Firn is a calm browser for the Mac, and privacy is part of that calm. There's no account to make, no analytics, and nothing about your browsing sent to me. What you do in Firn stays on your Mac.
This page explains exactly what Firn keeps, what it sends, and to whom, in plain words. Firn is open source, so you don't have to take my word for any of it: every line is on GitHub.
No account, no tracking, no telemetry
Firn doesn't ask who you are. It doesn't count how often you open it, which buttons you press, or which sites you visit, and it doesn't report crashes or "usage statistics" anywhere.
Every space is its own browser
Most browsers keep one pile of cookies and sign-ins and let everything share it. In Firn, each space is truly separate.
Work and Personal each have their own:
- sign-ins and cookies
- site data, like what a site saves to remember you
- history and recently closed tabs
- Basecamp, groups, and tabs
Signing into Gmail in Work doesn't sign you into Personal. A shopping site you visit in Personal can't see what you did in Work. The command bar and address suggestions only ever show the space you're in.
Sharing is your choice. When you make a new space, you can keep it separate (the default) or have it share sign-ins with one other space. A shared space says so plainly, and you can stop sharing at any time. It then starts fresh, signed out of everything.
Deleting a space deletes its data. Its tabs, cookies, sign-ins, and site data are erased from your Mac. If another space shares them, they stay until that space is gone too.
Ads and trackers, blocked
Firn blocks ads and trackers from the moment you open it, using the public EasyList and EasyPrivacy lists. The lists are built into the app, so blocking never has to phone home to work.
If a site breaks, open it and choose Stop Blocking on that site in the View menu. That only changes the one site, in the one space.
What Firn sends, and to whom
Besides the websites you visit, Firn makes only these requests on its own.
Site icons. To show a site's icon in your sidebar, Firn asks that same site for it, without its cookies or your sign-ins, so the request can't be tied to you. The welcome fetches the suggested sites' icons the same way, from those companies' own servers.
Scam checks. Firn uses macOS's own Safe Browsing service, the same one Safari uses. It keeps a list of known scam sites on your Mac. When a page might be on that list, it asks Apple using a short code calculated from the address, never the address itself. If the site is a known scam, you'll see a warning instead of the page.
Search suggestions, only if you turn them on. They're off by default. If you turn them on, your search engine sees what you type in the address bar as you type it, without your cookies or sign-ins. Your searches themselves go to the search engine you choose: Google by default, or Bing, DuckDuckGo, or Ecosia in Settings.
Update checks. Once a day, Firn asks firnbrowser.com whether a new version is out. Only Firn's version number goes along, nothing about your browsing. firnbrowser.com passes the question on to Firn's page on GitHub, where the list of versions lives. A new version downloads from GitHub, and Firn installs it only if it carries Firn's own signature. Firn asks before it starts checking on its own, and you can turn checks off in Settings.
Nothing else. No analytics, and nothing about what you do in Firn.
What stays on your Mac
Your tabs, spaces, Basecamp, groups, and settings are saved on your Mac so they come back when you reopen Firn. Each space's cookies, sign-ins, and site data are kept on your Mac, separately for each space.
All of it lives in Firn's own sandbox folder (~/Library/Containers/), where other apps can't reach it. None of it is uploaded anywhere.
Saved passwords are kept in your Mac's Keychain, and can only be read while your Mac is unlocked.
Firn's own logs never record the addresses you visit.
Tabs that tidy themselves away are deleted for good 30 days after they're tidied, or as soon as you close them. Firn remembers your last 30 closed tabs so you can bring one back with ⇧⌘T.
Camera and microphone
A site can only use your camera or microphone after it asks and you click Allow. Firn shows which site is asking, and if it's a part of another page, which page it's on. Don't Allow is always the default. Only secure (https) sites can ask at all, and a yes lasts only while that tab is open.
Built to keep your data in
Firn runs in Apple's App Sandbox, which walls it off from the rest of your Mac. It can only touch what it's given:
- the internet, to load web pages
- files you pick yourself, in an Open or Save window
- your Downloads folder, for downloads
- your camera and microphone, only after you allow a site
- printing
- macOS's Safe Browsing service, for scam warnings
- its own place in your Keychain, for saved passwords
- Arc's list of spaces and tabs, read only, when you bring them over from Arc
- Firn's updater, which puts a new version in place
Nothing else on your Mac is open to it. Every web page is treated as untrusted, and Firn's own helpers inside pages run walled off from the page itself, so a site can't reach into Firn.
What Firn can't promise
The sites you visit can still see you visit them, like they would in any browser. Firn blocks the trackers it knows about, but no list catches everything. And when you sign in to a site, that site knows it's you. Firn keeps those sign-ins in their own space; it can't make a site forget you.
If Firn ever needs to send something new, this page will say so first, in plain words.
This website
firnbrowser.com keeps the same promise. It has no cookies, no analytics, no trackers, and no scripts or fonts from anyone else: everything on it loads from firnbrowser.com. Cloudflare hosts it, so like any web host, Cloudflare handles each visit to deliver the page.
The download button takes you to GitHub, where Firn's releases live. Links to Reddit, Threads, Ko-fi, and GitHub Sponsors take you to those sites, which have their own privacy policies.
If you email [email protected], Cloudflare forwards it to me, and I read it myself.
Questions
Firn is open source under the Mozilla Public License 2.0. You can read the code, or ask a question, on GitHub, or email [email protected].