebook, Instagram, Reddit, YouTube and others) are skipped: you land on the destination without the tracker logging the click.
- Third-party requests carry no cookies and may not set any; cross-site Referer is cut to the origin; hyperlink-audit pings never fire; Chromium's storage partitioning is on.
The limit: filter lists know what is known. A brand-new tracker domain is blocked only once a list maintainer has seen it.
3.Looking like everyone else
Sites try to recognise a browser by the shape of the device behind it. Zero Say Browser makes every copy report the same story: a common Windows desktop running current Chrome, a common screen, a time zone that follows the Tor exit, no WebGL and no 3D, a canvas that answers consistently but not truthfully, uniform fonts and audio, and matching client hints on the wire and in JavaScript, so the two never contradict each other. Optional letterboxing rounds the window to common sizes as well.
The honest limit: this makes you common, not invisible. A site running its own extensive tests may still find a difference.
4.Security levels and per-site scripts
Most attacks on a browser arrive as JavaScript. Standard runs scripts everywhere. Safer runs them only on HTTPS and .onion sites, so an exit relay cannot inject code into a plain-HTTP page, and media plays only after a click. Safest runs no scripts at all. The setting is enforced before a page's document exists, not by removing scripts afterwards, and you can allow or block scripts for one site from the padlock. WebGL and 3D are off at every level.
5.What stays on your device
Burner by default. Cookies, cache, site storage and history live in memory and are gone when you close the window. There is no history at all. Downloads are kept in a sandbox and discarded with the session unless you choose “Save a copy”.
What does persist, because you asked for it, and where:
| Item | Where | Protected by |
|---|---|---|
| Settings (levels, engine, bridges, per-site script choices, upstream proxies) | Your profile folder, readable by your user only | Operating-system file permissions |
| Bookmarks | Your profile folder | Operating-system file permissions |
| Saved logins | The operating system's secure storage (Keychain on macOS) | Your login, and Touch ID if you turn it on; an app lock with a passphrase is available |
| Filter-list snapshot, translation models | Your profile folder | Contain no data about you |
Deleting the profile folder, or uninstalling, removes all of it. There is nothing of yours anywhere else.
6.Onion search, translation, reader view
- Onion search sends your query, through Tor, to five third-party onion search engines and merges what they return. They see the query text; they see it coming from a Tor circuit, not from you. Sponsored placements are removed and results matching an abuse-term blocklist are dropped before they reach the page. There is no setting that turns that filter off.
- Translation runs on your computer. Models are downloaded once, through Tor, from Mozilla's public registry and checked against their published hashes. The text of the page never leaves your machine.
- Reader view rebuilds an article through a strict allowlist of elements, so no script, frame or form from the page survives into the reader page.
7.Updates and the app itself
- The macOS build is signed with our Apple Developer ID and notarised; Tor and its transports inside it are signed with the same identity. Verify the SHA-256 printed on the download page before installing.
- The update check goes through Tor and carries no identifier. What our server records is that some Tor exit asked for the version file. Updates download the same way, are signature-checked, and install when you quit.
- The browser sends no crash reports, no analytics and no telemetry. There is nothing to opt out of.
8.What it cannot do
- Hide who you tell a site you are. Logging into an account that names you names you, on any browser.
- Beat traffic analysis by a global observer. Tor protects against your network and the sites you visit, not against someone who can watch both ends of the internet at once.
- Make Chromium as hardened as Tor Browser. This is Chromium with Tor underneath and our own hardening on top. For the highest-risk situations, use Tor Browser; for a fast everyday browser that leaks nothing by default, use this.
- Protect a compromised computer. Malware on your device sees what you see.
- Vouch for onion search results. They come from third-party indexes; we filter, we do not curate.
Security researchers: write to hello@zerosay.com with “security” in the subject. We will not take legal action against good-faith research. The messenger's own security page is here.