Most people never get two things: a clear picture of what every app is actually doing with their data, and real protection for the moment a phone is lost, stolen, or taken. Reap Guard gives you both, and it does all of it on the device itself. There is no Reap Guard server, and nothing it finds is ever uploaded.
Reap Guard is visible and on your own device by design. It is not hidden, and it is not built to be turned against anyone else. Everything it does is either something you can see, or something that activates only in response to a real security event.
Reap Guard runs a local VPN on the device. Not to route your traffic through some remote server the way a commercial VPN does, but so Android will let it see, on the device itself, which apps talk to which destinations and what they carry.
Traffic still goes wherever it was already going. Reap Guard reads it in passing, attributes every connection to the app that made it, and records the metadata: destination, port, protocol, byte counts, and the hostname from the handshake.
A policy engine reads each connection at the moment it opens and acts: allow it, block it, slow it, or send it nowhere. Known advertising, analytics, and tracking endpoints are cut automatically, out of the box.
Findings are written to a local database encrypted with SQLCipher, its key sealed in the phone's hardware-backed Keystore. You read it in the dashboard or export it. We never see any of it, because there is nowhere for it to go.
The same core engine ships in two configurations. They differ in how deep the tool is allowed to look and how far it is allowed to act. Choose by the phone you are protecting and the threat you are protecting it from.
Version 1 is the app store edition, and it is the only one published there. The Full instrument is a separate build you provision yourself on hardware you own. It is not distributed through the Google Play Store on any release track, and it is not an update, an in-app purchase, or a downloadable module of the version you install from the store. Nothing in the store edition turns into it.
The full visibility and forensics engine, plus a recovery-passphrase lock on the app and a refusal to run on a rooted phone. It never reads your keystrokes, never captures your screen, and never decrypts your traffic.
Everything in version 1, plus opt-in traffic decryption for apps that permit it, an active self-defense subsystem for a device that is out of your hands, and forensic capture. Provisioned on hardware you own and control.
Every alert can be traced back to why it fired. Where the tool cannot see something, it says so plainly, rather than showing a reassuring but empty result. Trust is a feature.
Where Reap Guard can simply stop something harmful from leaving the device, it does. You do not have to understand a threat to be protected from it.
Reap Guard defends the phone you own. It keeps its icon, shows a notification whenever it is monitoring, and never hides from you. That is the line between a security tool and spyware, and it stays on the right side of it.
A security tool that oversells itself is a liability. Here is where the edges are.
Encrypted DNS, Encrypted ClientHello, and connections to hard-coded IP addresses can slip a name-based block, and a socket already open before you blocked it is not cut. The whole-app firewall is the reliable option when you need one app fully stopped.
Version 1 sees where a connection is going, not what is inside it. In the Full instrument, decryption is opt-in, needs a certificate you install yourself, and works only for apps that permit it. Banks and messengers that pin their certificates stay opaque by design.
Kernel-level capture, per-process tracing, and blocking a force-stop from Settings require privileges Android will not hand a normal app. Those live in the Full instrument on hardware you have provisioned yourself.
Locking, wiping, beaconing, and evidence capture run fine in the background. An alarm, a photo, or an audio clip may wait until the app is next opened, because Android restricts starting a camera or microphone from a background task, and it forces a visible indicator when either runs.