Privacy notice
Hominis sends no telemetry, studies, crash reports or usage data. This page lists everything it does contact, and why.
Draft for legal review. The technical statements are taken from the Hominis source and its measured network census; the legal basis needs to be confirmed before publication.
In short
- Hominis sends no telemetry, studies, crash reports or usage data. There is no Hominis account, and no Firefox account or sync service.
- Your history, workspaces, notes, sketches and bookmarks are stored on your Mac. History never leaves it.
- A private session is kept in memory only. Nothing from it is written to disk.
- The AI features do nothing until you add your own API key, and then talk directly to the provider you chose.
- Websites you visit see what they would see in any browser.
Services Hominis contacts
Apart from the websites you visit, Hominis connects to these services. Like any internet request, each one sees your IP address.
| Service | What for | What it receives |
|---|---|---|
| Hominis update service updates.hominis.eu, mar.hominis.eu | Checks for new versions of Hominis and downloads them. | Your Hominis version and build, your Mac’s architecture, macOS version and basic system capabilities, and your language, as part of the update request. |
| Mozilla Remote Settings firefox.settings.services.mozilla.com and its content delivery hosts | Certificate revocation data, the extension blocklist and translation models. | Requests for these shared lists. Nothing about the pages you visit. |
| Mozilla add-ons (AMO) addons.mozilla.org | Installing and updating extensions, and blocklist details. | Requests for the extensions you install or have installed. |
| Media plugin updates aus5.mozilla.org, ciscobinary.openh264.org (Mozilla, Cisco); update.googleapis.com, edgedl.me.gvt1.com, www.google.com (Google) | The OpenH264 video codec, and the Widevine module some video sites need for protected content. | Plugin update requests. Hominis never bundles Widevine; it is fetched from Google. |
| Google Safe Browsing safebrowsing.googleapis.com | Updates local lists of known dangerous sites and downloads. | List update requests. Pages are checked against the lists on your Mac; the separate check that sends downloaded programs to Google is off unless you turn it on. |
The source repository publishes this list in machine-checked form (NETWORK.md), and every release is tested against it: a connection to any host not on the list fails the release.
Certificate revocation
Hominis does not ask certificate authorities about each site you visit (OCSP), because that tells them which sites you open. It checks revocation with CRLite instead: a compact list delivered through Mozilla Remote Settings and checked on your Mac. Turning off Remote Settings therefore also turns off revocation checking.
What Hominis turns off
Firefox features that contact Mozilla or others without a clear need are off in Hominis: telemetry and studies, crash reporting, the captive-portal check, the startup location lookup, and web push notifications. As a result, websites cannot send you push notifications in Hominis.
AI features
Generated applets, chat, combining sources and group name suggestions use a language model. They stay off until you add your own API key in Settings → Applets, and removing the key turns them all off again. A coming update adds a switch for each feature, so you can keep some on and others off. When you use one:
- Hominis sends your request, and any page, selection or tile you attached, directly from your Mac to the model provider (today Inception, at
api.inceptionlabs.ai). It sends no cookies and no identifying headers. - Your key is kept in Hominis’s password store and read only when a request is made.
- The provider’s own terms and privacy policy apply to what you send it.
- These features never run in a private session.
- Generated tools and conversations are stored on your Mac, and you can delete them in Settings → Applets.
Data on your Mac
- Browsing data: history, cookies, site data and the downloads list are stored in your profile. Settings → Privacy & security lets you choose how long history is kept and delete browsing data for a time range.
- Identities: each identity keeps its own cookies, separate from the others.
- Your export: Settings → General → Export all data saves everything Hominis stores in open formats in one .zip. Nothing is uploaded.
- Sharing a workspace creates a file you send yourself. Sign-ins and identities are never included.
Websites you visit
Sites receive the requests your browser makes, as in any browser. Hominis’s user agent includes the Firefox version token, so sites that check for Firefox work as expected. Tracking protection blocks known trackers; you can choose the level in Settings → Privacy & security.
This website
hominis.eu sets no cookies, and its fonts are served from this site. The only third-party service is Cloudflare Web Analytics, a visit counter from our host, and it runs only if you say yes. It tells us which pages people read, whether they find the download and how fast the site loads for them. If your browser sends Global Privacy Control or Do Not Track, we do not ask and do not count, though you can still say yes below.
When it is on, a small script from Cloudflare reports:
- the page you opened and the page you came from (without anything after a “?”)
- your country, browser, operating system and type of device
- how quickly the page loaded
The counter stores nothing on your device, uses no ID and cannot follow you to other sites. Cloudflare keeps the detailed data for 7 days, then only a sample. Your answer itself is kept in your browser’s local storage, alongside any light or dark choice, and neither is ever sent to us. You can change your answer below at any time.
Separately, and for everyone, Cloudflare counts the requests it serves for hominis.eu and dl.hominis.eu as part of hosting them: how many for each address and from which countries. No script is involved; we use these counts to see how often Hominis is downloaded. Cloudflare also keeps standard server logs for as long as its own purposes and legal duties need, without naming a fixed period (how long Cloudflare keeps data). We don’t get these logs: we see the totals above, and the address of any request Cloudflare blocks as an attack.
Your choice
Who is responsible
Noduz e.U., Krenngasse 12, 8010 Graz, Austria. For questions about this notice or your data: dataprotection@hominis.eu.
Under the GDPR you can ask what personal data we hold about you, have it corrected or deleted, and object to its use. You can also complain to the Austrian data protection authority (Datenschutzbehörde). As described above, Hominis itself keeps your browsing data on your Mac, not with us.