Privacy and Security
A browser keeps a record of where you went, and a search engine keeps a record of what you asked. Those records outlast the moment you needed them and belong to someone else. Pelorus is built so that there is no record to keep: nothing is written down, and one tap destroys what the session left behind. This page covers Erase and the settings around it, what Pelorus blocks while you browse, and the short list of cases where anything leaves your device.
Erase
The trash can in the toolbar is Erase. It closes every card, forgets the search, and wipes everything Pelorus kept behind them: cookies, caches, service workers, and anything a page saved on your device. By default nothing in Pelorus survives it, so there is no confirmation, because it is the button you reach for in a hurry, and there is no undo.
Your settings, engines, presets, and API keys stay. Erase deals with what you looked at. How you set the app up is untouched.
Add to Reading List hands the page to Safari's Reading List, which is outside Pelorus, so Erase does not clear it. The same is true of anything you opened in another browser with the Open button. That browser keeps its own history, and Erase cannot reach it.
On its own. Erase When Switching or Closing Apps, under Settings > Privacy & Security, erases when you leave the app, after a delay you pick: immediately, or after 1, 5, or 30 minutes away. With a delay set, you can step out to read a message and come right back with your cards still there. Stay away longer and they are gone.
From outside the app. Erase Current Session is offered to Siri, the Shortcuts app, and the Action button, and it runs without opening Pelorus. Erase & Open erases and then opens Pelorus fresh. Both also appear when you press and hold the app icon.
The one exception. A site you have chosen to keep signed in to holds its cookies and local storage across Erase. Managing Site Logins explains that choice and what it means.
Blocking Trackers
Block Trackers, under Settings > Privacy & Security, stops the requests pages make to advertising, analytics, social, and content trackers. Tracker Categories lets you turn each of the four on or off. Custom Blocklists adds lists of your own, imported from a file or from an address. A list you import from an address is fetched once, when you tap import, and never updates itself.
A counter shows how many trackers Pelorus has blocked over the life of the app. It is the one place you can see the blocking actually working. The shield on any card lists what was blocked on that page.
Two more switches sit beside it. Hide Ads on Results hides the advertising sections of engines' results pages. Block Web Fonts stops pages loading fonts from outside, which are a common tracking channel.
Fingerprint Randomization
Websites can recognize a device by the details it reveals, such as screen size and installed fonts, without any cookie. Randomize Fingerprint varies some of those details and rotates them on every Erase, so the same site sees a different device next time.
It reduces one category of tracking and does not eliminate fingerprinting. Some sites render incorrectly or refuse to load with it on, which is why it is off until you choose it. When a site breaks, the card offers to reload without it for that site, and the exception is remembered.
Locking the App
Require Face ID to Open asks for Face ID, or your passcode, every time Pelorus comes to the front. Hide Contents in App Switcher covers Pelorus in the app switcher, so what you were reading is not on display while you flip between apps.
Suggestions and Autocomplete
Search Suggestions, under Settings > Search, is off by default because it sends what you type as you type it, before you press return. It is the one feature in Pelorus that sends anything anywhere without you finishing a deliberate action. URL Autocomplete completes addresses on the device and sends nothing.
What Leaves Your Device
Pelorus has no backend. Nothing about what you search, read, or do reaches us. Here is every case in which something leaves your device, so that you can decide about each one.
| When | What goes where |
|---|---|
| You search | Your query goes to each engine you turned on, from your device, exactly as it would from any browser. |
| A result hides its destination | Some engines wrap results in tracking links. Pelorus asks the destination site to resolve the link, so that site sees a request from your device even though you did not open it. |
| Research results are matched | Pelorus may fetch a result page to read its DOI, so that two engines finding the same paper count as agreeing. |
| You use voice search | Nothing. Speech is turned into text on the device. |
| You use AI on the device | Nothing. |
| You use AI with your own key | Your query and your results' titles, addresses, and snippets go to the provider you chose. For Summarize this Page, the page's text goes. |
| You complete citations | Each source page is fetched once from your device to read its author, date, and site name. |
| Search Suggestions is on | What you type goes to your engine as you type it. |
| You add a key | The key goes to the service it belongs to, once to check it and then with each search through that service. |
| You import a blocklist from an address | That address is fetched once, when you tap import. |
| You download the Pelorus Voices | The voice files come from our server. That is the only request the app ever makes to us, and it tells us nothing about you. |
| You turn on iCloud sync | Your settings sync through your own iCloud account. Keys sync separately through iCloud Keychain, or not at all. |
| You send feedback | Nothing leaves until you fill in the form on our website and submit it. |
The Privacy Policy says the same things at full length and is the document that binds us.
Signing in to an Engine
An engine you are signed in to can tie your searches to your account and keep them in its own history. That record lives with the engine, and Erase cannot reach it. Pelorus never requires you to sign in to an engine, and it cannot stop an engine from requiring it.
Reset Pelorus
Reset Pelorus, at the foot of Settings > Privacy & Security, removes your engines, rules, presets, and keys and returns the app to the state it was in when first installed. It asks first. Your purchase is kept either way. Deleting the app removes everything, because everything stays on your device, which is the only place it ever was.