Privacy Policy
Pelorus · Shadowfax Industries LLC
Last updated: 18 October 2026
Revised 16 October 2026 — a correction, not a change in behaviour. Earlier wording said Pelorus had no backend and that Apple's aggregate figures were the only numbers we had. Pelorus requests two files from hosts we control: a small configuration file when it opens, and the Pelorus Voices pack if you choose to install it. Neither request carries anything about you, and our CDN counts those requests only in aggregate. The document now says so. Nothing about what the app does changed.
The short version
Pelorus has no accounts and nothing to log into. Searches go from your device to the engines you chose; AI requests go from your device to the provider you chose, under that provider's policy. Nothing about what you search, read, or do reaches us. The app requests two files from us — a configuration file, and voices if you want them — and neither carries anything about you.
Apple tells us some things. As with every App Store app, Apple reports how many people downloaded and purchased Pelorus, and, for users who chose to share analytics with developers in their iOS settings, aggregate figures like session counts. These are numbers, not people. They carry no names, no email addresses, no device identifiers, and nothing whatsoever about what you searched for. We could not identify a single Pelorus user if we tried.
Pelorus Voices are optional. If you choose to install them, the voice files are downloaded from our server, voice.pelorussearch.app, to your device.
The rest of this document explains the parts that are more complicated than that, because there are a few, and you should know about them.
What Pelorus collects
Nothing.
Not your searches. Not the pages you visit. Not your device identifier, your location, or your usage patterns. When the app requests a file from one of our hosts, the request reaches it from your network address, as any request reaches any server, and that address is not recorded. There is no analytics library in the app, no crash reporting, and no telemetry.
The numbers we have are the aggregate figures Apple reports to us from the App Store, and aggregate request counts our CDN derives from traffic reaching our hosts. There is no analytics inside Pelorus — no analytics library, no tags. There is no record of individual requests anywhere.
What leaves your device, and when
This is the part worth reading carefully. Pelorus is a search app, and searching means talking to search engines. Here is every case where information leaves your phone.
When you search
When Pelorus conducts searches, it executes the search in different ways depending on the engine. For some, Pelorus runs your query on your behalf through Pelorus's built-in browser and renders the engine's own results page. For others, Pelorus sends your query to the engine's API and renders the results in its own way. Either way, your query and your device's IP address reach that engine directly from your device. Every engine carries its own privacy policy governing what it does with your search, and Pelorus has no control over it. Pelorus itself keeps no search history; see "What is never stored" below.
If you sign in to a search engine inside Pelorus, that engine can potentially associate your searches with your account on their service and keep them in your account history. That record lives with them, under their policy; Pelorus cannot control that, nor can Erase reach it. Pelorus itself does not require you to log into search engines to use them, but it cannot control whether search engines require it.
Some engines try to detect automated traffic and may ask you to confirm you are human before showing results. That check is usually run by a third party on the engine's behalf, and that party sees your IP address and browser details. Pelorus cannot bypass these checks. Where an engine challenges every visit, Pelorus can show you its page but cannot read its results, and the engine's own settings say so.
Some search engines wrap their results in tracking links that hide the real destination. To show you where a result actually goes, Pelorus asks the destination site to resolve the link. That site sees a request from your device, even though you have not opened it.
Pelorus may also retrieve a result page to read the DOI, the permanent identifier assigned to a published paper. This lets Unified Search recognise that two engines found the same paper and count them as agreeing, rather than listing it twice.
In both cases, the site learns your IP address and that something asked about that page. It does not learn your search, what else your search returned, or anything about your other activity in Pelorus. The page is not opened in your browser, so nothing is stored and no scripts run.
When you use voice search
Voice search is recorded and processed entirely on your device. Neither the audio recording nor a transcription is ever sent anywhere, and Pelorus does not keep it either.
When you use AI features
Artificial Intelligence ("AI") features. Pelorus has three AI features: the AI Synthesis search card, which runs your search query through an AI provider of your choice; Pelorus Insights, which interprets the structure and meaning of the results from your search query; and Summarize this Page, which provides an AI-inferred summation of the content on a page you are reading. All three use the same AI provider you choose in Settings. You can also choose to disable all AI features entirely.
