Demarc shows you what your phone is actually doing on the network — every connection, every DNS lookup, every byte, attributed to the app that caused it. No root required.

Android hands a VPN app its own outbound traffic. Demarc uses that to inspect your traffic locally and forward it straight back out. Nothing is sent to a server. There is no remote endpoint, no account, and no tunnel to anywhere — the "VPN" exists only so the OS will show Demarc the packets.

FREE

• Live connections — every TCP and UDP flow, with the owning app, the remote host or IP, the port, and bytes in and out
• DNS — every domain your apps look up, and what those names resolve to
• Data usage — per-app and device-wide upload and download totals, updating live
• Always-on monitoring, a Quick Settings tile, and an ongoing notification whenever capture is running

PRO (one-time in-app purchase)

Inspect
• Per-app deep view: its flows, its lookups, its destinations, its data in and out
• TLS server names (SNI) and JA3 client fingerprints — the hostname behind an HTTPS connection, read without decrypting anything
• Server names inside QUIC / HTTP-3, which most tools simply report as unnamed
• Country and network operator for each destination
• Packet capture to .pcap — whole-device or a single app — openable in Wireshark
• Data-leak assessment: outbound volume, upload/download ratio, cleartext transfers, tracker contacts, and a per-app risk level

Control
• Per-app firewall: block an app on Wi-Fi, on mobile data, or everywhere
• Rule engine: app × destination × port × network × schedule, evaluated in order, first match wins
• Default-deny mode, per app or device-wide, for an allowlist rather than a blocklist
• Ad, tracker and malware blocking across four layers — DNS sinkhole, IP, TLS SNI, and QUIC
• Blocklist subscriptions: ten curated lists across ten categories, each switchable on its own
• Encrypted DNS (DoH/DoT), with an option to pull apps off their own resolver onto it
• Block by country, network operator or protocol
• Lockdown tile: one tap cuts everything off, including connections already open

Notice
• Threat-intelligence alerts when an app contacts a known-bad address
• Behavioural detection over metadata: command-and-control beaconing, algorithmically generated domains, DNS tunnelling, and weak TLS handshakes
• Auto-quarantine: a flagged app can be cut off automatically
• Alerts when the network changes underneath you — new resolvers, a new gateway, a proxy appearing
• A security report of what happened while you weren't looking, exportable as JSON

HOW IT HANDLES YOUR DATA

Everything is captured and processed on your device. Demarc has no servers. Your traffic, your connection history and your rules never leave the phone. Two features reach the internet on your behalf, and only after you switch them on: downloading blocklists, and downloading the IP-to-network database used to label destinations by country.

Payloads are never decrypted. Demarc reads metadata — hostnames, addresses, ports, sizes, DNS — not the contents of your encrypted traffic. It cannot read your messages, and it is not designed to.

WORTH KNOWING BEFORE YOU BUY

• Android allows one VPN at a time, so Demarc cannot run alongside another VPN app
• Per-app attribution needs Android 10 or newer
• Blocking is layered because no single layer catches everything. A domain hidden by Encrypted Client Hello is deliberately not blocked on the decoy name it presents
• Enforcement fails open by default: if something can't be judged, it's allowed through. There is a "fail closed" switch for people who want the other trade
• Detection results are heuristics. They point at patterns worth your attention, not proof of wrongdoing
• ICMP is shown but not forwarded, so ping won't traverse the tunnel while Demarc is running

Demarc is a demarcation point: the place where your device ends and everything else begins, and the place to decide what gets across.