APOUL Device Guard Privacy Policy

Last updated: November 5, 2026

Masaki Kakiuchi, trading as APOUL ("we"), explains how the iPhone / iPad app and the Mac app "APOUL Device Guard" (the "App") handle information.

1. Our approach

The App keeps diagnostic information on your device. We have no server that collects or stores your personal information. The App contains no advertising, tracking or third-party analytics.

Because of how iOS works, no app, including this one, can scan a whole iPhone or iPad (other apps or iOS itself); there is no full scan. The App checks only the places and files you choose, files sent to it, the records iOS writes, and a backup you choose.

2. Information kept only on your device

The following stays on your device, is never sent to us, and is excluded from backups:

• Diagnostic history, timeline and scan results
• The usual state of your networks (Wi-Fi network names and access points are stored only as hashes)
• Answers you record in the Security Guide
• Internet speed results
• Performance data about the App itself (MetricKit)
• A status summary shared only between the App and its widgets
• What the Automatic watch (Plus) remembers to compare with next time: whether each protection was on, whether a passcode was set, when an iOS update was first seen, and the identifier of the last scan compared — nothing else
• What you put in the Record of what happened: your notes, saved check results and screenshots you attach. Message text goes into the PDF only if you choose to include it, and the PDF leaves your device only when you share it

You can erase it, and the Safari history (section 4f), with Settings > Delete all history, or by deleting the App.

3. Location

iOS requires location permission for apps to read Wi-Fi details such as the network name. For Wi-Fi Detail Diagnostics, the App does not record or send your location. It uses location only if you join a watch group to share your location with the people watching over you (section 4e). Everything else works without this permission.

4. Information sent outside your device

Information is sent only when you use these features:

Each recipient handles the information under its own privacy policy:

• M-Lab: https://www.measurementlab.net/privacy/
• Quad9: https://quad9.net/privacy/policy/
• Cloudflare: https://www.cloudflare.com/privacypolicy/
• Have I Been Pwned: https://haveibeenpwned.com/Privacy

4a. Plus purchases and detailed communication checks

• Apple processes Plus purchases and payments. We never receive card numbers or other payment details.
• We run no server, and nothing about you is sent to us.
• With Plus, detailed communication checks send ordinary requests (without any device identifier) to Apple's check pages (www.apple.com, captive.apple.com) and Cloudflare's connection information page (www.cloudflare.com). These companies necessarily see your public IP address to answer; their privacy policies apply (Apple: https://www.apple.com/legal/privacy/ , Cloudflare: https://www.cloudflare.com/privacypolicy/ ).

4b. Sharing your status with watchers

• This feature becomes available when the watchers' app, APOUL Guardian, is released. Until then nothing is shared or sent.
• The App is for telling the people who watch over you (not only family; "watchers" below) about your own device's status and location. It has no feature that receives or shows anyone else's status or location (watchers use a separate app, APOUL Guardian, to see them).
• Only if you choose "Share status with watchers", the device's status (the name you choose, device model, iOS version and whether an update is available, the result and time of the latest check, and how many protections are ready) is stored in your own iCloud and shared read-only with the people you invite.
• This feature never shares messages, location, websites, links or phone numbers you checked, network names, IP addresses or app lists. Location is shared only by the separate feature for sharing your location with watchers (section 4e).
• Storage and sharing use Apple's iCloud (CloudKit), not our servers. We cannot read this information.
• You can stop sharing at any time. Stopping deletes the shared status, and the people you invited lose access.
• If you open another person's status invitation in the App, it is not accepted; the App only explains that it is viewed in APOUL Guardian.

4c. Safari scam-site block

The Safari extension (content blocker) only gives Safari a list of dangerous sites. Blocking never tells the app which sites you visit, and nothing is sent (pages you visit are recorded only if you turn on "Safari history"; section 4f).

Updates of the scam-site and spyware lists

The list service is not running yet, so the app does not download any list: it uses only the lists built into it and makes no connection for them. Once the service starts, at most once a day, the app downloads lists of dangerous sites and spyware traces (public files) from APOUL's public website. Nothing about you or your device is sent (no identifiers, cookies or query strings). As with any download, the website's host sees your IP address. Lists without APOUL's signature, expired lists and altered lists are never used; if no list can be downloaded, the lists built into the app are used. The lists are used by the Safari scam-site block, the scam checks and the spyware check, and are compared only on your device.