What gets sent to an AI provider depends on the feature. The Synthesis card sends your search query and the titles, addresses, and snippets of your results. Pelorus Insights sends your search query, the computed facts about the results with page titles replaced by a placeholder, and the domains of the top results together with where each engine ranked them. No titles, no full addresses, and no snippets. Summarize this Page sends the text of the page itself. Pelorus does not retain any record of the search nor the results retrieved from your AI provider. And in no case does Pelorus send identifying information about you to your providers. However, if you choose a provider that uses an API key you provide, they will know the search is correlated to that API key, and thus to you.
On-device provider. If you choose the on-device model, nothing is sent anywhere. Your device and iOS do all the work of processing the search through a local/on-device model that is less capable than cloud providers. Apple is not involved beyond providing the model, and Pelorus maintains no record or transcript of these results.
Your own provider. If you add an API key for a cloud provider, the text described above goes directly from your device to that provider, under that provider's privacy policy and the terms of your account with them. Pelorus is not a party to that relationship and never sees what you send or what comes back. Different providers keep what you send for different lengths of time and use it differently; that is between you and them.
If a cloud provider fails. If your provider cannot be reached or returns an error before answering, Pelorus can answer on your device instead using its local model, provided you have enabled that feature and your hardware and operating system meet the minimum technical specifications for the capability. When this happens, Pelorus says so in its user interface. If the provider could not be reached at all, it never received your search query; but if it returned an error, it received your search query but did not answer it. Pelorus cannot know or control what the AI provider does with that query from there.
Your key. Your API keys are stored in the device Keychain. If iCloud Keychain sync is on, it syncs to your other devices through Apple, encrypted end-to-end. Either way, the key only ever leaves your device in a request to the provider it belongs to.
When search suggestions are on
This setting is off by default. When you turn it on, what you type is sent to your default search engine as you type it, before you press return. The setting's description says exactly this, because it is the one feature in Pelorus that sends anything anywhere without you finishing a deliberate action.
When you add a key for a source
Some sources accept a key of your own, entered on that source's own settings screen. When you save one, Pelorus sends it to that service once to confirm it works, and then with each search you make through that source. Nothing else is sent with it. Searches made with your key are billed by that service, not by Pelorus.
When you import a blocklist
If you import a blocklist from a URL, Pelorus fetches that URL once, at the moment you tap import. Lists never update themselves. There is no scheduled request, no background refresh, and no field in the app that could drive one. Checking a list for updates is something you do by tapping a button.
When Pelorus checks for updates
Pelorus checks for engine and feature updates when the app opens, by requesting one small configuration file from manifest.pelorussearch.app. The request carries no account, no identifier of you or your device, and nothing you have searched for or typed. Like any request to any server, it reaches our host from your network address. We have no request logging enabled and keep no record of individual requests; we see only aggregate counts, which identify no one.
When you buy Pelorus Unlimited
Purchases are handled entirely by Apple. Your payment information goes to Apple, never to us. We receive no transaction record, no receipt, and no identifying information. The app asks Apple's local system whether this device has the purchase and gets back yes or no.
Apple provides us with aggregate sales figures, the same as for any App Store app. Those figures contain no personal information.
When you turn on iCloud settings sync
This setting is off by default and Pelorus never asks you to enable it.
When you do, your settings (your engine list, domain rules, filters, appearance choices) sync through your own iCloud account so you do not have to set them up again on another device. This uses Apple's iCloud, not any server of ours, and is covered by your iCloud account's encryption.
Your API keys are not part of this settings sync. They sync separately through iCloud Keychain's end-to-end-encrypted channel (described above), or stay on one device if you turn that off. Nothing about what you search or visit is ever synced, because Pelorus never records it in the first place.
When you are asked to rate Pelorus
Pelorus may occasionally ask you to rate the app. That prompt is shown by iOS, which decides when and how often it appears, and your rating goes to Apple. Pelorus is not told whether you rated it or what you said.
When you send feedback
Request a Feature and Report a Problem, in Settings under Help Center, open a form on our website, pelorussearch.app. Pelorus does not send anything on its own; nothing leaves until you fill in that form and submit it.
The form carries only what you type: your title, your description, and the optional answers to its questions. Pelorus prefills a short environment line so you do not have to type it: the app version, the build number, your iOS version, and your device model (for example, "iPhone17,1"). That model names the kind of device, not your device; it is the same string for every unit of that model. Nothing that identifies you or your device across launches is included, and none of your settings, your searches, or anything about your purchases is.
The email field is optional. If you give one, it is used only to reply to you if we have a question about what you sent. There is no mailing list, no notifications, and no marketing, ever. Your submission becomes an entry in a private issue tracker that only we can see; the email, if you gave one, is stored there for that reply and goes nowhere else.
