Privacy & limits

The approved summary, and what it does and does not mean.

Redoubt ships the same privacy configuration and the same Gecko-level security patches as LibreWolf desktop, on a platform whose process containment is weaker — and we publish exactly where.

“Where” is the parity table in PARITY.md: every row is backed by a named measurement or marked as not yet verified. This page is a summary of it; when they disagree, PARITY.md is right.

What it changes compared with Firefox for Android

• Built from source. Gecko and the Android app are compiled from Firefox’s source with LibreWolf’s shared patch set and preference configuration applied, rather than patching a prebuilt browser.
• Telemetry and experiments removed: the Glean upload path, Adjust, Nimbus experiments, crash-report uploads and Google Play Services are patched out; sponsored shortcuts are removed and search suggestions are off by default.
• LibreWolf’s privacy defaults: resist-fingerprinting, strict Enhanced Tracking Protection and cookie partitioning (both locked), Global Privacy Control on.
• Stronger site isolation than stock: Fission is locked to isolate high-value sites; stock Firefox for Android ships with it off.
• uBlock Origin preinstalled, with its cookie-notice lists on by default. A filter list hides a cookie banner or blocks its script; it does not click “reject”, so the site records no refusal.
• Cloud features off, such as Shake to Summarize, IP Protection and Google Lens.

Honest limits

• No content-process sandbox. Firefox’s Gecko content sandbox does not exist on Android (upstream never finished the port). Per-site process isolation, isolated processes and RLBox recover most, not all, of it. This is a platform fact, not a setting, and the largest containment gap versus desktop.
• Not everything is proven on a live page. HTTPS-only, certificate revocation, the TLS floor and fingerprinting coherence are configured but marked Partial in PARITY.md until measured on a device.
• DNS over HTTPS is not inherited. The DNS-over-HTTPS setting in the configuration is overridden by the app; use Settings > DNS over HTTPS instead.
• Emulator-tested. Automated device testing so far covers an x86_64 emulator only. ARM builds are checked but have not been run on a physical phone by the project.
• A different signing identity. Redoubt cannot carry the desktop build’s code-signing identity; its trust root is its own app id and signing key, held by one person, with no second key holder yet.
• A small project. If you want a mature, widely used hardened Firefox for Android today, IronFox is that, and it is the browser LibreWolf itself recommends to Android users.

The full matrix, with the evidence for each row and the list of what is still pending: PARITY.md.