Privacy
What stays on your Mac, and what goes to your provider
Your history, passwords and agent threads live on your Mac. Rill’s AI features run the Claude Code or Codex you already use, and each one sends what it needs to that provider, under your own account. This page describes Rill Browser (Beta), version 0.1.7.
Who we are
Rill is made by Manifold AI Inc. (“we”). Questions about this page, or about your data: contact@rill.love.
What goes to your provider
Every AI feature in Rill runs the Codex or Claude Code CLI installed on your Mac, signed in to your own account. Codex sends to OpenAI and Claude Code sends to Anthropic, under that account’s terms. Tab groups, day episodes, search, routing and project areas use the provider set in Settings › Agents › Answer with. Tasks use the one in Send tasks to. Nothing from a private window is sent.
| Feature | When it runs | What is sent |
|---|---|---|
| Tab groups | When the start page opens, and after your tabs and your Mac have been quiet for 2 minutes, with 3 or more page tabs open and one not yet grouped (on unless you turn it off); and when you choose Organize tabs | Titles, addresses, hosts and opener links of open tabs in normal windows. A local file’s tab sends its path. No page text. |
| Day episodes | Once 15 of today’s visits are waiting, when History opens with visits waiting, and when you choose Describe this day | For each new visit: title, address, local time, tab numbers and up to 280 characters of page text. Also the day’s last episode. |
| Find a page you remember | When you search with Describe | A read-only agent searches your Rill library (history with page text, day episodes, kept passages, the project index), and what it reads is sent. Exact words searches on your Mac only. |
| Routing a task | Each new request sent without a chosen project | Your request; the page’s address and title with the selection or its first 2,000 characters of text; the project catalog (names, folders, stacks, descriptions, README excerpts, git remotes, latest commit subjects, session titles). When a page is on screen that you did not attach, routing is told only that there is one: not its address, its title or its text. |
| Search deeper | When the quick routing pass is unsure, or when you choose it | A read-only agent reads the project index Rill keeps, and what it reads is sent. |
| Project areas | When Projects first has 6 or more projects; again when 8 or more were added or removed, or a fifth of them changed, at most once a day; and when you choose Rearrange Areas | The project index: names, folders, stacks, README excerpts, commit subjects, session titles, and your own moves and area names. |
| Asking about a page | When you ask | Your question, the page’s address and title, and the selection or up to 18,000 characters of its text. |
| A task in a project | When you send one | Your request (with the page, when you sent it from one), and whatever the agent reads and runs. It is your own Claude Code or Codex with your own settings. |
| Finding a file | When you ask for a file from what you remember of it | Your request, and what the agent reads while it looks in Downloads, Desktop, Documents and iCloud Drive. |
| Agent tabs | When an agent opens or reads a page in a background tab | The pages the agent reads. |
| A task on the web | When you send a request that Rill shows as On the web or In this tab, and each time you reply to it or press Continue | Your request, and every page the agent reads while it works: the page’s address, title and text with its links, buttons and fields, and a picture of the page when the agent takes one. The agent works in ordinary tabs with your sign-ins, so it reads pages as you would see them. A page that shows a password, one-time-code or card field is not read or pictured while it shows one; the value of such a field is never sent, and the agent cannot type into one. When the task ends, or stops because it needs you, your request and the agent’s last message go once more to the same provider, which writes the short line shown in the bubble at the task’s tab. Nothing is read in a private window. |
| Talking (beta) | Off until you set it up. Then: when you hold the talk key, talk and release in a normal window, and the speech model is unsure of the sentence (about half of them) | The words recognized from what you said, to be proofread. A sentence the speech model is sure of is typed without being sent. Your voice is recognized on your Mac; the sound is never sent. In a private window, or with no agent signed in, the words are typed as recognized and nothing is sent. |
Pages with password, one-time-code or card fields are treated as sensitive: no feature sends their page text, and their visits are saved without text. A task on the web is held to the page instead of the whole site: it never reads a page while that page shows such a field, and it does read the site’s other pages, so that it can go on after you sign in.
