NetCage refuses selected apps’ connections on your phone. The firewall does not send their traffic to a VPN server, but NetCage can connect for features you choose, including your account, backup, support, Cage Packs, telemetry, announcements and Play update checks. This policy explains each flow separately.
NetCage receives packets only from apps in Android UIDs you cage. To return a refusal, it examines the destination address and port in the IP and transport headers in memory; it does not inspect packet payloads, resolve a hostname, or keep a DNS, URL or traffic log. Apps outside a caged Android UID do not enter NetCage’s tunnel.
The full list of installed apps stays on your phone. If you remain signed out, the firewall does not upload the apps you cage. If you sign in and use backup, NetCage stores the package names you acted on, including apps you caged or hid and apps with custom icons, as part of your account configuration. If you publish a Cage Pack, its chosen package list becomes readable to anyone with its link. Analytics, crash reporting and announcements do not receive package names, profile names, notes or search text.
Yes. The firewall and Cage Pack import and reporting work signed out. Cloud backup, in-app support and publishing a Cage Pack require Google sign-in because those records need an owner. When you sign in, Google supplies your name and email address; Supabase stores the account identifier, contact row and versioned configuration. Backup can include rules, profiles, schedules, preferences, hidden apps, device details and references to custom icons.
A support request stores the message, its issue or request category, and any phone number you choose to add. Your signed-in email remains in Supabase Auth and NetCage’s contact row; it identifies the sender in the notification sent to the developer, but it is not copied into the support-request row. The request row also stores the app version, Android version and phone model. Bounded details from the last sync failure can appear in the developer notification only; they are not stored in the support row. No caged package names are attached. A phone number is optional and comes from Google’s Phone Number Hint sheet only after you choose it; NetCage holds no phone-number permission. Any reply belongs to your account and appears in the app; NetCage does not email reply notifications.
Anyone with the link can read the pack’s name, emoji and Android package list. Opening the link also returns an opaque publisher ID so another phone can recognise packs from the same publisher; it does not return your Google identity or Supabase user ID. Publishing needs an account and acceptance of the current Cage Pack terms. Importing creates an editable profile and leaves it switched off.
Reporting needs no account. NetCage creates a random token for this installation and sends it with the pack code, a reason and any details you type. The report service HMAC-hashes the token before storage, keeps only the hash, and uses it to suppress duplicate reports and limit report volume. The first valid report quarantines the pack from new imports while the developer reviews it. Blocking is different: NetCage stores that pack’s opaque publisher ID only on your phone and refuses future packs carrying the same ID until you unblock it in Settings.
Supabase hosts the NetCage account database and Edge Functions. FilesHub is the developer’s own storage and email service; selected custom icons reach it through an Edge Function, so its server key never enters the app. Usage analytics starts off. If you choose Share usage data, Google Analytics for Firebase and Amplitude receive bounded screen and feature events, while Microsoft Clarity can receive session interaction data from approved replay-safe screens. NetCage does not send these providers your Supabase account ID, name or email address. When crash reporting is on, Sentry keeps exception types, stack frames, bounded tags, and device and app details. NetCage drops event and exception messages, breadcrumbs and request data before sending the record. Announcements also starts off. NetCage requires consent before OneSignal initialises. If you turn Announcements on, NetCage gives SDK consent and opts the installation in; OneSignal can then receive a push token and subscription, sessions and app activity, notification interactions, device and app metadata, the country and IP address. Turning Announcements off opts the installation out and revokes SDK consent, stopping new OneSignal collection and announcement delivery. NetCage does not send OneSignal your Supabase account ID, name or email address.
Usage analytics and Clarity start off. If you choose Share usage data, NetCage still defers Clarity until you open Setup, Help or Other apps by the same developer. Its Compose integration masks the app’s root view and pauses capture on every sensitive or unknown route. Those routes may still contribute a bounded screen-view event. NetCage masks their content and pauses Clarity capture on those routes. The website does not use Clarity or any other session replay.
After you choose Share usage data, Firebase Analytics can receive the Android advertising ID and an app-instance identifier for analytics. Amplitude generates a random device identifier for this app installation, but receives no advertising ID, App Set ID, IP address or location fields. The house promotion uses no identifier. If you turn on Announcements, OneSignal uses a push token and subscription so an announcement can reach this installation. NetCage does not send OneSignal your Supabase account ID, name or email address. Turning Announcements off stops new OneSignal collection and delivery. The promotion for another app by the same developer is compiled into NetCage, makes no network request and reads no identifier. Settings lets you turn off Usage analytics, crash reports and announcements separately.
A Play-installed build asks Google Play whether an update is available and can open Play’s immediate update flow. Google handles that request through Play services. NetCage records only a bounded event that an update prompt was shown when Usage analytics is on.
