Privacy Policy

Last updated: 30 August 2026

The short version: Aegis's core protection runs entirely on your device. It compares the hostnames your phone looks up against a list already downloaded to it, so your browsing history never leaves the device. There are no accounts, no analytics, no advertising identifier and nothing for sale. Two tools send something out, and only when you tap them.

1. Who this covers

This policy describes how Aegis ("Aegis", "the app", "we", "us") handles information. Aegis blocks ads, trackers and scam sites, and can check a link or a message you are unsure about. It is built by towr, an independent studio in Montréal.

2. The core protection runs entirely on your device

Aegis's always-on protection inspects the hostnames your device looks up (DNS) and compares them, locally, against its list of protected brands and known-bad domains. This core protection has no analytics, no tracking, and no accounts, and it does not collect, transmit, sell, or share your data:

Your browsing history never leaves your device. The record of what your phone looked up is stored only in Aegis's local storage. You can clear it at any time, or switch the recording off entirely and keep full protection.
Blocked-site records and any site you allow or block yourself are stored only on your device.
Aegis does not use the Advertising Identifier and does not track you across apps or websites.
There is no account and no sign-up. Aegis never asks for your name, email address or phone number.

Aegis installs a local VPN profile. That is the only mechanism iOS offers an app for filtering DNS on the device — it is not a VPN service, and your traffic is not routed through our servers.

3. The two checks you ask for

Aegis has two tools you operate by hand. Neither ever runs on its own, and nothing is sent until you tap.

Sent only when you tap

Check a link

When you paste a link (or send one to Aegis from another app's share sheet), that web address is sent to the Aegis service, which fetches the page and asks an AI model at Anthropic whether it is a fake payment or login page. The same address is also checked against Google Web Risk, Google's published list of known phishing and malware pages. The address and the page's visible text are used for that answer and then discarded.

Sent only when you tap

Check a message

When you paste or photograph a suspicious message, the text of that message is sent to the Aegis service and on to Anthropic for the same kind of answer, then discarded. If you photograph a message, the photo is read on your device and only the text is sent — the image itself never leaves your phone.

For both: we do not store the link or the message after answering, we do not build a profile from them, and they are not used to train any model. Anthropic and Google process them as our service providers, under their respective API terms, and neither trains on them. Nothing in either check identifies you: there is no account, and no name, email address, phone number or device identifier is sent with it.

4. What else Aegis sends

Sent automatically

Threat-list updates

Aegis periodically downloads its blocklist and ad/tracker list from the Aegis service. These are plain downloads — the request says nothing about you or where you have been.

Sent automatically

DNS lookups

Names your device looks up and that Aegis does not block are passed to the public DNS resolver you choose in Settings (Cloudflare, Google or Quad9). This is what your phone does anyway; Aegis lets you choose who answers, and can encrypt those lookups (DNS over TLS) so the network you are on cannot read or forge them.

Sent only when you tap

A wrongly-blocked site you report

If you tell us a site was blocked by mistake, Aegis sends only that site's name so a person can review it.

Sent only when you tap

A bug report you send

If you use "Send a bug report" in Settings, it sends what you wrote, the app version, and Aegis's own activity log — a record of what Aegis did, such as list updates and failures. It does not send the list of sites you looked up. You are shown the entire report before it is sent, and you choose whether to include your email address.

Stays on your device

Payment information

Aegis has no in-app purchases and processes no payment information. If you bought the app, that transaction is between you and Apple; we never see it.

5. Your controls

Turn protection on or off at any time.
Clear the record of recent lookups, or stop recording them entirely.
Allow or block any site yourself; your choice overrides Aegis's own verdict.
Choose which DNS resolver answers your lookups, and whether they are encrypted.
Turn off ad and tracker blocking.

6. Children

Aegis is not directed at children and collects no information from them.

7. Changes

If this policy changes materially, the updated version will be published here and the date above updated.

8. Contact

Questions about privacy: info@towr.dev