The CLIs keep their own records of these runs. Codex writes session logs to ~/.codex/sessions and Claude Code to ~/.claude/projects for tasks and page questions, including the request and the page text sent with it. Tab groups, day episodes, routing, project areas and library searches leave no saved session.
What stays on your Mac
Rill keeps the folders you answered “Trust folder” for in its preferences, on this Mac. For a Codex task it also reads which folders Codex itself trusts from ~/.codex/config.toml, and nothing else in that file.
Everything Rill keeps is on your Mac, in ~/Library/Application Support/Rill unless a path below begins with ~ or /.
| Data | Where | What it holds |
|---|---|---|
| History | Library/history/YYYY-MM-DD.jsonl | Each page visited in normal windows: address, title, times, how you reached it, tab ids, time on screen and up to 8,000 characters of the page’s text. Sensitive pages and imported visits: address, title and times. |
| Day episodes | Library/index/days/ | Episode titles, summaries and the day’s sentence, written by your provider |
| Project index | Library/projects/ | Project folders, names, stacks, README excerpts, git remotes (credentials removed), latest commit subjects, session titles and the areas |
| Threads | Threads/ | Your requests, the page text sent with them, answers, tool calls and file diffs |
| Tabs and bookmarks | session.json | Addresses and titles of open tabs and of tabs you closed recently; bookmarks, with the folder and browser they were imported from |
| Back and Forward lists | PageStates/ | For each open and recently closed tab: the pages behind Back and Forward and where you had scrolled, so they are still there after you quit. Written when Rill quits; removed when you clear history. |
| Caches | Intelligence/ | Session titles and first messages from Codex and Claude Code logs, the project index cache, tab groups |
| Ad and tracker lists | ContentBlocking/ | EasyList and EasyPrivacy as last fetched and the blocking rules made from them. Nothing about your browsing: Rill keeps no record of what was blocked, or where. |
| Site icons | Favicons/ | One icon per site visited in normal windows |
| Site permissions | permissions.json | Your camera, microphone, location and notification decisions, per site, and the sites that play sound without a click because you turned their sound on |
| What you said | Speech/History | With Talking on: each recording and its words, for 30 days. Not kept for private windows. |
| Speech model | Speech/ | The model that recognizes your voice on your Mac, downloaded once when you set up Talking (228 MB) |
| Downloads list | downloads.json | Each download’s name, where it was saved, its address and the page it came from. Not kept for private windows. |
| Projects you added | projects.json | Folders you added in Projects |
| Run marker | running.json | Process id, launch time and version, while Rill runs |
| Saved passwords | The macOS Keychain | Each login you save or import: the site, the account name and the password. Kept in the Keychain, not in Rill’s files. |
| Settings | ~/Library/Preferences/love.rill.Rill.plist | Preferences, sites where Rill never offers to save a password, sites never saved in history, the downloads folder, per-site download rules, the zoom you set per site and the time of the last update check |
| Cookies, website data, cache | ~/Library/WebKit/love.rill.Rill, ~/Library/HTTPStorages/love.rill.Rill, ~/Library/Caches/love.rill.Rill | Cookies, website data and the cache for normal windows |
| Downloads | Your downloads folder | Files you download, marked so Gatekeeper checks them before they first open |
| Temporary files | /tmp and $TMPDIR | Per-task files while tasks run, and a copy of another browser’s history, cookie, password or site data files during an import. Each is removed when its task ends. |
Private windows keep cookies, site data and icons in memory and save no tabs, history or icons. Private windows open at the same time share one sign-in; closing the last one discards everything. Finished downloads stay in your downloads folder.
Who can read these files
- Your account. Rill’s folders are readable by your account only (0700), and so is every file it writes (0600).
- Other accounts on this Mac cannot read them. Administrators can.
- Any program running as you can, including the agents Rill starts. The files are plain text, so turn on FileVault in System Settings.
- Time Machine backs them up with the rest of
~/Libraryunless you exclude it.
Passwords
- Where. Passwords you save or import are in the macOS Keychain on this Mac, in the login keychain, labeled “Rill”.
- Who can read them. You, in Rill, after Touch ID or your Mac’s password: filling, showing, copying and editing ask once per unlock session, and locking or sleeping the Mac ends it.
