Home / SilverArrow / White paper
SilverArrow White Paper
How SilverArrow protects privacy — the threat model it addresses, what it blocks, and what it doesn't.
Published 2026 · Project Research LLC
Note on scope. This paper describes SilverArrow at the level Project Research LLC has publicly stated it — its purpose, the categories of tracking it addresses, and the threat model it's designed around. It is written for a general, security-literate audience, not as a line-by-line technical specification of the underlying implementation.
1. Executive summary
Most consumer privacy tools are built for people who already understand the problem: engineers, journalists, activists. SilverArrow starts from the opposite assumption — that the people most exposed to tracking are the people least equipped to defend against it, including children and non-technical adults. It aims to deliver meaningful privacy protection with zero configuration, available across a Chrome extension, a Safari app for iOS, and a standalone desktop browser for Windows and Mac, all sharing one blocking engine (approximately 330,000 declarative blocking rules as of the current release).
2. The problem
Modern web tracking operates on several independent layers, and blocking only one leaves the others intact:
- URL-based tracking. Query parameters appended to links (common in marketing emails, social shares, and search results) identify the specific person who clicked, independent of cookies.
- Persistent identifiers ("super-cookies"). Techniques exist that re-derive a tracking identifier even after a user clears cookies and browsing history in the normal way, defeating the most common privacy hygiene step people actually take.
- Device fingerprinting. By combining details like screen resolution, installed fonts, canvas rendering behavior and other passively observable signals, a site can identify a specific device with high confidence — without needing a cookie or stored identifier at all.
Each layer alone is enough to reconstruct a persistent profile of a person's behavior across sites and over time. A tool that only addresses one (e.g., blocking cookies but not fingerprinting) still leaves a real tracking channel open.
3. Threat model
SilverArrow is designed around a threat model where the "adversary" is the ordinary, large-scale commercial tracking ecosystem — ad networks, data brokers, and analytics platforms — rather than a targeted nation-state actor. Concretely, it assumes:
- The user has not read a privacy policy, adjusted a browser setting, or installed a second tool to compensate for gaps.
- The user may be a child, for whom no informed consent to tracking is meaningful in the first place.
- The threat is passive, ambient tracking encountered through ordinary browsing — not active malware, phishing, or targeted intrusion (which fall under Project Research LLC's separate cybersecurity toolkit, not SilverArrow itself).
4. What SilverArrow addresses
| Layer | What SilverArrow does |
|---|---|
| Tracking URLs | Strips known tracking parameters and redirect chains from links before they load, so identity/session data isn't carried along with a click. |
| Super-cookies | Blocks the mechanisms used to re-establish a persistent identifier after normal cookie clearing. |
| Device fingerprinting | Interferes with common fingerprinting techniques (e.g., canvas-based signals) so a device is harder to distinguish from others. |
This operates via a shared, declarative rule-based blocking engine across all three delivery surfaces (Chrome extension, Safari iOS app, desktop browser), rather than three separately-maintained implementations.
5. What SilverArrow does not claim to do
Clarity here matters more than marketing breadth:
- It is not a content filter and does not block categories of content (e.g., age-inappropriate material).
- It is not antivirus or anti-malware software, and does not claim to stop malicious code execution.
- It does not protect against targeted, sophisticated surveillance (e.g., commercial spyware) — that threat model is addressed by different tools entirely (see Project Research LLC's Cybersecurity Research Toolbox for that category).
- It does not require or rely on a user account; Project Research LLC's own privacy policy states no accounts are required and no behavioral profiles of visitors are built by the company itself.
6. Data handling
Per Project Research LLC's published privacy policy, the company does not require accounts, does not sell or share personal information, and does not build behavioral profiles of website visitors. Users evaluating the SilverArrow extension/app specifically should also review the permissions it requests in each browser's extension listing (Chrome Web Store, Firefox Add-ons, or the iOS App Store), since that is the authoritative, store-verified source for what data the installed software itself can access at runtime.
7. Current development status
As of this writing, the Chrome extension and Safari iOS app are the primary released surfaces. A native Android app (Kotlin/Java) and companion Samsung Internet and Firefox for Android extensions are in beta testing, with internal test results (e.g., persistent UID regeneration wiping across sampled sites in Chrome and Brave) published on the SilverArrow page.
8. Conclusion
SilverArrow's core position is that privacy tooling shouldn't require the user to understand privacy engineering to benefit from it. By addressing tracking URLs, super-cookies, and fingerprinting together, under one blocking engine, with no account and no configuration required, it aims to close the gap for the users most commonly left out of privacy tooling design: children and non-technical adults.
For legal terms and the company's full privacy policy, see Terms of use and Privacy policy. This document may be revised as SilverArrow's feature set evolves.