The short version:
nothing.

Last updated 30 August 2026 · Applies to evil v1.0.0 development builds and to evil.st

1. This website

evil.st is a set of static files on a content delivery network. It sets no cookies, runs no analytics, embeds no third-party scripts and shows no advertising. Nothing you do here is profiled, and there is no account to create.

Two things are worth stating plainly rather than hiding:

• Web fonts. Typefaces are loaded from Google Fonts, which means your browser makes a request to fonts.googleapis.com and fonts.gstatic.com. Google receives your IP address and user-agent as part of that request. Self-hosting the fonts is on the list.
• Server logs. The CDN that serves these pages keeps short-lived request logs — IP address, timestamp, path, user-agent — for abuse prevention and traffic shaping. They are not used to build a profile, not enriched with anything, and not sold.

2. The browser

evil collects no usage data. Concretely, the following do not exist in the build:

• Usage statistics, event telemetry, or an analytics SDK of any kind
• A unique installation identifier, advertising ID, or hardware fingerprint sent anywhere
• A first-run ping, a connectivity check, or a "how are you enjoying evil?" survey
• Automatic crash reporting — crashes produce a local file, and nothing is uploaded unless you deliberately attach it to a report
• Google Safe Browsing lookups, which in their default mode disclose the URLs you visit

Your browsing history, bookmarks, open tabs, form data and downloads never leave your machine, because there is nowhere for them to go: no sync service, no cloud backup, no account.

3. Passwords and credentials

Saved passwords are stored in your profile directory, encrypted with a key held by the operating system's credential store: DPAPI on Windows, Keychain on macOS, kwallet or gnome-keyring on Linux. They are decryptable only by your user account on that machine. A copied profile will not open elsewhere.

Imported passwords take the same path — read from the source browser, re-encrypted locally, never transmitted.

4. Update checks

The only request evil makes on its own initiative is an update check against updates.evil.st, roughly every 12 hours. It sends:

• The current version string, e.g. 1.0.0
• The platform and architecture, e.g. macos-arm64
• The release channel, e.g. stable

It does not send an identifier, a cookie, a profile count or anything about your browsing. The server sees the IP address any HTTP request carries; those logs are kept briefly for abuse prevention and then discarded. Disable the whole mechanism at evil://settings/updates if you would rather update by hand.

5. What the browser talks to, and when

6. Third parties you bring with you

A browser is a window onto other people's software. The websites you visit, the search engine you choose and the extensions you install all have their own data practices, and this policy cannot reach them.

Two consequences worth being clear-eyed about: an extension granted access to all sites can read every page you open, whatever the browser does about fingerprinting; and DRM-protected playback runs a proprietary Widevine module that is subject to Google's terms, which is the price of Netflix working.

7. What this does not protect you from

Fingerprint randomization raises the cost of passive tracking. It does not make you anonymous.

• Your IP address is visible to every site you visit and to your network provider. Use a VPN or Tor if that matters to you.
• Logging into an account identifies you to that account's owner, unavoidably and by design.
• An adversary who can observe your network, or who controls your device, is outside what any browser can defend against.

If your threat model includes a state-level adversary, use Tor Browser. It is purpose-built for that, and this is not.

8. Children

evil is a general-purpose browser and is not directed at children. Since no personal data is collected from anyone, none is collected from children either.

9. Changes to this policy

Material changes will be dated here and noted in the changelog. This page lives in a public git repository — evil-browser/evil.st — so every earlier version of it, and every edit, is part of the public record rather than something quietly rewritten.

10. Contact

Privacy questions go in the issue tracker. Security reports go privately to security@evil.st or through GitHub's private reporting — the full policy is in SECURITY.md.