Distribution model
Why there is no lookup API.
The obvious design — ask the server "is tracker.example a
tracker?" — would hand us a live feed of everything you browse. It is
cheaper to build and it is disqualifying.
Instead the full ruleset ships to the client, signed and versioned. Evaluation is local. The only thing this server learns is that some browser requested the current dataset.
sessyn.io
↓ signed + versioned ruleset
Extension verifies both signatures
↓
Rules stored locally
↓
Browsing evaluated on device
Requests to sessyn.io per page load: 0
Published ruleset
Every rule, with its evidence.
A classification without a source is an opinion. Each rule carries an owner, a category, a confidence level, and a review date. Anything above "unknown" confidence must cite a reviewable source, and the schema rejects rules that do not.
| Rule | Owner | Category | Action | Confidence | Reviewed |
|---|---|---|---|---|---|
| tracker.google.analytics | Google LLC | analytics | block | verified | 2026-09-12 |
| tracker.google.tagmanager | Google LLC | analytics | restrict | verified | 2026-09-12 |
| tracker.google.doubleclick | Google LLC | advertising | block | verified | 2026-09-12 |
| tracker.meta.pixel | Meta Platforms, Inc. | advertising | block | verified | 2026-09-12 |
| tracker.microsoft.clarity | Microsoft Corporation | analytics | block | verified | 2026-09-12 |
| tracker.tiktok.pixel | ByteDance Ltd. | advertising | block | verified | 2026-09-12 |
| cdn.jsdelivr | jsDelivr | cdn | allow | verified | 2026-09-12 |
| payment.stripe.js | Stripe, Inc. | payment | allow | verified | 2026-09-12 |
| asset.meta.fbcdn | Meta Platforms, Inc. | cdn | allow | verified | 2026-09-14 |
| asset.google.gstatic | Google LLC | cdn | allow | verified | 2026-09-14 |
| asset.github.githubassets | GitHub, Inc. | cdn | allow | verified | 2026-09-14 |
| asset.x.twimg | X Corp. | cdn | allow | verified | 2026-09-14 |
| asset.meta.cdninstagram | Meta Platforms, Inc. | cdn | allow | verified | 2026-09-14 |
| asset.reddit.static | Reddit, Inc. | cdn | allow | verified | 2026-09-14 |
| asset.linkedin.licdn | LinkedIn Corporation | cdn | allow | verified | 2026-09-14 |
| asset.google.ytimg | Google LLC | cdn | allow | verified | 2026-09-14 |
| asset.ebay.static | eBay Inc. | cdn | allow | verified | 2026-09-14 |
Note the allow entries. A payment script and a content
network are not trackers, and a blocklist that cannot express "this one is
fine" breaks the web and gets switched off.
Integrity
Rulesets require Ed25519 and ML-DSA-65 signatures. Both public keys are embedded in the extension; private-key custody remains undecided, and no production signing keys have been generated.
Current status: Phase 1 ships rules inside the store-signed extension artifact. Remote rule fetching is disabled. Client-side hybrid verification is implemented, but the fetch/store/apply path, independent review, and dual-key custody remain release blockers.
Disputes and corrections
If you operate a domain classified here and believe it is wrong, write to contact us with your evidence. Corrections are published with a changed review date.
Classification is never for sale. Sessyn will not accept payment to allowlist a tracker or to describe tracking as essential — that is written into the project's monetisation guardrails, not left to good intentions.
Machine-readable endpoints
| Path | Purpose | Status |
|---|---|---|
| /rules/trackers.json | Current tracker ruleset | Planned |
| /rules/trackers.sig.json | Detached Ed25519 + ML-DSA-65 signatures | Planned |
| /rules/latest.json | Version pointer for update checks | Planned |
| /security.txt | Security contact | Live |
No endpoint here accepts a URL, a hostname, or any browsing input. Sessyn will not operate an API that could be turned into an open proxy or an internal-network scanner.