Privacy: what stays on the machine and what leaves it
Keys, history and settings never leave the computer. What does leave is listed here, source by source, so nothing has to be taken on trust.
On the machine only
The keys and the recovery phrase (encrypted, in the profile folder), the history, the downloads list, the saved layouts, the tracked wallets, the settings, the address book that fills itself after a send, and everything the address bar ranks. No server of Kestrel's sees any of it.
What the app asks the network for
- market and safety data for a token, from DexScreener, RugCheck, GeckoTerminal, Jupiter and pump.fun;
- the blocklists, from Scam Sniffer, MetaMask and Phantom;
- prices, balances and transactions, through the Solana RPC (the Kestrel relay by default, the public endpoint as a fallback, or your own address), which is also where the new tab page's three prices come from while that page is open;
- the prices, names and logos of the tokens in your wallet, from Jupiter, which is told which tokens you hold (not your address) once a minute while a wallet exists;
- swaps, through Jupiter and, if you choose it, Jito;
- the headlines in Simple mode, from CoinDesk, The Block and Decrypt;
- the signed token registry and the update manifest, from kestrelbrowser.com.
Each of those sees your IP address and what you asked about, as it would in any browser.
What Kestrel sends about you
Anonymous counts, if you leave them on: a random install id, the version, the system, the language, the day, and counters (tabs opened, pages loaded, Shield blocks, swaps, which panes were opened, memory, error kinds).
When the app freezes or fails (since 2026-09-20, not yet in a public version): what happened in a few words, when, what the computer was doing (display off, asleep, on battery, the network gone), for a freeze the places in Kestrel's own code and the system's where the app stood and how the freeze ended, and on Windows the file names of other software loaded into Kestrel's process (security products and overlays do that). An incident waits on the computer until it has arrived, and one that happens while the switch is off never leaves, also not later.
Never an address, a balance, a page or anything you typed. Every document is shown on the report page as it would go, and the switch is in three places (Settings > Privacy and data, the menu, and the report page).
Cookies and site data
Cookies are kept until they expire, or cleared when Kestrel quits (Settings > Privacy and data). Third party cookies are swept away about once a minute and when Kestrel quits: domains you opened yourself are kept, the rest go. "Clear browsing data" empties cookies, site data and the cache of the pages open at that moment, and the history when you tick it.
Site permissions
Camera, microphone, location, notifications and clipboard read are each set to Ask or Deny. An answer is remembered for the run of the app and forgotten when it quits, and "Forget my answers" clears them at once. Kestrel itself asks for none of them, and nothing is asked at launch.
The proxy
Settings > Network sends pages, their icons and the address bar's live suggestions through an http or socks5 proxy you name. The wallet's RPC calls, the chrome itself and updates do not use it.