Silkoon Privacy Policy
Last updated: 20 October 2026
Silkoon ("the app", "we") is a web browser for iPhone. This policy explains what data the app processes, why, and what choices you have.
Controller: the developer of Silkoon (individual developer, Ukraine). Contact: support@silkoon.cc
1. The short version
- Your browsing stays on your device. The addresses you visit, your searches, page content, form input, cookies and bookmarks are not sent to us or to any advertising or analytics partner.
- No account is needed. We do not ask for your name, email or phone number.
- We use analytics and advertising measurement (Firebase, AppsFlyer, Meta, Apphud) to understand how the app is used, to fix crashes and to measure which of our ads bring new users. These services receive device identifiers and in-app events such as "onboarding completed" or "trial started", never your browsing.
- You control tracking. The app asks for permission before your device's advertising identifier (IDFA) is used. You can also turn off usage statistics in Settings → Data → Usage statistics.
- We do not sell your personal information.
2. Data that stays on your device
| Data | Where it lives |
|---|---|
| Pages you open, tabs ("cocoons"), cookies, cache | In memory, inside separate non-persistent sessions. Erased when a cocoon is dissolved. |
| Bookmarks, settings, protection statistics | On your device (app storage). Erased when you delete the app or use "Erase all data". |
| Site safety scores | Calculated on your device. |
Silkoon does not keep a browsing history.
3. Data processed to provide features
Threat list. The app downloads the public abuse.ch URLhaus host list and checks addresses against it on your device. The download does not contain any information about you.
Domain age. When a site score is calculated or you check a link, the app asks public RDAP registries (operated by domain registries) for the registration date of the domain name only. The registry sees the domain name and your IP address, as with any internet request.
Link check. When you ask the app to check a link, it follows that link's redirects and downloads the page without cookies or scripts to analyse it on your device.
AI check (optional, Pro). Only when you tap "AI check" and give consent, the app sends to our server (hosted on Cloudflare):
- the domain name (for example
example.com), not the full address; - short results of the on-device checks (for example "domain registered 12 days ago");
- the app language and a random installation identifier used for rate limiting.
Our server looks up public mentions of the domain with a search provider (Serper.dev), checks the domain with Cloudflare Security DNS, and asks an AI model (Anthropic Claude, accessed through an API provider) to summarise the result. Page content, the full address, cookies and your browsing history are never sent. Results are cached by domain for up to 24 hours and are not linked to you.
Purchases. Payments are processed by Apple. We receive confirmation of your subscription status and transaction identifiers, never your payment card details.
4. Analytics, crash reports and advertising measurement
We use the following third-party services. Each receives device-level and in-app usage data, never your browsing.
| Service | Purpose | Data |
|---|---|---|
| Google Firebase Analytics (Google LLC) | Usage statistics: which features are used, conversion through onboarding and the paywall | App instance ID, device model, OS version, app version, language, approximate region (derived from IP address), in-app events |
| Firebase Crashlytics (Google LLC) | Crash and stability reports | Crash traces, device state at the time of the crash, installation identifier |
| AppsFlyer (AppsFlyer Ltd.) | Install attribution: which ad campaign led to an install | IDFV, IDFA (only with your permission), IP address, device data, in-app events, campaign data |
| Meta (Facebook) SDK (Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) | Measuring the effectiveness of our ads on Facebook and Instagram | IDFA (only with your permission), device data, app install and activation, in-app events |
| Apphud (Apphud Inc.) | Subscription analytics and validation; forwarding subscription events to AppsFlyer and Meta | Transaction identifiers, subscription status, product, price, IDFV, IDFA (only with your permission), random user ID |
| Our attribution server (Cloudflare) | Reporting the subscription funnel (install, trial started, trial still active after 20 minutes, payment) to Meta Conversions API and AppsFlyer, and checking the trial status with Apple's App Store Server API | Random user ID, IDFV, IP address, device model, OS and app version, AppsFlyer ID, transaction ID, product and price. IDFA and the Meta ad-click ID are sent only if you allow tracking; otherwise events are marked as not tracked. |
In-app events we record are limited to steps such as: onboarding started/completed, tracking permission granted/denied, paywall shown/closed, purchase started/succeeded/failed, trial started, restore, cocoon created/dissolved, bookmark added, setting switched on/off, first page loaded. Events about the site-safety features (report opened, link checked, risk level, AI check) contain only a category such as "low/caution/high", are sent only to Firebase and never to advertising partners.
5. Tracking and your choices
App Tracking Transparency. After onboarding, iOS asks whether Silkoon may track you across apps and websites owned by other companies. If you allow, AppsFlyer, Meta and Apphud may use the advertising identifier (IDFA) to attribute your install to an ad. If you decline, the IDFA is not accessed, events are marked as not tracked, and ad measurement relies on Apple's privacy-preserving SKAdNetwork / AdAttributionKit and Meta's aggregated measurement. You can change this anytime in iOS Settings → Privacy & Security → Tracking.
Usage statistics switch. Settings → Data → Usage statistics turns off Firebase Analytics, AppsFlyer, Meta event logging and reporting to our attribution server. Crash reports stay on so we can keep the app stable.
Other choices. You can dissolve cocoons, erase all app data in Settings, or delete the app at any time.
6. Legal bases (EEA/UK users)
- Providing the browser and requested checks: performance of a contract (Art. 6(1)(b) GDPR).
- Crash reports and security: our legitimate interest in a stable, secure app (Art. 6(1)(f)).
- Usage statistics and ad measurement: our legitimate interest in improving and promoting the app (Art. 6(1)(f)), which you can object to with the Usage statistics switch; use of the IDFA and the ad-click ID only with your consent via the tracking prompt (Art. 6(1)(a)).
- AI check: your consent given in the app (Art. 6(1)(a)).
7. Retention
- Analytics events: up to 14 months in Firebase; according to the retention settings of AppsFlyer, Meta and Apphud (typically up to 24 months).
- Crash reports: up to 90 days.
- AI check cache: up to 24 hours; rate-limit counters: up to 2 days.
- Purchase records: as long as required by tax and accounting law.
8. Sharing
We share data only with the service providers listed above, who process it on our behalf or as independent controllers under their own privacy policies, and when required by law. We do not sell personal information. Under some US state laws, allowing tracking may count as "sharing" for cross-context behavioural advertising; you can opt out by declining the tracking prompt or turning off Usage statistics.
9. International transfers
Our providers may process data in the United States and other countries. Where required, transfers rely on the EU Standard Contractual Clauses or equivalent safeguards.
10. Your rights
Depending on where you live, you may have the right to access, correct, delete or port your data, to object to or restrict processing, and to withdraw consent. Because we do not ask who you are, include your installation details (Settings → Version) when you contact us. You may also complain to your local data protection authority.
11. Children
Silkoon is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect their data.
12. Security
Data is transmitted over encrypted connections. Server keys are stored only on our server and are never included in the app.
13. Changes
We will update this page and the date above if our practices change. Significant changes will be announced in the app.
14. Contact
Provider policies: Google · AppsFlyer · Meta · Apphud · Cloudflare · Serper · Anthropic