Effective October 12, 2026 · version 1.9
This policy covers the loaf Mac app, tryloaf.app, downloads.tryloaf.app, and support provided by Owen Van Vooren, an independent developer in Minnesota, United States. Contact: hi@tryloaf.app. “I” and “me” mean Owen. Third-party websites, extensions, search engines, and connected services have their own policies.
Using loaf does not require signing up or providing an email address. Accepting the app’s terms does not send me your identity or contact details.
What stays on your Mac
loaf does not include developer-operated browsing analytics, advertising tracking, or telemetry. I do not receive a feed of your browsing history. Profiles, history, favorites, tabs, notes, checklists, preferences, extension data, and website storage are kept locally. If you enable optional iCloud sync, the limited profile, tab, and settings data described below is also stored in your private iCloud database. Website storage can include cookies, sign-in sessions, caches, and permissions. Saved passwords and connected-account credentials are stored using macOS Keychain. Downloads are transferred through a temporary local file and saved to the location you choose.
Download permission prompts are on by default. Before saving the first download from a website, loaf asks whether to allow downloads from that exact site, including its subdomain, scheme, and port. Redirected downloads use the final download site; files generated by a page use that page’s site when identifiable. Your allow or block choice is stored locally in the current profile. It does not apply to other profiles, parent domains, or sibling subdomains. You can change or reset it in website settings. The app-wide prompt toggle is in website settings; turning it off allows downloads from undecided sites without saving an allow choice, while existing site blocks remain in effect. The initial website request can occur before the prompt appears. These prompts do not govern loaf’s app updater or extension installation.
Browser importing is optional. When you open the importer, loaf checks installed apps’ browser registrations and signing entitlements to show a local browser picker. It reads source profiles only after you choose a browser or file. Choosing the browser’s data folder in a file picker is the preferred way to allow import access. Full Disk Access is optional unless macOS continues to block the source files you chose; it is not required simply because you chose to import cookies or omitted passwords. Protected cookies may need separate file or Keychain access. Access checks read only the selected browser’s source locations; they do not inspect unrelated protected files or claim to read the system’s Full Disk Access switch. If you change Full Disk Access in System Settings, quit and reopen loaf before retrying. History, bookmarks, tabs, and supported cookies are imported locally. Database imports use private temporary copies, including pending database records, and remove those copies when the read finishes. Source databases are not modified. Cookies and opening imported tabs are off by default and require your selection. Opening imported tabs makes normal requests to those websites. If you explicitly choose to unlock Chromium cookies, macOS Keychain may ask you to authorize access to that browser’s cookie key. Source browsing data and cookie keys are not uploaded, and loaf does not save a copy of the source cookie key. Some protected or partitioned cookies cannot be transferred.
Deleting a regular profile removes its tabs, history, bookmarks, saved passwords, cookies, website storage, and installed extensions from loaf on this Mac. Downloaded files are kept. If macOS or WebKit delays cleanup, loaf keeps a local record of the profile identifier and retries cleanup on a later launch; that profile is excluded from session restoration. Readable automatic session backups are scrubbed for that profile. This does not erase copies made by your backup software or other services. You must keep at least one regular profile.
Local does not mean inaccessible to everyone. Other people with access to your Mac, your backup software, macOS services, and extensions you permit may have access under their own settings and permissions. I cannot remotely inspect or erase your local browsing data.
Private profiles use temporary WebKit website storage and do not save browsing history in loaf. Private browsing is not anonymity: websites, extensions, your network operator, and connected services can still receive requests. Files you download, credentials or favorites you deliberately save, and data retained by outside services can remain after a private session ends.
Download permission choices made in a private profile stay in memory for that private session. They are not written to disk or copied to regular profiles, and are discarded when the private profile closes. Cancelling a permission prompt does not save a decision.
Optional iCloud sync
iCloud sync is experimental and off by default. You can enable it in loaf’s sync settings on each Mac signed in to the same Apple Account. No loaf account is required. Enabling sync authorizes loaf to merge this Mac’s eligible profiles and settings with your iCloud copy and upload later changes while sync remains enabled.
Sync includes regular profile identifiers, names, icons, colors, order, ad-blocking and cookie-blocking preferences; pinned website tabs and groups, their names and order; start-page colors, widget layout, and appearance; selected browser preferences such as search engine, tab behavior, and interface appearance; and lists of open website tab titles and full addresses, associated profile identifiers, a random installation identifier, your Mac’s name, and the time its tab list changed. Synced addresses can include search terms, query parameters, fragments, and other sensitive information contained in a URL. Pinned tabs and groups appear in their profiles across syncing Macs. Ordinary open tabs appear under “other Macs”; opening one makes a local tab and a normal request to that website. Closing that copy does not close the original tab on the other Mac.
