Reap Guard is built by Venmara. This policy explains what the app looks at on your phone, what it does with what it finds, and, because this is the part people actually care about, what never leaves your device.
Reap Guard runs entirely on your phone. There is no Reap Guard server. Nothing you capture, block, or investigate inside the app is uploaded anywhere, shown to us, sold, or shared with anyone. If you uninstall the app, everything it collected is gone with it. We do not have a copy, because we never had one to begin with.
If you only read one section, that is the one that matters. The rest of this document is the detail behind it, permission by permission.
Reap Guard is a network-security tool. It runs a local VPN on your device, not to route your traffic through a remote server the way a commercial VPN does, but to see, on the device itself, which apps are talking to which destinations, how much data is moving, and whether any of it looks like tracking, an ad component, or something worse. It also looks at the device itself: whether it has been rooted, whether a suspicious certificate or accessibility service has been installed by something else, and whether an app's own manifest gives away more access than it should have.
None of that requires, or uses, a connection to us. The VPN interface exists so Android lets Reap Guard see the traffic. The traffic itself still goes wherever it was already going. Reap Guard reads it in passing, on your device, and writes what it finds to a local, encrypted database.
This is the complete list. Reap Guard requests nothing that is not named here, and everything named here is in the app's manifest, which you can inspect yourself.
Network traffic (VPN permission). When you start capture, Reap Guard sees the destination, port, protocol, byte counts, and timing of every connection your other apps make, plus the hostname from the TLS handshake. This is metadata every server you connect to already sees, and Reap Guard does not decrypt TLS. This is how the app builds its list of trackers, blocked hosts, and per-app bandwidth. It is the core of what Reap Guard does, and it is also the one permission you get an explicit Android system prompt for, separate from anything Reap Guard itself asks. What happens to connections that were already unencrypted is set out in its own section below.
Which apps are installed (query all packages). Reap Guard reads your installed-app list so it can show you which app is generating a given connection, flag apps with risky manifest configurations, and detect newly installed or updated apps. It does not read what is inside those apps beyond their public manifest.
Usage access. Used for two things: per-app bandwidth totals from Android's own usage-stats system, and a timeline of when you had which app open, so findings can be tied to whether you were actually using an app when it did something.
Phone state and phone number. Used to show your SIM and carrier details and run the silent call-forwarding checks, the standard carrier codes like *#21#, that surface SIM-swap and line-hijack attempts. Reap Guard does not read your call log or your SMS messages. We removed both of those code paths deliberately, because Android restricts them to your default phone or messaging app, which Reap Guard is not and has no reason to be.
Wi-Fi state. Used to read the name of the network you are currently on, so you can mark a network as trusted and so a change of network can be shown alongside a finding. Reap Guard does not scan for or record nearby networks, and it does not request location, which is what Android would require to do so.
Network state. Used to tell whether the device is online and on what kind of connection, so capture can be brought back up after the network changes.
Internet access. Worth explaining, because an app that insists it has no server still asking for internet access deserves a straight answer. Reap Guard holds this permission for one reason: while capture is on, your other apps' connections pass through Reap Guard's local interface, and it has to send those packets onward to the destinations they were already going to. Without it, nothing on your phone would reach the network at all. Reap Guard makes no network requests of its own. There is no call home, no licence check, no update check, and no tracker list downloaded from anywhere. The app's own code contains no HTTP client.
Draw over other apps. Used only to show an alert bubble when something is found while you are in another app. It does not watch or interact with anything you are doing in that app.
Notifications, boot start, battery-optimization exemption, foreground service, wake lock. Housekeeping permissions that let Reap Guard keep its capture running and tell you when it finds something, rather than silently stopping every time the phone sleeps. The wake lock is requested by Android's own scheduling library, which the app uses to run its periodic bandwidth sampling, and is held only for the moment that work runs.
This section exists because it is the part of Reap Guard that deserves the most explicit explanation, and we would rather over-explain it than have you discover it later.
Reap Guard does not break, downgrade, or decrypt HTTPS. It installs no certificate and holds no interception key. Anything an app sends over a properly encrypted connection is opaque to Reap Guard, exactly as it is to anyone else on the network.
Some apps, however, still send data over connections with no encryption at all. When that happens, that content is already readable by your mobile carrier, by the operator of any Wi-Fi network you are on, and by anyone else in the path. Reap Guard reads it too, on your device, and tells you about it. That is the point of the feature: the whole reason to look is to find out which of your apps are exposing you.
Concretely, on those already-unencrypted connections Reap Guard flags:
These findings are written to the same encrypted on-device database as everything else. They are never transmitted anywhere, and the app deliberately does not display the captured secret values themselves. As with everything Reap Guard records, they exist only on your phone and are removed when you uninstall it. This capture only happens while you have capture turned on, after the disclosure the app shows you and after the Android VPN consent prompt you accept.
Packet capture. Reap Guard also has an optional packet-capture feature that is off unless you switch it on. While it is on, it records raw packets to a .pcap file inside the app's own private storage, capped at 200 MB, so a connection can be examined byte for byte in a tool like Wireshark. Nothing is uploaded. If you want that file elsewhere, you export it to your Downloads folder yourself, and from that moment it is an ordinary file under your control rather than something the app is protecting. The same applies to the forensic report and evidence exports: the app produces a file, and you decide whether it goes anywhere.
Everything Reap Guard records, the captured connections, blocked hosts, scan results, the cleartext findings described above, and the recovery passphrase you set for the app's own lock screen, lives in a local database encrypted with SQLCipher, with the encryption key sealed in your device's hardware-backed Android Keystore. A handful of sensitive settings, such as the passphrase hash itself, are kept separately in Android's encrypted preferences store, with the same Keystore backing. None of this is backed up off-device by Reap Guard. If your phone's own operating-system backup is enabled, that is a setting you control in Android, not something Reap Guard adds.
For as long as it is useful to you, and not a day longer, because we do not control it once it is on your phone. You do. You can clear individual findings from inside the app, and uninstalling Reap Guard removes the encrypted database along with it. There is no step where you email us to delete your data, because there is no copy anywhere for us to delete.
There are none, in the sense that matters here: nobody but you sees what Reap Guard finds. The one thing outside our control is the app store itself, which collects its own install and diagnostic data under its own privacy policy when you install any app from it. That is between you and the store operator, not something Reap Guard adds to or sees.
Reap Guard is not directed at children, and we do not knowingly collect anything from anyone under 13. Given that nothing the app collects ever leaves the device in the first place, there is nothing for us to have collected either way, but the app is not designed, marketed, or intended for use by children.
This policy describes Reap Guard v1, the everyday edition, and that is the only edition published on the Google Play Store. Everything above applies to the app you install from Play.
The Full research instrument is a separate build that adds deeper capabilities, including opt-in traffic decryption and forensic capture. It is not distributed through the Google Play Store on any release track, and it is not available as an update, an in-app purchase, or a downloadable module of the Play edition. It is provisioned directly by you, on hardware you own, and nothing in the Play edition reaches it or turns into it. Those capabilities still keep everything on the device and still send nothing to us. If you run the Full instrument, you are responsible for using it only on devices you own and only in ways the law allows where you are.
If what Reap Guard asks for, or does with it, changes, this page changes with it, and the date at the top moves. We are not going to quietly expand what the app does without updating this document to match. That would defeat the point of writing it.
Questions about this policy or how Reap Guard works: info@venmara.com.