Short version: the app has no accounts, no analytics, no advertising, and no servers of ours. Traffic goes through the Tor network and the AI runs on your phone.
Last updated 11 September 2026
Nothing. DarkDeepWeb has no backend. We operate no server that receives your searches, the pages you visit, your questions, or any identifier. We cannot see what you do in the app, because none of it reaches us.
Every request the browser makes — pages, searches, images, scripts, even site icons — is sent through the Tor network by a Tor daemon running inside the app. Tor relays each request through three volunteer-run computers chosen at random. The first knows your device but not where the request is going; the last knows where it is going but not who sent it. No single relay knows both.
This means the websites you visit see a Tor exit relay's address, not yours. It also means your internet provider can see that you are using Tor, but not which sites you open.
Nothing loads until Tor is connected. If the connection drops, requests fail — the app does not quietly fall back to an ordinary connection.
The following is stored locally, in the app's own container, and is deleted when you delete the app:
Cookies, caches and site storage are never written to disk. They live in memory only and are gone when the app closes, the way Tor Browser treats a session. "New identity" clears all of it plus every Tor circuit in one step, so nothing links what you do next to what you did before.
The app ships with a Llama 3.2 1B model that runs entirely on your device through llama.cpp. When it summarises search results or answers a question about a page, that computation happens on your phone. The text never leaves it, and it never touches the Tor network either — because it never goes anywhere.
When you tap the assistant on a page, the app reads that page to answer well: the text the publisher provides, and — if "Read the screen too" is on — a screenshot of the current view analysed with Apple's on-device Vision framework for text recognition, scene labels and face detection (counting faces present; no attempt is made to identify anyone). Both are used only to form the prompt for the on-device model. Screenshots are never stored and never uploaded.
It is optional, off by default, and used only while you have it selected. If you turn it on, you should assume the provider learns both what you sent and where you are.
If you enter an API key for a provider such as Gemini, ChatGPT, Claude, Groq, Mistral, DeepSeek or Qwen — or configure your own endpoint — then while that engine is selected, your questions and the relevant page or search text are sent from your device directly to that provider so it can answer.
Data you send to a third-party provider is governed by that provider's privacy policy, not this one.
Searching sends your query — through Tor — to the engine you have selected: DuckDuckGo, DuckDuckGo's onion service, Ahmia, Onion Search (which asks Ahmia and DuckDuckGo Onion in turn), or one you configure yourself. Opening a result loads that website, also through Tor. This is ordinary browsing: those services receive the request from a Tor exit relay and handle it under their own policies. We add nothing to it and receive no copy.
Choosing an onion service — DuckDuckGo Onion, Ahmia or Onion Search — means the request never leaves the Tor network at all, so no exit relay is involved.
The app requests no location, contacts, photos or camera access, and it refuses camera and microphone requests from web pages outright rather than prompting you. Websites cannot send you notifications — the browser engine has no support for it.
The app is a web browser and displays whatever the web returns, including content reached over the Tor network. It is rated 17+, is not directed at children, and collects no information from anyone.
If this policy changes, the revised version will be posted here with a new date. Material changes will also be noted in the App Store release notes.
Questions about privacy: sivavimelrajhen@gmail.com