Visiting this website
The website requires no registration, has no forms that collect information and uses no third-party visitor analytics or ad-tracking scripts. Normal page requests still pass through hosting and network services (including a CDN); the origin server’s Nginx keeps access logs, which may include the IP address, request path, time, status code, referrer and browser User-Agent.
Pages with download buttons query GitHub’s public Releases API for the app version, so GitHub receives that request. If the query fails, the page keeps its static download links; when you click an installer, GitHub serves the file.
Browser profiles in the app
Profiles, cookies, cache, extension data, proxy credentials and browsing history are stored on your device by default and are not uploaded to Prism servers. Proxy passwords are encrypted with the system’s secure storage (macOS Keychain / Windows DPAPI) when available and are never sent back to the interface. The proxies you configure handle the corresponding browsing traffic; the websites you visit and the extensions you install have their own data practices.
Exported cookie files and full backup folders are not encrypted and may contain login credentials; the “migration package” for all profiles is encrypted with the migration password you set. Local diagnostic logs redact passwords, tokens and authentication headers, and rotate at 5 MB.
Network requests the Prism app makes
“Local-first” does not mean the app never goes online. Based on the 0.3.17 app code:
- Proxy checks: For connection tests, the re-check before launch and the re-check every 5 minutes while running, the app contacts ipwho.is and ipapi.co through that profile’s proxy (api.ipify.org if those fail) to get the exit IP and location; the requests do not include the profile name, proxy credentials or browsing data.
- Announcements and ads: The app reads Ed25519-signed product announcements and text ad content; ads appear in both Community and Pro, and a link opens in your system browser only when you click it.
- Pro license: Activation sends the activation code and its hash, the device public key and a device ID derived from it, the app version, OS platform and CPU architecture. After activation, the app checks the license status online about every 15 minutes and renews it periodically. The device identity comes from a key generated randomly on your computer; hardware serial numbers are not collected.
- App updates: When the installer is configured with an update source, the app reads a signed update manifest after startup to check for new versions; nothing is installed silently.
- Kernel and extension downloads: When Pro downloads a new kernel, it reads a signed version catalog and downloads over HTTPS; installing an extension from the Chrome Web Store downloads the package from Google’s official servers.
- Default startup page: A new profile’s default startup page is this site’s home page, so opening the profile visits prismbrowser.app; you can change it in “Startup Pages”.
Behavior on each platform and version is defined by the actual app and its release notes; the historical public source does not necessarily match the current installers.
After you connect AI
MCP connects Prism and your AI client locally and exposes only the profiles you allow. The AI can read web page content in those profiles, including values already entered in forms (the app also warns that this includes “passwords you provide”); whether the AI client sends this content to a remote model depends on the data policies of that client and the model service. A local MCP connection does not make the whole AI workflow offline. Prism’s MCP audit log is stored on your computer and records only actions and results, not typed text or page content.
What you can do
- Enable AI control only for the profiles that need it, and revoke access or stop MCP when you are done.
- Keep exported cookie files and backup folders safe; prefer the encrypted migration package for moving between devices.
- Remove credentials and personal information from feedback, screenshots and public logs.
- Before using external proxy, AI model or payment services, check how they handle your data.
For product information and feedback channels, see About and contact; for verifiable public code, see Open source.