Every page and every search travels through three relays. Everything that reads them runs on the device. Two halves of the same promise: nobody learns where you went, and nobody learns what you read.
A Tor daemon runs inside the app and the browser engine itself speaks to it. Pages, searches, scripts, images, even site icons go the same way. Nothing loads until the connection is up, and nothing quietly falls back to your ordinary connection if it drops.
Guard, middle and exit for every live circuit, with the countries they sit in. The first relay knows your device but not your destination; the last knows the destination but not you.
A new circuit changes the route and keeps your session. A new identity throws away the route, the cookies, the caches, the history and the log in one step.
Reach .onion addresses directly, with an onion badge in the address bar instead of a padlock — because there is no exit relay in the path at all.
Most engines meet a Tor exit relay with a CAPTCHA. This one ships with the ones that do not: DuckDuckGo, DuckDuckGo's own onion service, and Ahmia — the index of onion services, which is how you find a .onion in the first place. Onion Search asks the last two together and merges them, so a search stays inside the Tor network end to end and still comes back with something when the onion web has nothing. Add your own if you prefer, clearnet or onion.
Results appear the moment an engine answers. The summary fills in beneath them — it never makes you wait, and you can stop it at any time.
A short summary of what the results actually say, written on your phone, with the pages it drew on listed underneath. Tap any of them to read the source yourself.
Standard, Safer and Safest, with HTTPS-Only on by default and per-site exceptions you can see and revoke. The screen says exactly what each level changes.
Open any site and tap the orb. Before you have typed a word, the browser has read the page — the publisher's own text, and what is on your screen right now.
It reads the page. Headings, article text, author and date — whatever the site publishes.
It looks at the screen. Text inside images, charts and photos, recognised on your device with Apple's Vision framework.
You just ask. Summarise it, pull out the key points, explain it simply, or question what it claims.
Screenshots are analysed on device and never stored or uploaded
The language model ships inside the app. There is no first-run download, no server of ours, and no account. A summary of what you just searched for is written on the phone that searched for it — which is the only version of this feature that belongs in a browser like this one.
Bring your own model instead, if you prefer. Connect Gemini, ChatGPT, Claude, Groq, Mistral, DeepSeek or Qwen with your own API key — or point the browser at a server you run. That path goes directly rather than through Tor, because a streaming response through three relays is unusably slow. The app says so plainly, it is off by default, and switching back to on-device takes one tap.
| Collect your data | There is no backend. Nothing about your browsing reaches us, because there is nowhere for it to go. |
| Track you | No analytics, no advertising SDKs, no identifiers. |
| Require an account | Install it and connect. That is the whole setup. |
| Keep cookies on disk | Cookies, caches and site storage live in memory and go when the app closes — the way Tor Browser treats a session. |
| Send pages to a server | Summaries and answers are generated on your phone, unless you connect a cloud model yourself — and the app tells you when you have. |
| Pretend to be Tor Browser | An app cannot match its fingerprinting defences, and this one says so rather than implying otherwise. |