- Not sent to agents or your provider. Passwords and field values are not part of what Rill sends to Codex or Claude Code, and agents’ tabs are not filled.
- Websites. A page gets a password only when you choose an account in Rill’s list, and only on the site it was saved for. An https password is never filled on an http page.
- Sign-ins from another browser. Importing from Chrome, Brave, Edge, Arc, Vivaldi, Opera or Firefox brings the checked sites’ cookies and their saved site data (localStorage) into the store your normal windows share, so those sites stay signed in too. Safari’s site data is not read. Private windows and agents’ tabs never receive imported sign-ins. Clear Browsing Data removes them like any other cookie or site data.
- One site at a time. File › Bring Sign-in From lists the browsers on this Mac and, for the page in front, whether each has a session for its site. Choosing one brings that site’s cookies, saved site data and passwords alone and reloads the page. The autofill list makes the same offer on a sign-in form when nothing is saved for the site.
- The browser’s key. Reading a Chromium browser’s cookies and passwords uses that browser’s key, which macOS asks you for once, from the login keychain. Rill holds the key until it quits or the Mac locks, sleeps or switches user, so a second import or a second site does not ask again. Firefox’s files are decrypted on this Mac with the key in the profile, with no prompt, unless the profile has a primary password.
- When the browser has not saved its sign-ins. A browser can keep running for days without writing its cookies to disk. The review sheet and the result then say when it last saved them and that quitting and reopening it first brings the current ones. Only the files’ dates are read.
- Nothing is sent. Imported cookies, site data and passwords stay on this Mac. No agent, model or server sees them.
- Passkeys do not work in Rill yet. Sign in with a password, or open the page in Safari.
Turning features off
Background features run on their own. Everything else runs only when you ask.
- Tab groups
- Settings › Tabs › Group tabs on the start page. Organize tabs still works when you choose it.
- History and day episodes
- Settings › History › Save history. With it off, Rill saves no new visits and writes no new episodes.
- Pages agents open
- Settings › History › Skip pages agents open keeps them out of your history. It is on unless you turn it off.
- How long history is kept
- Settings › History › Keep history: forever, 1 year, 90 days or 30 days. List sites that are never saved there too. Settings › Privacy clears browsing data for the last hour, today or all time.
- Search engine
- Settings › General › Search engine: Google, DuckDuckGo, Bing, Kagi or Ecosia. Searches you submit and search suggestions go to the one you choose.
- Ad and tracker blocking
- Settings › Privacy › Block ads and trackers. With it off, pages load everything they ask for and Rill fetches no lists. Allow Ads on This Site, in the page’s More menu, turns it off for one site.
- Sound without a click
- Settings › Privacy lists the sites that play sound right away because you turned their sound on. Set one back to “Plays after a click”, or Forget it.
- Search suggestions
- Settings › General › Show search suggestions. With it off, nothing you type in the address field leaves your Mac until you press Return.
- Which provider answers
- Settings › Agents. Answer with sets the provider for tab groups, day episodes, search, routing and project areas. Send tasks to sets the one for tasks.
- Tasks and page questions
- They run when you send them. Stop (⌥⌘.) ends a task and its website access.
- Clicks and typing on websites
- A task on the web clicks and types in its tabs to do what you asked. The agent is instructed to stop before the step that pays, places an order, sends, posts or deletes, unless you plainly told it to go through with it. In a project task, agents click and type in their tabs only for a request you send with Allow website clicks and typing turned on.
- Talking
- Settings › Talking. It is off until you finish its setup there. Keep what you say for 30 days turns the recordings off, and Delete All removes them. System Settings › Privacy & Security › Microphone turns the microphone off for Rill.
- Updates
- Settings › General › Keep Rill up to date. With it off, Rill looks for a new version only when you choose Check for Updates….
Websites
- Websites receive your normal browsing requests. While Block ads and trackers is on, requests to the ad and tracking services that EasyList and EasyPrivacy name are not sent.
- Every four days Rill fetches those two lists from easylist.to, one HTTPS request each, with the user agent
Rill/0.1.7and no cookies or identifier. - Site icons are fetched from the site you visit, without cookies.
