PearBrowser browse the P2P web. Keep your browser private.

No. PearBrowser ships without telemetry, remote analytics, an ad network, or tracking SDKs. It does not upload your browsing history to PearBrowser or sell it to advertisers. History and local page indexing are off by default; if you enable them, the data stays local unless you explicitly choose device sync.

No. PearBrowser is private by default, but it is not an anonymity network. Websites, relay operators, and P2P peers may receive the network information required to serve your request, including your IP address and requested content. Some HiveRelay operators can expose Tor endpoints, but PearBrowser Desktop does not yet route browser traffic through Tor automatically.

Content Shield, HTTPS-only navigation, common tracking-parameter stripping, third-party cookie blocking, and fingerprint farbling are enabled by default. Browsing history and local full-text search indexing are disabled until you opt in. Telemetry stays off and cannot be enabled.

Yes. The first tab and every blank new tab include DuckDuckGo search. PearBrowser sends no search analytics and does not add submitted queries to its optional persistent visit log. DuckDuckGo still receives the query and your network address to return results; its policy says it does not save or share search history. This is private search, not anonymity.

No — that's the whole point. Lighthouse is a local-first personal index: pages you browse are tokenized, signed by a per-app search subkey, and stored in a local Hyperbee. Library search returns in under 5ms with zero network. If you opt in to “include trusted peers,” the query also fans out to your trust graph over Hyperswarm — never to a central crawler.

Every federated row is re-verified client-side against the contact's identity binding and dropped on failure before it can affect ranking. Contacts only enter your trust graph through signed invite URLs that are verified at import and rejected if forged. The ranker is deterministic and clock-free, so the same inputs produce identical ordering on every device. The room is an index, not an authority.

The local index is live and wired. Federation is smoke-validated by a two-node federation test — meaning the path works end-to-end, not that it's been run at production scale. Treat the opt-in toggle as the early-access feature it is.

Not to public wss:// relays — not yet. What works today (Phase 3): Settings displays your npub and a one-click “Link (attested)” / Revoke control that cross-curve-binds your Nostr (secp256k1/BIP-340) key to your Pear Ed25519 root. You can post NIP-01 notes signed with that key, and read notes your verified contacts authored with their attested keys — all replicated peer-to-peer over your trust graph, with no relay servers in the middle. Public relay transport is a later, opt-in phase.

Device sync is still experimental and opt-in, but it now covers more than bookmarks: open-tab snapshots, allowlisted settings, profile fields, bounded browsing history, trusted contacts, and app grants. You pair devices with a sync://<key>:<encKey> invite, and rotate or forget the sync group when a device should stop receiving future state.

Nothing — that's the point. When you publish, the block editor signs a seed-request and HiveRelay pins the drive; PearBrowser only reports “published” after a relay confirms replication. The publisher can then be offline indefinitely while the relays serve the bytes to anyone with the key.

Yes, via hyper-fetch — a small drop-in JS library that talks to the HiveRelay HTTP gateway. The full peer experience (publishing, identity, Lighthouse search, signed grants) still requires PearBrowser.

Desktop builds are attached to the v0.8.0 release and listed on the download page: macOS .app.zip, Windows .msix, and Linux .AppImage. They are package-proof artifacts, not public-trust installers; verify the published checksum before opening them. The old migration identifier is for local support only, not an install command.

If you backed up your 12-word BIP-39 phrase, you restore your identity on a new machine and your grants and per-app sub-keys come back with it. If you didn't back up, drives you published stay alive on the relays — but you can never update or unseed them. Write the phrase down.