Default deny
New and reinstalled apps start blocked on Wi-Fi and mobile data. You explicitly allow each network type. Unknown and unsupported flows stay blocked.
On-device · Android
Keep the latch on your own door.
Keeplatch is an on-device per-app firewall. You choose which apps may use Wi-Fi and which may use mobile data. Traffic stays on this device. It is not sent to a remote VPN server.
Local VPN, not a tunnel out
The app uses Android’s local VPN interface so it can filter on the device. TLS payloads are not opened. Packet payload and package name are never logged.
Honest engine bounds
IPv4 TCP and UDP that the pinned engine can forward may pass when a rule allows them. IPv6 stays BLOCK_ONLY. Classic UDP DNS query names can drive a live domain decision. CNAME chains and TCP port 53 enforcement are not live.
What this is not
- This is not all data staying on the device. The Play purchase token and subscription status are processed by Google Play and the verification server.
- Unmeasured soak, battery, or handover results are not claimed here. Build success is not leak-proof proof.
- Only one VPN can be active. Work profiles, tethering, inbound traffic, multicast, and rooted software are outside the V1 guarantee.
- Starting the firewall needs an active trial or subscription. There is no permanently free firewall and no daily allowance of free hours.