One core engine ships in two editions. Below is the shared foundation, then the exact capability set of each edition, a side-by-side matrix, and the technical detail underneath. Where a limit exists, it is stated here rather than hidden.
Both editions are built on the same on-device foundation. None of it requires, or uses, a connection to us.
| Capability | What it delivers | Mechanism |
|---|---|---|
| Network capture | Reads which apps talk to which destinations, on the device, while traffic still reaches where it was already going. | Local VpnService with a from-scratch userspace TCP and UDP forwarder |
| Per-flow attribution | Ties every connection back to the exact app that opened it, with host, port, protocol, bytes, and timing. | getConnectionOwnerUid, API 29 and above |
| Real hostnames | Shows the true server name behind an IP, without decrypting anything. | Server name read from the TLS handshake |
| Traffic fingerprinting | Reveals when different apps share the same networking library or impersonate one another. | JA3 fingerprint per connection |
| Endpoint Atlas | A searchable ledger of every destination contacted, a cross-app tracker graph, and a per-endpoint dossier: owner, what it collects, whether that is acceptable, how to block it, and every flow to it. | Built-in intelligence base, about 70 host patterns and 28 named trackers |
| Multi-layer blocking | Blocks a destination at the DNS level, at the TLS name, over QUIC and HTTP/3, or the entire app at once. Domain-label matching stops false positives. | Synthesised NXDOMAIN, SNI reset, a QUIC Initial decryptor, and a per-app firewall keyed on the Linux user ID |
| Automatic tracker blocking | Cuts known advertising, analytics, attribution, and telemetry endpoints out of the box, on by default. | Domain-label-anchored name matching, no decryption |
| Upload guard | No app may push more than a set volume out per minute without your say-so. A crossing app is cut and held, and releasing it needs your recovery passphrase. | Deny-by-default, 500 KB per minute, persisted across restarts |
| Background exfiltration | Answers why a closed app just uploaded, by correlating every upload against whether the app was actually open at the time. | Upload records against device usage history |
| App-loophole scan | Enumerates the holes an attacker could use: debuggable builds, cleartext permission, open backups, exported components, and exfil-capable permission sets. | Manifest analysis of every installed app |
| Leak and credential scan | Flags personal data in unencrypted traffic: email, device identifiers, location, passwords, and tokens, redacted and attributed to the app and destination. | Cleartext HTTP inspection with checksum validation |
| Deep forensics | A device dossier (model, patch level, build and setup dates, boot and verified-boot state, root status), per-app usage history, and the screens navigated inside each app. | Platform APIs, no root required |
| Telephony forensics | Lists every SIM and eSIM with number and carrier, and runs the carrier checks that surface silent call-forwarding, the classic line-hijack move. | Carrier MMI checks such as *#21# |
| Change detection | Catches the silent background updates the store performs, and new installs or removals, with version and time. | Package receiver plus a periodic install-time diff |
| Daily report | A plain-language summary once a day of what every app did, where data went, and whether it is worth worrying about, delivered as a notification that opens the exact screen it is about. | On-device digest, retained 30 days |
| Threat and integrity engine | Fuses app risk, bad destinations, exfil-style uploads, cleartext leaks, SIM changes, and integrity findings into one device posture, with a security-score trend. | Root, rogue certificate, accessibility, and device-admin checks |
| Encrypted at rest | Captured findings are ciphertext on disk. Opening fails closed and never falls back to an unencrypted database. A forensics tool does not trade its evidence for convenience. | SQLCipher database, key sealed in the hardware-backed Keystore |
| Evidence export | One tap writes a timestamped forensic report you can hand over. | Local file export, plus packet-capture writing |
The everyday guardian. It gives you the whole visibility and forensics engine above, hardened for daily use, and it deliberately does not look inside your traffic or capture what you type and see. It is the edition built to meet the expectations of a consumer app store, and it is the only edition published on the Google Play Store.
Every capability in the shared engine: capture, the Atlas, blocking, the upload guard, leak scanning, deep forensics, telephony checks, and the daily report.
The app itself is gated behind a passphrase you set, stored only as a salted hash, so a thief holding an unlocked phone still cannot wave an exfiltrating app through the upload guard.
On a rooted device the security guarantees no longer hold, so version 1 declines to run rather than pretend otherwise.
It explains what the local VPN is for, in the app, before Android's own system consent prompt appears. Nothing starts capturing behind your back.
It sees where a connection is going, never what is inside it, unless that content was already sent unencrypted.
There is no accessibility keylogger and no screen recorder in this edition. It cannot read what you type into other apps or capture your screen.
Those permissions are not declared. The active response features that would need them live only in the Full instrument.
It keeps its launcher icon and shows a persistent notification whenever it is monitoring. It never hides.
Each one maps to a feature, and the reason is stated in the privacy policy. The network capture prompt comes from Android itself, separate from anything the app asks.
| Permission | Why |
|---|---|
| VPN consent | To see, on the device, which apps talk to which destinations. Prompted by Android. |
| Usage access | Per-app bandwidth totals, and a timeline of when each app was open. |
| Query installed apps | To attribute a connection to an app and flag risky manifests. |
| Notifications, boot, battery exemption, foreground service, wake lock | Housekeeping so capture keeps running and can alert you. The wake lock comes from Android's own scheduling library and is held only while periodic sampling runs. |
| Draw over other apps | To show an alert bubble when something is found while you are in another app. |
| Phone state and number | SIM and carrier details, and the call-forwarding checks. No call log, no SMS. |
| Wi-Fi and network state | The name of the network you are on, so you can mark it trusted, and whether the device is online. No nearby-network scanning, and no location. |
| Internet access | Solely to forward your other apps' packets onward to where they were already going. Reap Guard makes no network requests of its own: no call home, no licence check, no downloaded tracker list. There is no HTTP client in the app. |
| Location | Not requested. Version 1 asks for no location permission of any kind. |
| Media and storage | Not requested. Version 1 asks for no storage or media permission. |
Everything in version 1, plus deep interception and an active self-defense subsystem for a device that is genuinely out of your hands. It is provisioned on hardware you own and control. Its reach places it outside consumer app-store policy by design. It is not distributed through the Google Play Store or any other app store, on any release track, and it is not an update, an in-app purchase, or a downloadable module of the version 1 app. You provision it yourself, on hardware you own.
