Sitr | سِتْر
a content filter that is private by construction
est. 2026 · dooplin apps · mozilla public license 2.0

Sitr Family · in development · for households

Protect the whole household.
Surveil no one — including your own kids.

Sitr Family adds what parents actually need — device management, tamper-resistance, shared household lists — without becoming the spyware dashboard every other “parental control” app turns into.

1 household devices 1 endpoint added — E2E encrypted 0 browsing reports
§F

What Family adds

The free filter protects a device. Family protects a household — while keeping the covenant that made you trust the free filter in the first place.

F.1

One household, every device.

Enroll each family member’s phones, tablets and browsers under one household. The same public blocklist everywhere, plus your family’s own additions — no per-device fiddling.

F.2

Tamper-resistance for kids’ devices.

A child’s device can’t simply uninstall or disable Sitr. Removing protection requires the guardian’s approval — and when protection is off, the badge says so loudly, on both devices.

F.3

Your family’s own allow & block lists.

Add sites the public list doesn’t cover, or allow ones your family needs. These lists belong to your household and sync only between your own devices.

F.4

End-to-end encrypted sync. We hold ciphertext.

Family settings sync through one endpoint carrying an E2E-encrypted blob. We cannot read it — not “we promise not to,” cannot. The keys never leave your devices.

F.5

No child surveillance. On purpose.

Sitr Family is not a spyware dashboard. There is no browsing-history report, no screenshot feed, no location tracking. We protect children without teaching them that surveillance is love.

§E

Exhibit B — what Family does to the endpoints table

We said the free filter's table stays empty, and it does. Family adds exactly one row — and it was documented in docs/data-flow.md before a line of it shipped.

EndpointPurposeData sent
sync.sitr.app household settings sync E2E-encrypted blob · unreadable by us

// Keys are generated on your devices and never leave them. What our server stores is ciphertext we cannot open — verifiable in the client source, like everything else.

§P

Pricing, plainly

Family is how Sitr stays funded without ads, analytics or data — the subscription pays for sync infrastructure and full-time maintenance of the free, public blocklist.

Sitr

Free forever

The full filter, per device. Not a trial, not a tease — the trust engine.

  • On-device blocking + SafeSearch
  • Public, appealable blocklist
  • Zero endpoints, zero telemetry

Sitr Family

$6.99/month or $59/year

Per household — every device in the house, unlimited. Annual saves ~30%.

  • Everything in free
  • Guardian-approved uninstall, household lists
  • E2E-encrypted sync — one endpoint, ciphertext only
Subscribe

// Fair use: one household means one family. We can't count your devices (that's the product), but honest clients cap enrollment at 20 per household — no real family hits it, and sharing your pairing code means sharing control of your family's filter. Checkout is handled by Polar as merchant of record; after payment you get a subscription token to paste into the extension — it contains an expiry date and nothing about you.

Running a school, masjid or network instead of a household? See Sitr for Institutions.