So that the forms are not flooded by automated submissions, they use Cloudflare Turnstile to check that a submission comes from a person rather than a bot. Turnstile does not track you across websites.
What is stored on your device
What Pelorus stores on your device. Your settings and saved configurations: engines, presets, domain rules, and appearance choices. Add to Reading List sends a page to Safari's own Reading List, which lives outside Pelorus, so Erase does not touch it. A small number of counters, including the lifetime count of trackers blocked. Technical records that help Pelorus keep working, such as the configuration file described above and a note of how each search engine's results page is currently laid out, since engines change theirs often. And anything you have chosen to download, such as the Pelorus Voices.
Pelorus does not store your searches, the pages you visited, or any history of what you did. Erase clears the session and its technical records. The one exception is the cookies and saved data of any site you have chosen to keep signed in. Your settings survive it, and Reset Pelorus removes everything and restores Pelorus to its state when it was first installed on your device but had never been run.
The tracker counter and iCloud. If iCloud settings sync is on, the lifetime count of trackers blocked syncs with your other settings. It is a single number with nothing attached (no addresses, no searches, no times), but it is shared across every device signed in to your iCloud account, so the count you see on your iPad includes what was blocked on your iPhone.
What is never stored
Browsing history. There is none. Pelorus does not have a history feature, and this is not a setting you can turn on.
Site data. Pelorus keeps the cookies, caches, and other files websites leave in Pelorus only until you tap Erase, which throws them away and starts over.
Search queries. When you erase, or close the app with erase-on-close enabled, your queries are gone from memory and were never written to disk.
Sites you choose to keep
There is one exception. You can tell Pelorus to keep you signed in to a specific site. While that site is on your list, Erase leaves its cookies and saved data alone so you do not have to sign in again. That also means the site can still recognize you the next time you visit, and anything it saves for its own purposes stays as well, including its own analytics.
Keeping a site is a choice you make, one site at a time, and you can undo it whenever you want. The list starts out empty, so until you add something, Erase leaves nothing behind.
Keeping one site does not keep anything for any other site. Advertising and tracking companies that appear on a kept site's pages are cleared along with everything else.
The tracker counter
Pelorus offers a counter of how many trackers have been blocked. We include it because some people find the statistic useful, and because it is the only user-visible proof that blocking works at all.
The counter works by observing every request a page makes, from inside that page, and tallying the ones our blocklist stops. That is the only way to count them. A side effect is that a website could, with effort, detect that instrumentation is present. It cannot see your searches, your settings, or anything else.
Eliminating the counter would not buy much, though. A page can already detect the behavioral signatures of any content-blocking browser by checking whether its own tracker scripts loaded. Perfect invisibility is not possible to any privacy browser, so giving up the feature would not achieve it either. But we can make Pelorus harder to identify. The counter's marker is given a new, random name every single time the app launches and every single time you tap Erase, so it cannot serve as a stable identifier across sessions.
Fingerprint randomization
This setting is off by default. When enabled, Pelorus varies some of the details websites use to recognize your device, and rotates them every time you erase.
We are honest about the limits: this reduces one category of tracking and does not eliminate fingerprinting. Some sites will render incorrectly with it on, which is why it is off unless you choose it.
Children
Pelorus is a search app that loads the open web. It applies no content filtering of its own, and the search engines you enable have their own safety settings. It is not designed for children and we do not knowingly collect information from anyone, including children, because we do not collect information from anyone at all.
Your rights
Laws in California, the European Union, and elsewhere give you rights to access, correct, delete, and port the personal information a company holds about you.
We hold none. There is nothing to access, nothing to correct, nothing to delete, and nothing to port. If you want to remove what Pelorus has stored, Settings gives you the routes: Clear All Website Data wipes every site's cookies, caches, and saved data in Pelorus; Reset Pelorus does that and also restores your settings and removes your engines, rules, presets, and keys. Deleting the app removes all of it. Everything stays on your device, which is the only place it ever was.
We do not sell personal information. We do not share it. We do not have any.
Changes to this policy
If this policy changes, the updated version will appear here and in the app, with a new date at the top. If a change ever means Pelorus starts collecting something it does not collect today, we will say so plainly at the top of the document rather than burying it.
Contact
Questions about this policy: hello@shadowfaxindustries.com
Shadowfax Industries LLC
6754 Bernal Ave Ste 740
Pleasanton, CA 94566
United States