A full interception engine reads plaintext for HTTP/1.1, HTTP/2, WebSocket, and gRPC or protobuf. It needs a certificate you install yourself, and works only for apps that trust it and do not pin. Apps that pin are detected instantly and passed through untouched.
A per-flow policy engine decides allow, block, inspect, throttle, or sink for every connection, with a learned cache so it never breaks an app that rejects inspection, and a live decision log.
Per-app, defeating hint masking, with a hardware-keyboard path. Android lists the service publicly, so it cannot run covertly. It cannot read fields the OS secures.
A snapshot on each app foreground, in a per-app gallery. Android forces the screen-record indicator whenever it runs.
Every session reconstructed: the screens navigated in order, what was typed, and the snapshots captured in that window, including the real internal routes of Flutter and React Native apps.
A fail-deadly timer that escalates on a ladder if you go silent: warn, then lock and alarm, then the full armed response. Trusted safe zones check in for you automatically.
Convincing bait files planted in storage, each with a unique canary. The instant anything reads one, it photographs whoever is holding the phone and escalates. A second tripwire watches for a canary leaving the device.
Run in evidence-first order: snapshot, intruder photo, ambient audio, a beacon to your trusted contact, an un-dismissable alarm, lock, then an optional wipe. Proof leaves before anything is erased.
Reach a phone that is already gone. Text it a command with your passphrase to locate, lock, alarm, wipe, or stand down. A guessed keyword does nothing.
A second passphrase that appears to comply when you are forced to unlock, while it photographs, records, beacons, and keeps defending.
Every trigger and recovery reconstructed from the signed evidence chain and the media captured while it ran, assembled into one exportable report.
As a device administrator it cannot be uninstalled until deactivated. Provisioned as device owner over USB, it also resists force-stop and clear-storage from Settings.
The Full instrument declares what its extra reach requires. Android forces a visible indicator whenever the camera or microphone is used, so evidence capture is transparent, not covert.
| Permission | Feature it powers |
|---|---|
| Accessibility service | Keystroke capture and reading the real screen a single-Activity app is showing. |
| Screen capture | The per-app snapshot gallery. |
| Camera and microphone | The intruder photo and ambient audio clip during an armed response. |
| SMS | The location beacon to a trusted contact and remote command control. |
| Device admin or device owner | Lock, wipe, uninstall protection, and force-stop resistance. |
| Local certificate authority | Opt-in TLS interception, only for apps that trust it and do not pin. |
| Capability | Reap Guard v1 | Reap Guard Full |
|---|---|---|
| On-device network capture | Included | Included |
| Endpoint Atlas and dossiers | Included | Included |
| Multi-layer blocking and auto-block trackers | Included | Included |
| Upload guard and background-exfil forensics | Included | Included |
| Leak scan, deep forensics, telephony checks | Included | Included |
| Threat and integrity engine, daily report | Included | Included |
| Encrypted at rest, evidence and packet export | Included | Included |
| Recovery-passphrase lock, refuses to run rooted | Included | By configuration |
| Traffic decryption for non-pinned apps | Not included | Included |
| Keystroke and screen capture | Not included | Included |
| Per-app audit trail of screens and input | Not included | Included |
| Self-defense: dead-hand, decoys, doomsday response | Not included | Included |
| Remote control over SMS and duress unlock | Not included | Included |
| Incident autopsy | Not included | Included |
| Anti-tamper uninstall and force-stop resistance | Not included | Included |
| Distribution | Google Play Store, consumer install, runtime permissions | Provisioned by you on your own device. Not on Google Play or any app store, on any track |
| Detail | Value |
|---|---|
| Platform | Native Android |
| Language and UI | Kotlin with Jetpack Compose |
| Storage | Room over SQLCipher, schema migrations that preserve your data, key in the hardware-backed Keystore |
| Background work | WorkManager and Kotlin coroutines |
| Network core | A from-scratch userspace TCP and UDP forwarder over the local VPN interface |
| QUIC handling | A QUIC Initial decryptor covering version 1, drafts 27 to 32, and version 2, so a blocked host cannot be reached over UDP port 443 |
| Package name | com.reapguard.app |
| Android support | minimum SDK 29, target and compile SDK 35 |
| Backend | None. No server, no account, no network egress from the app itself |
None of this is hidden in the product, so it is not hidden here.
Encrypted DNS, Encrypted ClientHello, and hard-coded IP addresses can slip a block by name, and a socket already open is not cut. The whole-app firewall is the reliable option for one app.
It exists only in the Full instrument, needs a certificate you install, and cannot touch apps that pin their certificates. Banks and major messengers stay opaque by design.
Kernel-level capture, per-process tracing, and preventing a force-stop from Settings require a provisioned device. They are not claimed on an unprovisioned phone.
It cannot read fields the OS secures, and some manufacturers may unbind the service under battery optimisation unless the app is set to run unrestricted.
Lock, wipe, beacon, and evidence capture run from the background. An alarm, camera photo, or audio clip may wait until the app is next opened, and Android shows an indicator whenever the camera or microphone runs.
There is no copy of your data anywhere else. If you uninstall the app, everything it gathered is gone with it. We cannot recover it, because we never had it.