Privacy & trust
Nothing leaves your device.
Ayyaran was built on a simple promise: what you do stays on your device. Our servers can't see it — not because we say so, but because we designed things that way. The code that powers Ayyaran is open for anyone to inspect, every update is signed so nothing tampered with can slip through, and if you turn on the optional cloud dashboard, only you hold the key that unlocks your own data. We can't read what you do, because we made sure we never could.
On-device engine
A Rust core compiled to WebAssembly runs inside your browser tab. Every detector — 18 of them — evaluates on your machine. Page content, emails, chat messages, and clipboard contents are never transmitted to Ayyaran servers.
k-anonymous lookups
When the engine needs to consult a hosted list (for example, known-bad domains), it sends only the first two bytes of a hash prefix — never the full URL. The server returns a bucket; the match happens back on your device.
Sealed cloud sync (Pro only, optional)
Cross-device sync uses a pair-code handshake. Your content key is derived on your device from a code only you know. The server stores AES-GCM envelopes it cannot decrypt. Even with a full database dump, an attacker sees ciphertext.
Open-source core
The detection engine is Apache-2.0 licensed. Threat-intel bundles are Ed25519-signed and version-pinned. You are welcome to build it yourself, audit it, or run a fork. There is no hidden model.
Questions or a specific worry? Write to founders@ayyaran.com. Real humans, quick replies.