- Your search engine (Google unless you choose another in Settings › General) receives the searches you submit from the address field and, while Show search suggestions is on, the words you type there. Never from a private window, and never an address.
- A task in a project gets its own temporary cookie store for the pages its agent opens: your cookies and logins stay with you. A task on the web is different: it works in ordinary tabs with your sign-ins, so the sites it visits see you as signed in.
- Setting up Talking downloads its speech model once, two files (228 MB) from huggingface.co. The requests carry no cookies and nothing about you; Hugging Face sees the request’s IP address, as any website you visit does.
- A site you allow to send notifications has them shown by macOS, as notifications from Rill with the site’s name. Rill keeps nothing of them. A site notifies only while it is open in a tab, and private windows show none.
- A site you allow to listen with speech recognition is heard through macOS’s own speech recognition, which can send what you say to Apple. macOS asks once for Rill itself before any site can use it.
- A site uses your camera, microphone or location, or sends you notifications, only after you allow it for that site; Settings › Privacy lists each decision. A site shares your screen or a window only when you press its share button and choose what to share in the macOS picker, each time; agents’ tabs never share the screen.
Updates
Rill keeps itself up to date. Every four hours while it is open, it asks rill.love for appcast.xml, over HTTPS. Its user agent is Rill/0.1.7 Sparkle/2.8.0: the version, and nothing else about you or your Mac. No identifier and no report about your Mac. When a newer version runs on your macOS, Rill downloads it from rill.love, checks it against Rill’s update key and its Developer ID signature, and installs it when you quit; a note says it is ready. Nothing else is downloaded or installed this way.
Versions before 0.1.3 do not update themselves: once a day they ask rill.love for releases.json in the same way and show a note with Download.
This website
rill.love doesn’t set cookies. It loads its fonts, images and film from rill.love.
The one exception is a visit that starts from an ad in ChatGPT. Then the page loads OpenAI’s measurement pixel, which sets two cookies on rill.love: the ad’s click reference, for 30 days, and a random browser reference, for a year. When you download Rill on such a visit, the pixel tells OpenAI, and rill.love sends OpenAI the same download with those two references and the time, so we can see how many downloads our ads bring. Nothing else about you goes with it. A visit that doesn’t start from an ad loads no pixel and sets no cookie. OpenAI handles what it receives under its own privacy policy.
To see how many people visit and which pages they read, rill.love uses Cloudflare Web Analytics. It counts page views and load times without cookies and without following you to other sites.
rill.love also keeps its own record of each request for a page, a disk image or the update list: the time, the page or file, the page you came from (without its query), any campaign tags in the address, your country, region and city and your network as Cloudflare reports them, your browser’s user agent and first language. A copy of Rill asking for the update list is recorded the same way, with its version.
When you leave or hide a page, it also reports how far down you read, how long the page was in view, your screen and window size, whether your Mac is set to dark mode or reduced motion, and which links you followed. These reports are recorded the same way.
Your IP address is not stored. To count visitors without a cookie, each record carries a code made from your IP address, your user agent and a random value that changes every day and is deleted when the next day starts. The code tells one browser from another within a day, and visits on different days cannot be linked to each other or back to you.
rill.love is hosted on Cloudflare Pages. Cloudflare handles each request, including your IP address, to serve and protect the site, under its own privacy policy.
Limits
- A task on the web acts as you. It works in tabs with your sign-ins. The agent is instructed to stop before paying, ordering, sending, posting or deleting; that is an instruction to the agent, not a lock.
- Prompt injection is reduced, not solved. Text on a page, in a README or in a commit can still steer what an agent says and does within its limits.
- Codex tasks can read any file your account can, and what an agent reads goes to your provider.
- Agents run with Rill’s macOS permissions. If you give Rill Full Disk Access to import from Safari, turn it off after the import.
- Agent tabs can reach local development servers and other devices on your network, such as a router’s page.
- Anything running as your account can read Rill’s files and the CLIs’ logs. Saved passwords are in the Keychain instead.
Security problems
Report a security problem privately to contact@rill.love. Include the Rill version (Rill › About Rill), your macOS version, and the output of codex --version or claude --version when an agent is involved.