Transparency centre
The source code, the signing certificate, every permission and every server the app talks to, written down in one place so you can check our claims instead of trusting them.
Open source
The app and its releases are public on GitHub. The app is licensed GPL-3.0-or-later, and its README explains how to build it yourself.
The Android app (Kotlin, Jetpack Compose) and Arivna Shield, the Rust ad-block engine. Build instructions in the README.
github.com/viroaryan/arivna-browser
Signed APKs for every version, with release notes and SHA-256 checksums.
github.com/viroaryan/arivna-browser-releases
Verify an APK
Two checks: the file's checksum proves you downloaded the exact file we published, and the signing certificate proves who built it.
Every official Arivna APK, on GitHub and on Google Play, is signed with this certificate.
ArivnaCN=Arivna Browser, O=Arivna, C=IN56:BE:21:31:F1:A1:B9:F5:AE:8A:2D:17:B0:2F:C4:14:89:A4:A4:4B:D1:69:BC:79:DB:74:A9:B3:29:F8:A5:AESHA-256 of arivna-browser-v1.0.0.apk. Newer versions list theirs on the releases page.
050c18063aa6c916107d18bf508152f76a42e7ae4e13ce725474c180ab5819b5
Run the command for your computer in the folder where you saved the APK.
Get-FileHash .\arivna-browser-v1.0.0.apk -Algorithm SHA256shasum -a 256 arivna-browser-v1.0.0.apksha256sum arivna-browser-v1.0.0.apkThe output must match the checksum exactly (capital or small letters do not matter). On a phone, many file managers can show a file's SHA-256 too.
With the Android SDK build tools installed:
apksigner verify --print-certs arivna-browser-v1.0.0.apkLook for Signer #1 certificate SHA-256 digest. It prints the same fingerprint as above, in small letters and without colons:
56be2131f1a1b9f5ae8a2d17b02fc41489a4a44bd169bc79db74a9b329f8a5ae
If the checksum or the certificate does not match, do not install the file, and please tell us where you got it.
Android permissions
This is the complete list from the app's AndroidManifest.xml. Camera, microphone and location are "dangerous" permissions in Android terms: Android asks you before Arivna can use them, and Arivna asks again per website.
| Permission | Why Arivna needs it | Asked first? |
|---|---|---|
INTERNET | To load web pages, update filter lists and fetch search suggestions. | No (granted at install) |
ACCESS_NETWORK_STATE | Lets the web engine know whether you are online, so pages can react to going offline. | No (granted at install) |
CAMERA | Only when a website asks for the camera (for example a video call or QR scanner) and you allow it. | Yes, by Android and per site |
RECORD_AUDIO | When a website asks for the microphone and you allow it, and for voice search when you tap the microphone. | Yes, by Android and per site |
MODIFY_AUDIO_SETTINGS | Needed by the web engine to route audio for calls and media on websites. | No (granted at install) |
ACCESS_COARSE_LOCATION, ACCESS_FINE_LOCATION | Only when a website asks for your location (for example a map) and you allow it. You can choose approximate location in Android's prompt. | Yes, by Android and per site |
POST_NOTIFICATIONS | To show download progress, speed and finished downloads. | Yes, on Android 13 and newer |
FOREGROUND_SERVICE, FOREGROUND_SERVICE_DATA_SYNC | Keeps downloads running when you leave the app. A notification is always shown while it runs. | No (granted at install) |
WAKE_LOCK | Stops the phone from sleeping in the middle of a download. | No (granted at install) |
WRITE_EXTERNAL_STORAGE | Android 8 and 9 only: saves downloads to your Downloads folder. Not requested on Android 10 and newer. | Yes, on Android 8 and 9 |
Arivna does not request contacts, call logs, SMS, photos and media, phone state, accounts or "all files" access. Camera, microphone and location are marked as optional hardware, so the app also installs on devices without them. You can set camera, microphone and location to "Blocked" for all sites in Settings > Site settings, with per-site exceptions.
