RWR

io.github.revocx35.rwr

Warns you when someone behind you looks at your screen (shoulder surfing)

Republished from GitHub / F-Droid by the Zapstore main account.

RWR watches through the **front camera** for people looking at your screen from behind (shoulder surfers). When it sees one, it: - pops up a card **over whatever app you are using** with a snapshot of the onlooker (boxed in red, with "laser eyes" showing where they look), - posts a notification, - saves a **photo or a short video clip** (for example 10 s before to 10 s after) to your gallery, and optionally to your own Immich server. It runs in the background and can be switched on and off from the **Quick Settings** panel. **Detection** - **Head tracking**: a face turned toward the screen counts as looking. Lightest on battery. - **Eye tracking**: follows the irises and combines them with head pose, so it alerts only when the eyes point at the screen. - Your own face is recognised and ignored, and faces too far away to read the screen don't count. - A **debug view** shows live what the detector sees and why each face counts or not. **Private by design** - Detection runs **on the phone**, offline, with bundled open-source models (YuNet and MediaPipe Face Landmarker). No analytics, no ads, no accounts. - Nothing leaves the phone unless you pair it with **your own RWR server** (Docker, open source, in the same repository). Then frames go only to your server, over TLS: detection runs there at full frame rate without draining your battery, and snapshots can be uploaded to Immich. - The camera is always off while the screen is off. Android shows its camera indicator while RWR is watching. Requires Android 10 or newer and a front camera. The pop-up needs the "Display over other apps" permission.

First release: Oct 13, 2026, 2 total releases.

Most recent release: Oct 20, 2026.

Repo

Appears in 0 app stacks.

0 sats / 0 zaps received in the past year.

Sats Received

Underlying data available via MCP: app_zaps, app_releases.

Zap Count

Underlying data available via MCP: app_zaps, app_releases.

Releases

Oct 20, 2026 1.6.0

Servers behind authentik. - If your RWR server sits behind [authentik](https://goauthentik.io) forward auth (e.g. Nginx Proxy Manager + authentik), RWR now signs in with authentik in the browser when pairing (OAuth 2 + PKCE), keeps an encrypted, revocable sign-in and renews it in the background. If authentik asks again, RWR shows a notification and a **Sign in with authentik** button in the Server section. - No server update needed. Setup: [docs/authentik.md](https://github.com/revocx35/RWR/blob/main/docs/authentik.md) (authentik client `rwr-android`). SHA-256: ``` 87e8559ebc6d983399bb1062553ca0f4b54ea8ce33f69ae9de187b2a0650f91e RWR-1.6.0-arm64-v8a.apk d43f0291641220ea0de19eb1e894972608080b5e13267bcd2a7bd0989c36cd36 RWR-1.6.0-armeabi-v7a.apk bcf73d340345c2e6aaff1f77aa8ba0a7dff293b0e63b6f7438213249b51ce6a6 RWR-1.6.0-universal.apk ```

More…

Signing certificate SHA-256: `0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675`
Oct 13, 2026 1.5.0

Open-source face detection, no telemetry, ready for F-Droid. - Face detection now uses the open-source YuNet detector (same as the RWR server) instead of Google ML Kit: about half the CPU, and good at small faces. - MediaPipe's usage-statistics client can no longer send anything: its Google telemetry transport is replaced by a do-nothing stand-in. - Fewer false alerts: far-away faces never count, every candidate face is verified, an onlooker must stay half a second. **Privacy note:** MediaPipe (eye tracking) contains a usage-statistics client that can send anonymous events to Google. Versions 1.1.0–1.4.0 had internet permission (for the RWR server), so it could have sent some. 1.5.0 removes the sending code entirely. SHA-256: ``` 56d3d39e858f5826271a6c4ed7cf795cf38b79b3b361fd414ea6af592c90cdff RWR-1.5.0-arm64-v8a.apk

More…

3a3b22d42ab8aa69dd4bbd63422247e48c116109667aa9cdb6c4bcda6b41d2c0 RWR-1.5.0-armeabi-v7a.apk 80dce229e769fcb9978fc6f5ffd33f9714316e26bf569b16d9f239f5f198c574 RWR-1.5.0-universal.apk ``` Signing certificate SHA-256: `0cc47cbec28c72addf57966d8aecf04e1636bc18d6dd75dfc90f2c47ee5d6675`