Tracker blocking and link cleaning

Every profile does the same two jobs: it refuses requests to tracker hosts, and it cuts tracking parameters out of the addresses you navigate to. How that is carried out depends on which engine the profile runs.

On ARMANOS Browser the app writes a small extension into the profile folder at launch. It works inside the network stack, so a site finds nothing in the page to notice, and your requests do not wait for the app to rule on each one.

The built-in Electron engine has no such road, so the app cancels a matching request in its own process and redirects an address that can be cleaned. The list of tracker hosts is the same on both engines.

The general list holds 31 entries and goes to every scenario: analytics, product measurement, crash reporting and session replay. The other three are scenario specific, and your profile takes the general list plus its own.

A Privacy profile ends up with 31 unique entries, a Social media profile with 74, an Ad accounts profile with 56. Your profile loads nothing the scenario did not ask for, and an unknown list name shows up in the log instead of leaving you with a silent blank.

The ads list is the most restrained on purpose. Every host an ad console needs to sign in, load, bill or answer its own API is deliberately absent, because a rule that fires inside the console you are paid to run is a business risk.

A domain list catches other people's counters. It cannot catch the platform itself, because those calls go to the very site you came to, from its own address.

For that there are separate sets tied to the platform's own paths, and two of them read the query as well: messaging loses only the calls that carry a typing or read marker, search only the calls that carry a tracking one.

Every set is locked to its own hosts. The LinkedIn set contains bare words like beacon and telemetry, and fired everywhere they would break an unrelated shop for you, so off its own hosts your profile never applies them.

• LinkedIn set

  The tracking, pixel and profile view paths, firing only on linkedin.com and licdn.com.

• Social set

  Meta, X and Pinterest logging paths on those platforms' own hosts. Two Meta entries carry the cross app handshake that ties a Facebook account to an Instagram one.

• Ad consoles

  No bare path rules here at all, only host plus needle pairs, so nothing of yours breaks on the rest of the web.

Every scenario gets link cleaning, and both engines strip exactly the same set of names. They cut on the navigation itself rather than in a redirect loop, so your address bar shows the clean address and the parameter never reaches the page.

The click identifiers are the point of it. An ad click id survives every other kind of tidying and carries exactly the correlation you want cut, so the list covers the platforms the Social media and Ad accounts scenarios work with.

Two kinds of tracking are structurally out of reach for any network rule. A beacon fires on unload and the payload is the tracking itself, and socket frames are opaque to a filter that only reads addresses.

Where the scenario asks for it, your profile replaces both inside the page's own world. The beacon call reports the event and returns true, so the page believes it succeeded, and short socket frames that name typing or read markers never reach the platform, while the rest of the socket carries on.

A replacement has to look like the built-in it replaced. Your profile copies the name and the length from the original, because measured against the shipping engine the beacon length is 1 rather than the 2 the specification implies.

• Beacons

  The stealth scenarios suppress them, and your count keeps them apart from network blocks.

• Read receipts and typing

  In the message privacy scenarios those frames never reach the platform, and the rest of the socket is left alone.

• Nothing names the product

  The event name the two halves share is new at every launch, so a site cannot listen in or forge your counts.

On ARMANOS Browser your counting happens on your own machine: what builds up over 500 milliseconds goes to a loopback address with a random per profile token. It never leaves the machine.

The app will not take those reports on trust: it clamps each batch, accepts only five categories and writes to disk at most once a second, so a busy page cannot cost you speed.

The Protection screen shows today, the last 7 days, the total, a breakdown by type and by the 12 profiles with the highest counts, and bars by day for the last 7 days. Reset counters wipes everything on this computer, and there is nothing to sync, because nothing was ever sent.

Measured with the same extension on both engines: on the built-in engine the request an ad blocker should have stopped reached the server, while ARMANOS Browser blocked it. A blocker installed there loads, but it has no button of its own, and by itself it stops nothing.

The app closes part of that gap itself. It takes the rules of the blocker you installed from that extension's own folder and runs them on its own, so blocking there does work after all.

What it will not do is pretend. A rule with its own regular expression, tab conditions or header conditions it marks as not understood and leaves alone, because applied without its condition it would block more than was asked and leave you with a white page.

Nothing here has a switch of its own. Everything follows from the scenario you pick for a profile: it selects the lists, the telemetry set and the page scripts, and the rest you get at launch.

1. 1

   Pick the scenario

   Privacy gets the general list alone, Social adds the LinkedIn and social lists with both telemetry sets, and Ad accounts adds the ads list with host scoped console rules.

2. 2

   Turn on ARMANOS Browser

   Blocking and cleaning work on both engines, but an installed blocker's own rules only run in full there. The build shipped today is 153.0.7978.0.

3. 3

   Work, then open Protection

   A profile at zero after real browsing is telling you its engine or its scenario is not what you assumed.

4. 4

   Reset before a measurement

   The reset is local and immediate, so you start a clean count on one machine without touching the server.