Private profiles and their tabs never enter the sync payload. Sync does not upload browsing history, bookmarks, cookies, website sessions or storage, passwords, passkeys, connected-account credentials, extension installations or data, site permission decisions, notes, checklists, downloads, local files, custom background images, or local browsing-time records. Saved chat transcripts are included only if you separately enable chat transcript sync, as described below. Addresses containing embedded usernames or passwords, internal browser pages, file URLs, and local-network addresses recognized by loaf are excluded. Search-suggestion and remote-discovery opt-ins, current-location weather, the selected weather city, download locations, and device-specific permissions and settings remain local. Receiving a synced profile does not sign you into its websites.
loaf uses Apple’s CloudKit service and your private iCloud database. Sync payloads use CloudKit encrypted fields; connections to iCloud are encrypted in transit. Apple operates the service and processes account, network, storage, and record metadata under its own policies. iCloud’s data protection and account recovery are managed by Apple and your account settings. I do not receive your synced tabs, profiles, settings, or Apple Account identity through loaf’s sync feature.
Eligible edits are queued in a private local sync file while offline and retried when iCloud is available. If that file becomes unreadable, sync pauses; the local-cache repair action retains the old file as a private backup and resets sync metadata without removing local browser data or your iCloud copy. Such backups remain on your Mac until you remove them. Devices may temporarily show different data. Separate setting edits and pinned-item edits are merged; simultaneous edits to the same field or item resolve deterministically, so one edit can replace another. Permanent profile deletion records prevent an offline Mac from restoring a removed profile. Pinned-item deletions use the same deterministic conflict ordering as pinned-item edits; concurrent edits can win. If the Apple Account changes or signs out, loaf turns sync off and retains local browser data. Turning sync on again deliberately makes the eligible local data available to the current account.
Turning sync off stops future transfers on that Mac and keeps both its local data and the existing iCloud copy. Deleting a synced regular profile while sync is enabled removes its shared profile and pins and queues deletion for other syncing Macs, which also perform their local profile cleanup. An offline or non-syncing Mac retains its copy until it receives that deletion; old tab-list copies can remain in iCloud until their originating Macs update them. Tab lists unchanged for more than 30 days are hidden from the other-Macs view, rather than erased from iCloud.
Use “remove loaf data from iCloud” in sync settings to delete loaf’s sync zone from the current account. This turns sync off on this Mac; other active syncing Macs turn it off when they receive the reset. Each Mac keeps its local profiles, tabs, and settings. To create a new iCloud copy afterward, turn sync on again deliberately. Deletion requires a working connection to iCloud; the app reports the result. Apple’s backups follow its own retention policies. Disabling sync or uninstalling loaf alone does not remove the iCloud copy. I cannot remotely erase your local or private iCloud browser data.
Saved chats and optional transcript sync
Regular-profile chats can be saved locally, including questions, answers, citations, attached page text, and image attachments. The archive is encrypted with a key stored in macOS Keychain. Private-profile chats are never saved or synced. Removing a saved chat removes it from the local archive; deleting a profile removes its local chats too. Temporary permissions to read pages or capture screenshots are not restored from saved chats.
Chat transcript sync is a separate option, off by default, and requires iCloud sync and iCloud Keychain. When enabled, regular-profile transcripts and attached page text are encrypted before upload to your private iCloud database. The encryption key uses iCloud Keychain so your other Macs can unlock the transcripts. Image attachments and captured screenshots stay in the encrypted local archive and are excluded from transcript sync. Apple operates both services. I do not receive your transcripts or encryption key. Turning transcript sync off retains local chats and any existing iCloud copy; use “remove loaf data from iCloud” to remove loaf’s cloud sync zone.
Requests that leave your Mac
Browsing necessarily sends requests to the sites you visit and their service providers. They can receive your IP address, browser information, cookies, page requests, and anything you submit. loaf’s privacy policy does not control those sites.
Some loaf features also contact outside services:
- Search and suggestions. Your chosen search engine receives submitted queries. In a fresh installation, search suggestions are off by default. You can turn them on during setup or in search settings; they then use your selected suggestion provider (Google initially). Existing saved choices are preserved when updating loaf. Remote suggestions are off in private profiles and are not requested for URL-like input. When suggestions are enabled, the relevant provider can receive text as you type. Supported suggestion services include Google, DuckDuckGo, and Wikipedia. Custom search providers receive the queries you route to them.
- Weather. City search uses Open-Meteo’s geocoding service. Forecasts use Open-Meteo or Apple WeatherKit when available and configured. Requests contain the selected city or its coordinates. No weather city is configured by default, so forecast requests begin only after you choose one. Current-location weather is optional and requests macOS location permission only when you enable it. When enabled, loaf uses the location supplied by macOS for forecasts; significant location changes can trigger an immediate forecast refresh up to three times per calendar day, while normal forecast refreshes reuse the latest location. loaf does not send your device location to me.
