Privacy
What leaves your Mac, and what never does.
Crank Browser decides what each part of a page is on your Mac. It has no account, no server of its own and no analytics. This page lists every way information leaves your Mac while you use it, so you can check it rather than trust it.
Requests Crank makes on its own
One: the update check.
At launch, and every six hours after, Crank fetches RELEASES.json from Crank's public releases repository on GitHub. The address is fixed and is the same for every reader: no version number, no installation or account identifier, no query string. Crank compares versions on your Mac.
GitHub, as the host serving that file, can see what it sees for any download: your IP address, the time and the HTTP client.
When an update is available, Crank downloads it from the same repository. That tells GitHub someone at your IP address moved to that version.
Only release builds check for updates, and only when Crank is in Applications. Settings (⌘,) names the host the updater talks to.
Requests the pages you open make
Pages load as they do in any browser: your Mac talks to the sites you open and whatever those sites load. This is by far the largest flow, and it goes to those sites, not to Crank. Crank reduces it:
- It sends Global Privacy Control, as a header and as the JavaScript property.
- It strips tracking identifiers from links you follow.
- It blocks requests to known ad and tracker hosts, using lists shipped inside the app. Crank never downloads those lists.
- It refuses consent where the consent platform allows refusal.
- Its user agent is the Chromium it runs on, in Chrome's reduced form, with nothing naming Crank, so its readers aren't marked out as a small group.
On a site you mark as trusted, you make those choices yourself: Crank sends no Global Privacy Control there, doesn't clean links to it, and leaves its consent banner for you to answer. On an excluded site (below) Crank changes nothing at all.
What stays on your Mac
- Your history, bookmarks, open tabs, downloads list and settings.
- Page content, in any form. Page judgement runs locally; there is no cloud AI.
- The weekly tally on the new-tab page: counts only, no addresses, never for an excluded site.
- The diagnostic log (below).
There is no crash reporter and no analytics code in Crank.
Diagnostics and feedback
By default Crank keeps a diagnostic log on your Mac: the pages it worked on, without query strings, and what it decided on them. It is never sent anywhere. You can pause it or record less in Crank ▸ Settings.
File ▸ Export Diagnostics… writes that log to a file in a place you choose. Nothing is transmitted; sending it is up to you.
Help ▸ Send Feedback… opens a draft in your own mail app addressed to connect@getcrank.co. Crank sends nothing itself. The draft includes the Crank build, your macOS version and, for an ordinary page on a site you haven't excluded, the site's host name (never the path), each marked so you can delete it before sending.
Sites Crank leaves alone
On these sites, and their subdomains, Crank changes nothing and records nothing. It's a fixed list of names, not detection: a bank or clinic that isn't on it is treated like any other site until you add it, in Crank ▸ Settings. Crank never removes a site from your list.
- Banking & payments
- chase.com, bankofamerica.com, wellsfargo.com, citi.com, hsbc.com, barclays.co.uk, lloydsbank.com, hdfcbank.com, icicibank.com, axisbank.com, sbi.co.in, onlinesbi.sbi, kotak.com, paypal.com, stripe.com, wise.com, revolut.com, coinbase.com
- Health
- nhs.uk, myhealth.va.gov, mychart.com, practo.com, 1mg.com
- Government
- gov.uk, irs.gov, ssa.gov, usa.gov, gov.in, incometax.gov.in, uidai.gov.in, digilocker.gov.in
- Mail & passwords
- mail.google.com, outlook.com, outlook.office.com, mail.yahoo.com, proton.me, protonmail.com, fastmail.com, 1password.com, bitwarden.com, lastpass.com
Never, in any version
These hold whether or not Crank ever has accounts or a paid tier.
- No browsing history, address, page content or search term reaches any Crank server. Not aggregated, not anonymised, not “just the host name”.
- No record of what Crank hid, labelled or restored is sent in the background.
- Nothing is collected on an excluded site.
- No advertising, no sponsored placement, no paid exceptions to Crank's rules.
- No selling or licensing of browsing behaviour, and no behavioural profile.
This website
No cookies, no analytics, no third-party requests: fonts and images are served from this site, and its Content Security Policy blocks everything else. The site is hosted on Vercel, which handles the request your browser makes for each page. Download links go to GitHub, which you reach only when you click.
Questions about any of this: connect@getcrank.co.
Reflects Crank 0.3.5, checked against its source on 27 October 2026.