Network connections
Apart from the websites you open, these are all the connections in Arivna's own code. None of them carries an account, user ID or device identifier, because Arivna has none.
| What | Servers | When | What is sent |
|---|---|---|---|
| Filter list updates | raw.githubusercontent.com, easylist.to, pgl.yoyo.org, malware-filter.gitlab.io, filters.adtidy.org, secure.fanboy.co.nz | On app start when lists are over 24 hours old (switch off "Auto-update daily"), or when you tap "Update now" | A normal HTTPS file request with user agent Mozilla/5.0 Arivna and the list's last ETag / Last-Modified, so unchanged lists are not downloaded again |
| Search suggestions | Your search engine: suggestqueries.google.com, duckduckgo.com, api.bing.com, search.brave.com or ac.ecosia.org (none for Startpage, Yahoo or custom engines) | While you type in the search bar, if "Show search suggestions" is on (default on; off in private tabs unless you enable it) | The text typed so far |
| Website icons | The site itself (/favicon.ico), then icons.duckduckgo.com, then www.google.com/s2/favicons | Only for home screen shortcuts to sites without a saved icon (including the default shortcuts on first launch). Visited pages provide their own icon. | The site's domain name; no cookies |
| Voice search | Your phone's speech recognition service (usually Google) | Only when you tap the microphone. Private tabs use on-device recognition only. | Your voice, handled by that service under its own policy |
| Downloads | The website offering the file | When you download something | What the page would send: user agent, referring page and that site's cookies |
| Safe Browsing | Google Safe Browsing, through Android System WebView | As pages load (WebView's built-in protection, switched on) | Handled by WebView as described in Google's Safe Browsing documentation |
Arivna does not check for app updates by itself: Google Play updates the Play version, and you update the GitHub version by downloading a new APK. Android System WebView is a Google component; if you have allowed usage and diagnostics sharing in your Android settings, WebView may send Google its own diagnostic data. That is controlled by Android, not by Arivna. Details in the privacy policy.
No telemetry
Arivna contains no analytics, telemetry, advertising or crash-reporting code, and no SDK that does it for someone else. We have no server that receives anything from the app.
Search the source code for http, URL( and openConnection. The dependency list in app/build.gradle.kts contains only AndroidX, Compose and WebKit libraries.
Arivna's network request log (menu > More > Network request log) shows every request a page makes and what Shield did with it.
Run a firewall or traffic monitor app (such as a local VPN-based logger) or a proxy on your computer, then use Arivna. Beyond the sites you open, you should only see the connections in the table above.
Follow the README to build the APK from source and compare its behaviour with ours.
What Arivna is built on
Arivna does not ship its own web engine. Pages are drawn by Android System WebView, the Chromium-based engine already on your phone, updated by Google Play or your phone maker. That keeps the app small (10.9 MB) and means web engine security fixes reach you through WebView updates.
The ad and tracker blocker is Arivna's own engine, written in Rust, compiled for each CPU type and called from the app through JNI. It reads uBlock Origin / AdBlock Plus filter syntax and blocks requests before they load. How Shield works.
Tabs, search, bookmarks, history, downloads, settings and privacy controls are written in Kotlin with Jetpack Compose. Minimum Android 8.0 (API 26), built for Android 16 (API 36).
Known limitations
Security
Email contactus@arivna.com with "Security" in the subject. Please do not open a public GitHub issue for security problems until a fix is out.
We will confirm that we received your report, keep you updated while we investigate, and credit you in the release notes if you want. We are a small team, so we cannot promise fixed response times, but security reports are handled before other work. We will not take legal action against good-faith research that respects users' privacy and does not damage data or services.
Third-party licences
Arivna is GPL-3.0-or-later. It builds on work by others, each under its own licence.
| Component | Licence |
|---|---|
| uBlock Origin filter lists (filters, privacy, badware, quick fixes, unbreak, cookie notices) | GPL-3.0 |
| EasyList, EasyPrivacy | GPL-3.0-or-later or CC BY-SA 3.0-or-later |
| EasyList Cookie List (Fanboy) | CC BY 3.0 (per file header) |
| AdGuard Mobile Ads, AdGuard Tracking Protection | GPL-3.0 |
| URLhaus filter (malware-filter, data from abuse.ch) | CC0-1.0 and MIT; URLhaus data CC0 |
| Peter Lowe's list | No standard licence stated; see NOTICE.md |
| Rust crates in Arivna Shield (regex, aho-corasick, memchr, jni-sys) | MIT OR Apache-2.0, or Unlicense OR MIT |
| Public Suffix List (compiled into Shield) | MPL-2.0 |
| Kotlin, Jetpack Compose, AndroidX libraries | Apache-2.0 |
| Lucide icons (redrawn in the app) | ISC (Feather-derived icons: MIT) |
| Android System WebView | Not bundled; Chromium's own licences |