Skip to content
Cra

Privacy

Yours alone, on your Mac

Cra has no telemetry, no ads and no analytics. Here is exactly what it stores, what leaves your Mac and why.

Last updated 25 October 2026

The short version

  • Cra has no account and no server. Nothing about you is sent to Cra, because there is nowhere to send it.
  • Your sidebar, archive and settings are plain files on your Mac.
  • Pages you visit talk to the sites you visit, as in any browser. Searches go to the engine you chose.
  • Ads and trackers are blocked by default, from a list that ships inside the app.
  • This website sets no cookies. It counts visits with a self-hosted analytics script; the app has none.

What stays on your Mac

Everything is under ~/Library/Application Support/Cra.

Sidebar and archiveJSON files describing your spaces, pinned tabs, Today lists, favorites, folders and archived tabs, with timestamped copies as a local safety net.
keybindings.jsonYour shortcut overrides.
faviconsSite icons, received from the pages themselves while they load.
ChromiumA standard Chrome-style profile for the engine: history, cookies, saved passwords, extensions, cache and site data for the pages you visit. Passwords and cookies are encrypted with a key kept in your macOS keychain, as Chrome does.
chromium.logThe engine’s log, useful when reporting a bug.

Deleting the folder removes everything and resets Cra.

What leaves your Mac

  • Web pages. Cra renders pages with Chromium Embedded Framework. Sites see what they would see from Chrome, and their own privacy policies apply.
  • Searches. When you search from the command bar, the query goes to the engine chosen in Settings: Google by default, or DuckDuckGo, Bing or Kagi.
  • Suggestions. Command bar suggestions are computed on your Mac from your open tabs, archive, history and a bundled list of popular domains. Nothing you type is sent to a suggestion service.
  • Extensions. Installing from the Chrome Web Store talks to Google, as it does in Chrome. Each extension can see what its permissions allow, so install the ones you trust.
  • Updates. Cra does not check for updates or phone home. New builds are announced on the release notes page.

Ad and tracker blocking

Settings → Privacy → Block ads and trackers is on by default. Cra cancels requests to more than 22,000 known ad and tracker domains, and their subdomains, unless the request belongs to the site you are on, so logins and a site’s own content keep working. The check happens on your Mac against a list bundled with the app; nothing about the pages you visit is sent anywhere to decide.

The list combines the AdAway default blocklist (CC BY 3.0, by Kicelo, Dominik Schuermann and the AdAway contributors) and Anudeep’s adservers list (MIT), reduced to bare domains.

Imports

Importing reads the other browser’s files on your Mac and writes into Cra’s. Nothing is uploaded. To bring passwords and sign-ins from a Chromium browser such as Chrome, Arc or Dia, Cra asks macOS for that browser’s key in your keychain, and macOS asks you first. The data is decrypted on your Mac and encrypted again for Cra’s own profile. Firefox and Safari passwords come from a file you export yourself; Cra reads it once and does not keep a copy.

This website

The site sets no cookies and loads no third-party scripts. Fonts are served from Google Fonts.

It counts visits with Phantom, a small analytics service hosted by Cra’s developer, served from this domain. The script keeps a random visitor id in your browser’s local storage and records the pages you view, links you follow off the site, the site or campaign that sent you, your browser, operating system, language and screen size, and the country, region and city your IP address points to. The IP address itself is not stored. None of it is sold, shared or used for ads. Blocking the script, or clearing site data, stops or resets it. The app sends nothing to Phantom.

Changes

If this page changes, the date at the top changes with it, and the changelog says what moved.