4d. Checks done only on your device

• "Check it is really family": the names and phone numbers you choose from Contacts and the code word you set are stored only in the Keychain on your device. They are not included in iCloud or in anything shared with watchers, and are never sent. The app does not read your other contacts. Calls, FaceTime and messages are started by you through iOS. When the code word is shown, iOS checks Face ID, Touch ID or the passcode; the app only learns whether it succeeded.
• "Check before sending to AI": the text you paste is checked on your device only, and is neither stored nor sent. The version with parts hidden is copied to the clipboard only when you tap the button.
• Automatic checks: whether a passcode and Face ID / Touch ID are set, whether a VPN or proxy is on, and whether a call is in progress (not who or what) are read from iOS and only shown on screen. Nothing is stored or sent.
• Clipboard: when the scam check screen opens, the app asks iOS only whether the copied content looks like a link or a number. The content itself is read only when you tap Paste.
• "Ask family for help": only when you tap it, iOS opens a call or a message to the family members you saved. You send it yourself.
• Safari fake login warning (extension): when you turn it on, it checks the address of the page you are viewing and the kinds of form fields inside Safari and shows a warning. Page contents and what you type are never stored or sent. Page addresses and titles are kept on this device only if you turn on "Safari history" (section 4f).
• "Check this iPhone for suspicious signs": the sysdiagnose (iOS diagnostic record) and App Privacy Report files you choose are read on your device only. From the sysdiagnose, only the restart record (shutdown.log), the list of running programs (ps.txt), the app install and uninstall records, and the names of crash report files are taken and compared with public indicators bundled in the app. The files are neither stored nor sent.
• "Check files you received" (file safety check): the folders and files you choose, or send with the Share button, are read on your device only. Each file's SHA-256 fingerprint is compared with public spyware and stalkerware lists bundled in the app, and its contents (including files inside zip archives) are checked for disguised programs, macros, fake login pages and similar. File contents are neither stored nor sent. A file is deleted only when you tap Delete and confirm.
• "Check this iPhone": the folders you chose once (such as On My iPhone and iCloud Drive) and the files sent to this app are checked on your device only, in the same way as "Check files you received" above. So that the chosen folders can be opened again, only the permission to open each folder (a bookmark) and its name are kept in the app, in a form that cannot be read while the device is locked. Folder contents are not kept. Files that are only in iCloud are not downloaded; they are shown as not checked. The scan also checks whether iOS is up to date (against Apple's public information bundled in the app) and whether a passcode is set. History keeps only the counts and the result, never file or folder names. Only when you turn on "Check automatically once a week", the same check runs automatically when iOS allows it, and a notification without any file name is shown only when something needs a look. Other apps' data and iOS itself cannot be checked by any app, because of how iOS works.
• "Check in detail with a Mac backup": only when you choose an iPhone backup that you made with Finder on a Mac, in the Files picker, it is read on this iPhone and compared with public indicators bundled in the app (file fingerprints, domains, program names and app IDs). For an encrypted backup, the password you type is held in memory for that scan only and is neither saved nor sent. Decrypted data exists only in memory and in a private temporary folder of this app (readable by you only), and is deleted when the scan ends, is cancelled or fails (or the next time the app opens, if it was closed during a scan). Message text is read only to find web addresses and is neither stored nor shown. The screen shows only the matching domains, file fingerprints and file locations, and what was and was not checked. Neither the backup nor the result is sent anywhere. While the scan runs, the screen is kept from locking automatically.
• When the Safari fake login warning is on and you try to send a password or card number you typed, the sending is paused for you to confirm. What you typed is not read, stored or sent.
• Checking a screenshot or photo: QR codes or text are read on your device from the one image you choose. The image is neither stored nor sent. If the link found is checked for domain reputation, only the domain name is sent, as described in section 4. The app does not ask for access to your whole photo library.

