Why ITISYOU

Your browsing data — history, bookmarks, workspaces, sessions, permissions — belongs on your machine, under your control. ITISYOU's storage design keeps each of these as a separate local dataset with its own boundary, instead of one merged profile blob that a sync service or an AI feature can quietly read end to end.

• No account required. No cloud handshake to start browsing.
• No telemetry endpoints in the codebase — verified per milestone, not asserted once.
• Data leaves your machine only when you explicitly make it (a sync feature, when it eventually exists, will be opt-in and documented).

Every subsystem sits behind a documented contract, and privileged code is separated from untrusted web content by construction. The browser's own UI is trusted HTML served over an internal itisyou:// scheme in a privileged view; web pages run sandboxed, with no privileged bindings, and the only JS-to-native bridge is origin-gated at three independent layers.

• Chromium's process model, sandbox, and Site Isolation stay at upstream defaults.
• Permission requests route through one deny-by-default service.
• Web pages are untrusted, always. No exceptions for convenience.

Inspect every module and its security boundary →

We reject the "ubiquitous assistant" model where AI watches everything you do. In ITISYOU, AI is off by default and structurally incapable of silent access. In the current build the AI runtime exists only as disabled interfaces — no provider configured, no API keys, zero provider calls. When AI capability arrives (Phase 3), it will be opt-in, explicit per action, and auditable.

The full AI philosophy →

Every milestone needs implementation, tests, and verification before it is called done. That discipline extends to this website: the progress page renders from the same status data the project itself maintains, the development story records failures alongside wins, and the comparison page cites a source for every claim about other browsers — and claims nothing unverified about ours.