- Site discovery and icons. Visiting sites and displaying remote site icons can contact those sites or their icon hosts. Remote site discovery is off by default. When you turn it on in search settings, loaf can fetch Mozilla’s top-sites catalog and use Google suggestions to discover sites. An offline catalog is also available.
- Domain validation. loaf periodically downloads IANA’s public list of top-level domains to validate address suggestions. The list is cached locally and refreshed weekly while the app is running; failed downloads retry hourly. These requests contain no typed input or browsing history. A bundled list and the last successful download remain available offline.
- Ad and tracker blocking. Blocking happens locally. Ad and tracker blocking is on by default and uses bundled local filter data. Filter updates are requested explicitly rather than uploading activity. A requested filter update downloads AdGuard’s filter from its hosting provider. That request does not upload your browsing history.
- Extensions. Installing or updating extensions contacts their distribution services. Extensions may access page content, browsing activity, cookies, or other information allowed by their permissions, and can send information to their own providers. Chrome extension support is experimental. Only install extensions you trust.
- Optional AI and page summaries. AI features are available by default but only run when you ask. You can turn them off in intelligence settings. Page summaries use the page text you choose to share; automatic provider selection prefers Apple Intelligence on this Mac when available and otherwise uses your connected ChatGPT account. A cloud summary still requires attachment-sharing permission. You can select a separate summary provider and model.
- ChatGPT. Connecting ChatGPT sends account authorization requests to OpenAI. OpenAI receives prompts and conversation context you submit, including page text, selected excerpts, additional tabs, and images you attach. Model availability depends on your account. Requests ask the API not to store the response, but OpenAI’s terms, security controls, and retention rules still apply. Disconnecting removes loaf’s saved credentials and attempts remote revocation.
- Claude. Connecting Claude requires an Anthropic API key, stored locally in macOS Keychain and excluded from iCloud sync. loaf sends the key to Anthropic to fetch your available models and authorize requests. When you select Claude, Anthropic receives the prompts and conversation context you submit, including approved attached page text. Anthropic’s terms, security controls, and retention rules apply. Disconnecting deletes the key from loaf’s Keychain entry and stops active Claude requests; it does not revoke the key at Anthropic.
- AI web tools, attachments, and screenshots. Sharing attachments with a cloud provider requires permission in that conversation. You can inspect the page text before sharing it. Side chat can request web searches and public-page reads, with permission controls in the conversation. An approved search sends the displayed query to Google, with DuckDuckGo as a fallback; approved page reads contact those websites, and their returned evidence can be sent to the selected AI provider with the conversation. Side-chat search queries are not automatically expanded with attached page text or previous questions. Full-page AI answers can use recent questions to establish the subject of follow-up searches. Google, DuckDuckGo when used, and retrieved websites receive normal network metadata. Public-page retrieval uses temporary sessions without your existing website cookies or saved logins. Attaching an already open tab reads its loaded content locally and shares the selected text with the chosen provider; it does not give the provider control over that tab. Sharing a screenshot of the visible page requires approval in the chat; the preview lets you inspect it before sending. Approved screenshots can contain information visible on that page. Image attachments and screenshots currently require a compatible ChatGPT model. Search requests can happen in private profiles when you submit and approve them.
- Apple Intelligence. Apple Intelligence processes model requests on this Mac using Apple’s supported system frameworks, but approved web searches and page reads still contact outside services. Apple Intelligence options are hidden when the system model is unavailable. Availability and processing are governed by Apple and your system settings.
- Updates and downloads. Automatic update checks are on by default in the distributed app and begin only after first-use agreement; you can change them in the updater’s preferences. Sparkle checks the update feed and downloads updates from loaf’s website and CDN. Requests expose network information and can include app and updater versions. Sparkle may send additional system information if you choose its system-profile option. Update checks do not send browsing history. Check the updater’s preferences for automatic-check controls.
- Platform services. WebKit’s fraudulent-site warnings, macOS permissions, and other Apple services can involve processing governed by Apple. Site requests for camera, microphone, location, and notifications are subject to browser and macOS permission controls.
The receiving service generally sees your IP address and request metadata, even where the requested content contains no personal information. Use loaf’s feature settings, extension controls, account controls, and macOS permissions to manage optional features. Information you submit to a third party is governed by that party’s policy, including Apple, OpenAI, Google, and Open-Meteo.
The website and CDN
Cloudflare hosts the website and downloads, operates security protections, and stores submitted bug reports on my behalf. Serving and protecting requests can involve your IP address, request time and path, browser or device information, headers, and security signals. Cloudflare may use security cookies or challenges. Its infrastructure processing is described in Cloudflare’s privacy policy.
The site has no developer-installed advertising trackers or visitor analytics. All website fonts, including Satoshi, are self-hosted and served through Cloudflare. Viewing the site does not request fonts from Fontshare or another outside font service. Any local browser state used for site interactions stays in your browser unless a feature explicitly submits it.