4e. Sharing your location with watchers

• This feature becomes available when the watchers' app, APOUL Guardian, is released. Until then location is not used, and nothing is shared or sent.
• Only if you open an invitation from a watcher and join their watch group as the person being watched, your own location, movement state (still, walking, driving, etc.), battery level, arrival at and departure from places, and SOS are shared with the watchers' devices that have been approved. If you do not join, location is not used.
• Sharing starts only with the consent of the person being watched; for under-16s, a parent or guardian must also consent. Consent is recorded on the device with the date and time, and you can withdraw it at any time by leaving the group. You can see in the App's list who receives your location at any time, and you can stop sharing or delete your history at any time.
• What is shared is encrypted on your device, then travels only through Apple's iCloud (CloudKit container iCloud.com.apoul.guardian) to the watchers' devices. We run no server, and neither we nor Apple can read it. Movement records are kept encrypted for only 7 days.
• To keep sharing while the app is closed, the App uses "Always" location permission. Precise positioning stops while you are still and is increased only when a move looks unusual. The iOS location indicator is always shown.
• This feature and SOS are free. Seeing other people's locations (a watcher's device) is not part of the App; it is provided by APOUL Guardian. The App never receives notices about other people's devices.

4f. Safari history (only if you turn it on)

It is off at first. Only if you turn it on in the app, the address (URL), title and time of each page you open in Safari are recorded.

• Not recorded: pages in Private Browsing, page contents, what you type, the part of an address after "#", and any user name and password in an address
• The part of an address after "?" (such as search words) is recorded, but values whose names contain token, session, code, key, auth, sig, pass and the like (such as the secret in a sign-in link) are replaced with "***"
• Where it is kept: on this device (storage shared by the app and its Safari extension), encrypted so that it cannot be read while the device is locked. The app never sends it to APOUL or anyone else, but it is included in this device's iCloud backup (stored on Apple's servers) and in Finder backups. Entries older than 90 days and any beyond 5,000 are removed automatically (at most 1,000 from one site)
• So that no one else can turn it on unnoticed, turning it on and exporting need Face ID, Touch ID or the passcode, and Home shows "Recording" while it is on
• Copy on your Mac: the record is included in Finder backups of the iPhone. When the Mac app scans such a backup, it saves the record in that Mac's reports folder (readable by that Mac user only). The Mac copy stays until you delete it
• Export: only when you tap Export, a CSV file is made and handed to the place you choose (AirDrop, Files and so on)
• Deleting: you can delete the whole record in the app at any time (on its screen, or with Settings > Delete all history). Exported copies and the Mac copy are deleted where they are

5. Scam SMS filter

Through iOS, the filter checks the sender and text of SMS / MMS from unknown senders on your device only. It has no network access and never stores or sends message content.

6. Notifications

Notifications (anomaly alerts, the monthly check-up reminder, the reminders to check for spyware (monthly, and once 10 minutes after you start waiting for a diagnostic record), the monthly safety report notice, the notice when "Automatic watch" (Plus) finds a change, the notice when "Check automatically once a week" (Plus) finds something that needs a look, and the notice when a watch group was deleted) are local notifications created on your device; our servers are not used.

7. Mac app

The Mac app compares the app list, running processes and App Privacy Report from a connected iPhone or iPad with public indicators (MVT indicators, downloaded from GitHub) on your Mac, and keeps the results on your Mac. Before inspecting a device that is not marked as yours, the app asks you to confirm the owner's consent. Results include the inspected device's app list, so keep them on an encrypted disk; the app warns you when the reports folder is on an unencrypted external disk. When "Automatic check" is on, only devices marked as yours are inspected in the same way, and the results stay on your Mac. When "Scan new backups automatically" is on, only backups you scanned by hand before are scanned again, while the app is open; an encrypted backup is never opened without its password, and the password is never saved. To show what changed, the Mac keeps, for each backup, only the last two results' levels, the titles of what was found, the app IDs and the iOS version. "Detailed check of a backup" reads an iPhone backup that you made in Finder and chose, on your Mac only, and compares it with public indicators (file fingerprints, domains, program names and app IDs). For an encrypted backup, the password you type is held in memory for that scan only and is neither saved nor sent. Decrypted data exists only in memory and in a private temporary folder of this app (readable by you only), and is deleted when the scan ends, is cancelled or fails. Message text is read only to find web addresses and is neither stored nor shown. The report contains only the matching domains, file fingerprints and file locations, and what was and was not checked. Neither the backup nor the result is sent anywhere. macOS may require "Full Disk Access" for this; whether to allow it is your decision, and the app never changes that setting.

8. Sharing with third parties

Except as required by law, we do not provide personal information to third parties (we do not hold any).

9. Changes

We will announce changes in the App or on our website.

10. Contact

Operator: Masaki Kakiuchi (trading as APOUL)
Address: 2F-C Shibuya Dogenzaka Tokyu Building, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan
Email: apoul.lcc@gmail.com
Phone: disclosed without delay on request