For families who take both deen and privacy seriously
Every filter says “trust us.”
Ours says check the math.
Sitr blocks adult, gambling and dating sites and locks in SafeSearch — entirely on your device, using your browser's own filtering engine. Your history has nowhere to go, because we built nowhere for it to go.
The premise
Most “family safety” software works by routing your browsing through someone else's computer — so the thing protecting your family is also the thing watching it. We think that trade is haram-adjacent at best. Sitr is architected so that watching you is structurally impossible, and every claim below is written so you can go falsify it.
The filter runs on your device. Full stop.
Sitr compiles its blocklist into your browser's native declarativeNetRequest rules. Requests to blocked sites die inside your browser — no call home, no lookup service, and the extension cannot read page contents.
One blocklist, identical for everyone, in public.
Every rule lives in a public Git repository with an inclusion policy and an appeals process. Because every user ships the same list, there is no per-user configuration for us to learn anything from.
No telemetry. Not opt-out — absent.
No analytics SDK, no crash reporter, no ad network, no “anonymous usage statistics.” The data-flow document enumerates every network endpoint the extension may contact. See §2 for that list, reproduced in full.
Builds are byte-reproducible.
A deterministic compiler turns the public domain lists into the shipped rulesets. CI publishes SHA-256 checksums; anyone can rebuild from source and diff against what's shipped. See §3 for the exact commands.
Failure is loud, never silent.
If protection isn't provably active, Sitr shows a red “Protection INACTIVE” badge. A filter that quietly fails is worse than no filter — so ours refuses to pretend.
SafeSearch, held in place.
Google, Bing and DuckDuckGo SafeSearch and YouTube Restricted Mode are enforced at the request layer — not by asking nicely in a settings page that anyone can flip back.
Exhibit A — every endpoint we call
Reproduced from docs/data-flow.md, the canonical inventory of network traffic the extension may generate while filtering.
// If a future version ever adds a row to this table, it will be visible in the public repo before it ships, with the diff to prove it.
Trust no one. Run this.
“Open source” is a claim; reproducibility is a proof. The rulesets Sitr ships are a pure function of the public blocklist — rebuild them yourself and compare checksums with what's published.
The compiler is deterministic on purpose: same input lists, same bytes out, on your machine or ours. CI publishes the SHA-256 of every shipped ruleset alongside each release.
If your checksums ever disagree with ours, you've either caught a build bug or caught us — and either way we want the issue filed.
Audits welcome: architecture & threat-model docs live in docs/.
$ git clone https://github.com/terrancoder/sitr $ cd sitr && npm ci && npm test # builds compiler → rulesets → extension, runs tests $ shasum -a 256 extension/rulesets/*.json # compare against the checksums CI publishes ✓ adult.json …matches release ✓ gambling.json …matches release ✓ safesearch.json …matches release ✓ reproducible build verified — nothing up our sleeves
The same covenant, pocket-sized
Sitr for iOS and Android is being built on the identical constitution: filtering on-device, the same public blocklist, and a data-flow table that stays empty. If a platform won't let us keep those promises, we won't ship on it.
Managing more than your own devices? See Sitr Family for households and Sitr for Institutions for schools, masajid and networks.
Anticipated objections
Longer answers live in the public docs; these are the short forms.
5.1 What does “Sitr” actually mean?
Sitr (سِتْر) is Arabic for covering, veiling, protection — the shielding of what ought to stay shielded. We chose it because it describes the product twice: it covers your family from harmful content, and it covers your browsing from everyone. Including us.
5.2 Can you see my browsing history?
No — and notice we didn’t say “we don’t look.” Filtering happens inside your browser with rules shipped ahead of time. There is no request to our servers to log, because there is no request to our servers.
5.3 Free and open source? Where’s the catch?
There isn’t one you can’t inspect. No ads, no analytics, no data to sell — the code is public under MPL-2.0, so this is a checkable statement, not a marketing one. Sitr is built by Dooplin Apps as a service to the community.
5.4 You blocked a site wrongly. Now what?
Every listing must satisfy a public inclusion policy, and there’s a documented appeals process — open an appeal in the repository and it gets reviewed against the published criteria, in the open, like everything else here.
5.5 Which browsers work today?
Any Manifest V3 Chromium browser: Chrome, Edge, Brave, Opera, Vivaldi and friends. iOS and Android apps are in development (see §4).