Privacy

At a glance

The pages you open

A page you open, or preview with Peek, gets what any browser sends it: your IP address, the page you asked for and the cookies it set before. ilo blocks ads and trackers on every site unless you turn that off.

A search goes to your search engine when you press return: DuckDuckGo (duckduckgo.com) unless you choose another in Settings › General. Nothing you type in the command bar leaves your computer before you search: ilo asks your search engine for no suggestions as you type.

Every service ilo talks to

The Chrome Web Store, from Google

Extensions come from the Chrome Web Store. When you visit the store, it sees which extensions you have. Installing one you've confirmed fetches its icon from Google's image host, and the extension from Google.

With a store extension installed, ilo checks for its updates soon after launch, then about every five hours. The check sends each extension's id and version, and ilo's version, system and language, without cookies.

chromewebstore.google.com clients2.google.com clients2.googleusercontent.com

Chromium's security updates, from Google

ilo is built on ungoogled-chromium, which cuts Chromium's calls to Google. ilo brings one back, for safety: a check for three components that keep the browser from trusting what's known to be bad. They're the list of revoked certificates (CRLSet), the certificate authorities and logs Chromium trusts (PKI Metadata), and the certificate error helper. It runs a minute after launch, then every five hours.

The check names ilo's engine version, your operating system and its version, and the components it has. It carries no cookies and nothing that ties one check to the next, but Google sees your IP address. There's no switch for it, as without it a revoked certificate would stay trusted.

update.googleapis.com/service/update2/json, with downloads only from dl.google.com, *.gvt1.com and www.google.com/dl/

Widevine, for protected video on Linux

On Linux, Netflix and other protected video need Google's Widevine module, which ilo doesn't ship. Once you allow protected video, ilo downloads it, and keeps it up to date, from the same Google hosts as the security updates. Removing it in Settings stops that. On a Mac, protected video plays in macOS's own web engine, and on Windows with Windows' own PlayReady, so ilo fetches nothing for it there.

Ad block lists

ilo blocks ads with uBlock Origin, built in. It ships with its lists, so it blocks from the first page, and fetches new ones about once a week from the hosts the lists come from. uBlock Origin may also add a list for your language. Those hosts see your IP address and that the lists were fetched; the blocking itself happens on your computer, so nothing about the pages you visit goes with it. Settings › Privacy › Block ads and trackers turns it off, and a site's own controls turn it off there.

ublockorigin.github.io ublockorigin.pages.dev cdn.jsdelivr.net raw.githubusercontent.com publicsuffix.org pgl.yoyo.org malware-filter.gitlab.io malware-filter.pages.dev curbengh.github.io

ilo's updates

Only a copy that updates itself checks. On a Mac and on Windows, ilo reads its update feed every 8 hours, sending its version and no profile of your system, and downloads an update from ilo's releases on GitHub, which hands the file over from its own download host. Each update is signed, and ilo checks the signature before it installs. A copy from the Microsoft Store leaves its updates to the Store. There's no switch to stop the checks yet (#1793).

github.com/MartinPTielemans/ilo/releases/download/updates/appcast.xml release-assets.githubusercontent.com

On Linux, only the Flatpak updates, through Flatpak's own remote, as your other Flatpak apps do. Installing it fetches the runtime it runs on from Flathub, if you don't have it yet.

dl.flathub.org

Crash reports, only the ones you send

When ilo crashes it writes a report on your computer, and the report leaves it only if you say so. The next time ilo opens, it asks whether to send that one. Settings › Privacy › Send crash reports, off unless you turn it on, sends each one without asking, and turning it off deletes those not yet sent.

A report is what the crashed part of ilo was doing: its threads and their stacks, which can hold bits of what it was working on, the code it had loaded, and ilo's version, its switches, your graphics chip and your extensions' ids. Switches naming your folders are left out. It goes to Sentry, in the EU, told to keep no IP address with it, and carries no cookies.

o4512341293334528.ingest.de.sentry.io

Sync, only if you sign in

Sync is off until you sign in to an ilo account, in Settings › Sync or when ilo first opens. Signing in sends your email address, then a code mailed to you or a passkey, to the account's server: ilo's, unless you give ilo the address of one you run yourself from its source. It needs no Google account.

Signed in, ilo syncs your Spaces and your first profile's bookmarks, passwords and open tabs. They're encrypted on your computer with your 24 recovery words, which only your devices have, and the server keeps them encrypted and turns away anything that arrives unencrypted. Even which site and username a password is for stays hidden.

What the server can see is your email address and when your account was made. It knows each device by a label, such as "ilo on Mac", which can include its hardware model, as in "ilo on Mac (MacBookPro18,3)", with its form factor, its operating system and when it was last active. A device being added also gives its label and operating system. The server also sees a few of Chromium's settings it keeps unencrypted; and, for the rest, which kinds of data you sync, how many items, how large, when they change and how bookmarks nest, but not their names, addresses or contents. When your devices message each other through it, it sees when and how much, not what they say.

Like any server, it sees the IP address each request comes from. ilo-server, the software it runs, doesn't log addresses, but a proxy in front of it could. Signing out stops it all.

sync.ilobrowser.com

Names, proxies and the rest

ilo finds the sites you visit, and the services above, through your system's DNS, as your other apps do. It sends those lookups to no DNS service of its own.

Where your system's proxy settings say to find a proxy automatically, as Windows' do by default, ilo asks your local network for one (wpad), as your system does.

When you ask an agent from ilo, ilo runs the claude or codex program you installed, which talks to its own company under your account. ilo has no AI service of its own and sends it nothing itself.

On a Windows computer joined to a work or school directory, ilo can sign you in to your organisation's sites with Windows' own Microsoft sign-in, as your organisation set it up.

What ilo never sends

No usage data, no analytics, nothing for advertisers. Of Google's services, ilo brings back only those above: no Safe Browsing, no Google sync and no Google metrics.

Someone else's build of ilo

ilo is open source, so anyone can build their own. Official builds differ from such a fork only in their name and logo, their signing keys and a few addresses: the update feed, where crash reports go, where ad block lists come from and this site. A fork chooses its own. What a fork sends is up to whoever makes it, so read theirs.

This site

ilobrowser.com sets no cookies and runs no analytics or third-party scripts. Cloudflare serves it, and sees each request as any host does.

How this list is checked

A check in ilo's code starts ilo on a new profile, waits through its first security check, opens a page and types a search, then reads every address ilo reached. It fails if ilo asked any host this page doesn't name, or one of those it names only for what you turn on. It runs on a Mac, Windows and Linux.

Questions and changes

Ask on GitHub. Every change to this page is in the site's history. Last changed 4 November 2026.