Bug reports and email
Reporting a bug is optional. A report contains the category, summary, description, app version and macOS version you enter, and an optional email address. I use it to investigate problems, prevent abuse, and contact you about your report if you provide an address. Do not include passwords, tokens, private browsing records, or information you do not want to share.
Reports are stored in a private Cloudflare D1 database. There is no public report inbox. The reporting feature does not store raw IP addresses, user-agent strings, browsing history, or automatically collected diagnostic logs. Cloudflare can still process raw request metadata at the infrastructure layer.
To limit spam, the server uses a secret-keyed hash of the request’s IP address. The hash is used for the reporting rate limit, not to follow your browsing. Its one-hour window expires, and hourly cleanup removes it within at most two hours. Separate infrastructure protections may also temporarily process request data.
Emailing hi@tryloaf.app sends the message and any attachments you choose through your email provider and mine. I receive your address and message. Bug reports and correspondence are not automatically posted to GitHub or sent to a public forum. Providing an address does not subscribe you to marketing or a mailing list. Contact details may also be used for necessary legal correspondence, consistent with applicable law.
Purposes, sharing, and retention
I process information to deliver requested downloads and support, investigate bugs, secure the services, prevent abuse, and meet legal obligations. I do not sell personal information or share it for cross-context behavioral advertising. I do not use your browsing history to build advertising profiles.
Access is limited to me and service providers needed to run the service. Information may also be disclosed when legally required, to investigate fraud or security incidents, or to protect legal rights. If ownership of the service changes, applicable privacy commitments continue to apply; material changes will be communicated where required. I do not disclose support content to unrelated parties for their marketing.
A first-use agreement receipt is stored only on your Mac. It contains the accepted terms, document versions and hashes, acceptance time, and app version/build. It is not uploaded or used as analytics. It remains until you remove it with loaf’s local support files; removing it means you will be asked to accept again. Local data remains until you remove it, delete its profile, or otherwise clear it through the app or macOS. Uninstalling the app alone may leave support files or Keychain entries. Bug reports, including their text, optional email, and version fields, are automatically deleted from the active reporting database at the earlier of 12 calendar months after resolution or 24 calendar months after submission, even if unresolved. Cleanup runs hourly after the expiry time. Reopening a report clears its resolution date; resolving it again starts a new resolution period, but never extends the 24-month submission limit. Correspondence is retained only as needed to investigate, follow up, maintain necessary support records, and meet legal obligations. Ask me to delete a report or correspondence you submitted. Information from a report is retained outside the active database only when needed for a specific legal obligation or dispute, with access restricted and deletion when that need ends; routine support does not justify an indefinite exception. Provider logs and backups may follow separate retention schedules and may not disappear immediately when a primary record is deleted.
Your choices and rights
You can clear local browsing data, remove profiles and extensions, disconnect accounts, disable optional online features, and choose not to submit a report or email. For information I hold, contact hi@tryloaf.app to request access, correction, deletion, a copy, restriction, or objection to processing, or to withdraw consent where processing relies on consent. Rights and exceptions depend on applicable law. I may need reasonable information to verify a request, and will explain any lawful reason I cannot fully comply. I do not discriminate against you for exercising privacy rights.
Where EEA or UK law applies, the legal bases are providing services you request, legitimate interests in operating and securing the service and responding to support, consent where required for an optional feature, and legal obligations. Withdrawing consent does not change the lawfulness of earlier processing. You may complain to your local supervisory authority. Where other privacy laws apply, including Minnesota law when its coverage requirements are met, applicable access, correction, deletion, portability, appeal, and opt-out rights are honored. To appeal a denied request, reply to my decision at the same email address.
Information sent to support or the website may be processed in the United States and other locations used by service providers. Where international-transfer protections are legally required, processing must use an applicable lawful transfer mechanism and safeguards. Third-party accounts and services manage their own transfers. Contact me for information about safeguards applicable to information I hold.
Security and children
I use access controls, private storage, encrypted network connections, and Keychain where appropriate. No software, storage system, or transmission can be guaranteed secure. Report a suspected security issue privately to hi@tryloaf.app; avoid sending exploit details through a public channel. Legally required incident notifications will be provided when applicable.
loaf is a general-purpose browser, not a service directed to children under 13. I do not knowingly solicit personal information from children under 13. If a child has submitted personal information to me, a parent or guardian can request its removal. Third-party sites have their own age requirements.
Changes and contact
The effective date and version identify the current policy. Material changes will be posted here and included with the affected app version, with additional notice or consent when required. Where individual notice is required, a general website post alone does not substitute for it. A new policy does not authorize uses of previously collected information that require fresh consent. Questions or requests: hi@tryloaf.app.