Android’s system photo picker gives NetCage only the custom-icon image you select, without gallery or storage permission; the image stays on the phone and, while you are signed in, FilesHub also stores it so your backup can restore it. When you remove the icon, NetCage asks FilesHub to delete the stored object first. It removes the database reference only after FilesHub returns a 2xx response or confirms that the object is already absent with a 404 response. If FilesHub is unavailable or returns another status, NetCage keeps the reference and lets you retry. Account deletion follows that order. It covers every referenced object.
Android’s VPN consent lets NetCage establish the local tunnel; without it, the app cannot cage anything. Full package visibility fills the installed-app picker. Notifications show the required active-VPN notice and, if enabled, announcements. Boot access restores the cage after a restart. Exact alarms end schedules and day passes near the chosen time. The battery exemption reduces the chance that Android suspends the tunnel. Usage access is optional and powers on-device data totals. NetCage holds no camera, microphone, location, contacts, SMS, call-log, phone-number, media or storage permission.
NetCage uses an account database and server functions. Supabase runs both. Custom icons and website contact email use FilesHub. Google, Microsoft, Amplitude, Sentry and OneSignal can process their respective data in more than one country under their own terms. NetCage cannot promise that every optional service uses one jurisdiction.
Your contact row and backup configuration remain until you change them or delete the account. Device and support records, the publisher record and published packs remain until account deletion, or until the developer removes a pack or publisher record for moderation. Account deletion removes its database rows only after FilesHub returns 2xx or 404 for every referenced custom icon. Until then, the identity, references and other account rows remain so you can retry. A completed deletion includes published packs and reports attached to those packs. A report can remain with the moderation record after review while its pack exists. Provider telemetry and crash data follow each provider’s retention period; turning a Settings switch off stops new collection by that category. Website contact email and mailbox notification copies of in-app support requests sit outside the NetCage database and may remain in the developer’s mailbox until manually deleted. NetCage does not promise a fixed mailbox deletion period. Device-only settings and the report token disappear when NetCage’s app data is cleared or the app is uninstalled.
Website analytics starts denied. The public website can measure page views, bounded actions and errors through Google Analytics, Amplitude, Microsoft Clarity and Sentry only after you opt in. Clarity records a replay of your visit to this website; it masks text you type into form fields, and it never runs in the NetCage app’s sensitive screens, which are governed separately above. NetCage does not send these providers your Supabase account ID, name or email address. Google Analytics and Amplitude events carry the route and the fact that an action happened, not form text, an email address or a caged package name. Google Analytics can also receive browser and device details, an analytics identifier and an approximate region derived from the connection. Sentry error records retain exception types, stack frames, bounded tags, and device and app details; NetCage removes error messages, breadcrumbs, request fields and user fields before sending them. Amplitude assigns a random browser device identifier after that opt-in, while its IP and location fields remain disabled. The account route can read your Supabase account data only after you sign in.
The contact form sends your name, email address, subject and message to the developer as email through a Supabase Edge Function and FilesHub; it does not write the message to a NetCage database table. Cloudflare Turnstile may check the submission for automation. The mailbox copy sits outside the NetCage database, is not removed by account deletion, and may remain until manually deleted; no fixed deletion period is promised. Do not use the public contact form for a private in-app support reply: sign in and use Support for that.
NetCage is intended for people aged 18 and over, is not directed at children and does not knowingly collect their data; if you believe a child has created an account, use the contact page so the developer can remove it and its associated records.
Sign in on the website to export the configuration stored for your account; correct it in NetCage and sync again, or turn off optional telemetry, crash reports and announcements in Settings. Delete the cloud account from Settings ▸ Account ▸ Delete account. The public /delete-account page provides the web request path: follow its prominent link to /account, sign in with Google, and confirm Delete account. A completed deletion removes the account and its cloud records. If any referenced custom-icon request returns neither 2xx nor 404, the request keeps the identity and cloud records and returns a retryable failure. Your phone’s cages stay unchanged. Clear the app’s data or uninstall it to remove device-only records. Use the contact page for a question or complaint.
Delete your account in NetCage, or open /delete-account and follow its prominent link to the working Google sign-in and deletion-confirmation flow at /account. The server asks FilesHub to delete every referenced custom icon first. It accepts only a 2xx response or a 404 confirming that an object is already absent. If FilesHub is unavailable or returns another status, NetCage keeps the identity, every stored-icon reference and all other account rows, then returns a retryable failure. After every object is confirmed deleted or absent, it removes the identity, backup, contact and support rows, stored-icon references, publisher record and published Cage Packs. Separate contact-email and support-notification mailbox copies sit outside the NetCage database, may remain until manually deleted, and have no promised deletion period. Account deletion cannot be undone.
NetCage is developed by Ahsan Mahmood. Use the contact page for privacy questions, complaints or a request that the controls above do not cover.
Last updated 1 September 2026